plugin-only-agent-surface-gating-fea30e — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plugin-only-agent-surface-gating-fea30e (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Domain: permission-gating Trigger: Apply this when an agent tries to extend its MCP surface while the session enforces plugin-only MCP access. Source Pattern: Distilled from reviewed agent trust-boundary and plugin-only surface-gating implementations.
Before connecting any agent-specific MCP servers, check whether the session is locked to plugin-only extension mode. If it is, allow the extra MCP connections only for trusted agent definitions such as built-ins or approved plugins. Untrusted or user-controlled agent definitions should continue without creating new clients, while logging the gating decision clearly. This prevents policy bypasses without breaking trusted packaged agents.
When running in a highly regulated environment, reuse this heuristic before initializing agent MCP servers so only pre-approved agents can expand the MCP surface and user scripts cannot sneak new servers in.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.