REPORT 01M7CZAZG031NEZP1JBXH5CS90 · checks-v2
setup skill: automated checks
What HostedMCP checked on 14 Nov 2026, 12:08 UTC in apache/magpie/plugins/magpie-setup/skills/setup on the default branch. Every result links to the public source it came from, so you can check it yourself.
Not verified
73/100
7 of 7 checks ran · 0 high findings · not a security audit
- Checked
- 14 Nov 2026, 12:08 UTC
- Files read
- SKILL.md and scripts
- Methodology
- checks-v2
Origin
25 / 25 points- LolosSource repository terhubung dan dapat dijangkau10 pts
apache/magpie/plugins/magpie-setup/skills/setup is public and reachable
github.com/apache/magpie/tree/HEAD/plugins/magpie-setup/skills/setup ↗ - Lolos
- LolosAda commit atau release dalam satu tahun terakhir5 pts
Last commit 2026-11-12
github.com/apache/magpie/commits ↗
Scripts
8 / 30 points- SebagianSkrip tanpa unduh-lalu-jalankan atau pencurian kredensial8 / 30 pts
5 of 18 scripts read; none of them downloads and runs code, the rest were not read
Instructions to the agent
30 / 30 points- LolosTidak ada instruksi tersembunyi di SKILL.md20 pts
No override phrases, safeguard switches, credential requests or hidden characters
github.com/apache/magpie/blob/HEAD/plugins/magpie-setup/skills/setup/S ↗ - LolosTool yang diizinkan otomatis dibatasi10 pts
No pre-approved tools; the agent asks before using one
github.com/apache/magpie/blob/HEAD/plugins/magpie-setup/skills/setup/S ↗
Format
10 / 15 points- SebagianSKILL.md mengikuti format Agent Skills10 / 15 pts
the description does not say when to use the skill
github.com/apache/magpie/blob/HEAD/plugins/magpie-setup/skills/setup/S ↗
What these checks do not cover
- Scripts are read, never run. Their logic is not audited, and up to five scripts per skill are read.
- Results describe apache/magpie/plugins/magpie-setup/skills/setup on the date above; a later commit can differ.
- A pass is not a guarantee of safety. Read the scripts before you let an agent run them, and keep allowed-tools narrow.