Report 01M7DNN3C1XS0H690G03YH7T9F · checks-v2
sentiment skill: automated checks
What HostedMCP checked on 14 Nov 2026, 18:38 UTC. Every result links to the public source it came from, so you can check it yourself.
7 of 7 checks ran · 0 high findings · not a security audit
- Checked
- 14 Nov 2026, 18:38 UTC
- Files read
- SKILL.md and scripts
- Methodology
- checks-v2
What to fix for a higher score
One check can earn more points. The next scan runs within a week, or right after the repository changes.
- SKILL.md follows the Agent Skills format up to +5 pts
Start SKILL.md with front matter holding a
name(lowercase letters, digits and hyphens, the same as the folder) and adescriptionunder 1,024 characters that says what the skill does and when to use it.
Origin
25 / 25 points- PassSource repository linked and reachable10 pts
apache/magpie/plugins/magpie-contributor-growth/skills/sentiment is public and reachable
github.com/apache/magpie/tree/HEAD/plugins/magpie-contributor-growth/s ↗ - Pass
- Pass
Scripts
30 / 30 points- PassNo download-and-run or credential theft in scripts30 pts
No scripts in the skill folder
Instructions to the agent
30 / 30 points- PassNo hidden instructions in SKILL.md20 pts
No override phrases, safeguard switches, credential requests or hidden characters
github.com/apache/magpie/blob/HEAD/plugins/magpie-contributor-growth/s ↗ - PassPre-approved tools are scoped10 pts
No pre-approved tools; the agent asks before using one
github.com/apache/magpie/blob/HEAD/plugins/magpie-contributor-growth/s ↗
Format
10 / 15 points- PartialSKILL.md follows the Agent Skills format10 / 15 pts
the description does not say when to use the skill
github.com/apache/magpie/blob/HEAD/plugins/magpie-contributor-growth/s ↗How to fix: Start SKILL.md with front matter holding a
name(lowercase letters, digits and hyphens, the same as the folder) and adescriptionunder 1,024 characters that says what the skill does and when to use it.
What these checks do not cover
- Scripts are read, never run. Their logic is not audited, and up to five scripts per skill are read.
- Results describe the skill folder on the date above; a later commit can differ.
- A pass is not a guarantee of safety. Read the scripts before you let an agent run them, and keep allowed-tools narrow.