Report 01M7D7BAFK55N0WWER4W23GQXF · checks-v2
python-stinger skill: automated checks
What HostedMCP checked on 14 Nov 2026, 14:28 UTC. Every result links to the public source it came from, so you can check it yourself.
7 of 7 checks ran · 0 high findings · not a security audit
- Checked
- 14 Nov 2026, 14:28 UTC
- Files read
- SKILL.md and scripts
- Methodology
- checks-v2
What to fix for a higher score
2 checks can earn more points. The next scan runs within a week, or right after the repository changes.
- Open source license (OSI) up to +10 pts
Add a LICENSE file and name it by its SPDX id in the SKILL.md front matter, for example
license: MIT. - No download-and-run or credential theft in scripts up to +5 pts
Ship readable source, not compiled files, and remove from the script named above what made it fail: downloading and running code, running decoded or remote content, or reading credentials and sending them out. When more than five scripts exist, the ones not read earn nothing.
Origin
15 / 25 points- PassSource repository linked and reachable10 pts
legioncodeinc/vibe-coding-tools/plugins/backend-and-desktop-tools/skills/python-stinger is public and reachable
github.com/legioncodeinc/vibe-coding-tools/tree/HEAD/plugins/backend-a ↗ - FindingOpen source license (OSI)10 pts
AGPL-3.0-or-later is not OSI-approved
spdx.org/licenses/AGPL-3.0-or-later.html ↗How to fix: Add a LICENSE file and name it by its SPDX id in the SKILL.md front matter, for example
license: MIT. - PassCommit or release in the last year5 pts
Last commit 2026-10-18
github.com/legioncodeinc/vibe-coding-tools/commits ↗
Scripts
25 / 30 points- PartialNo download-and-run or credential theft in scripts25 / 30 pts
5 of 6 scripts read; none of them downloads and runs code, the rest were not read
How to fix: Ship readable source, not compiled files, and remove from the script named above what made it fail: downloading and running code, running decoded or remote content, or reading credentials and sending them out. When more than five scripts exist, the ones not read earn nothing.
Instructions to the agent
30 / 30 points- PassNo hidden instructions in SKILL.md20 pts
No override phrases, safeguard switches, credential requests or hidden characters
github.com/legioncodeinc/vibe-coding-tools/blob/HEAD/plugins/backend-a ↗ - PassPre-approved tools are scoped10 pts
No pre-approved tools; the agent asks before using one
github.com/legioncodeinc/vibe-coding-tools/blob/HEAD/plugins/backend-a ↗
Format
15 / 15 points- PassSKILL.md follows the Agent Skills format15 pts
Valid name and description; says when to use it; 182 lines
github.com/legioncodeinc/vibe-coding-tools/blob/HEAD/plugins/backend-a ↗
What these checks do not cover
- Scripts are read, never run. Their logic is not audited, and up to five scripts per skill are read.
- Results describe the skill folder on the date above; a later commit can differ.
- A pass is not a guarantee of safety. Read the scripts before you let an agent run them, and keep allowed-tools narrow.