Skills release sourceBLOCK
Open-source Skills CLI, SDK, MCP, and service
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
This repository is the public, standalone release source for `@hasna/skills`. The package source, CLI, MCP server, SDK, service, tests and release checks are in apps/skills.
This repository contains Skills software. Skill instructions, executable bundles, account catalogs, aliases and selection profiles are user or operator data held outside the software repository. Publishing a package here does not publish anyone's skills.
Development uses Bun 1.3.14 and the lockfile in apps/skills:
cd apps/skills bun install --frozen-lockfile --ignore-scripts --backend copyfile bun run typecheck bun run build bun test bun run verify:release
The root release workflow requires a protected-main commit, an independently reviewed annotated tag bound to the packed archive, and npm provenance with registry integrity readback. See the package's release procedure for the linkage format. Package publication remains disabled until the repository protection, required-reviewer environment and npm trusted-publisher binding have been configured and verified.
Licensed under Apache-2.0; see LICENSE.
f00ffe967b4cOBSERVED · 2026-10-11Exposed tools (62)
39 read · 18 write · 5 destructive. Blast radius: 5 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
Fixture | read | Preserved |
accept_invitation_email_challenge | read | |
amd-skills | read | AMD skills |
atomic-agents | read | Agents |
cancel_private_publication | read | |
claude-plugins-official | read | Directory of popular Claude Code extensions |
cloud_skill_eligibility | read | |
context7 | read | Docs lookup |
create_api_key | write | Create a key with fresh email OTP reauthentication; returns the secret once. |
describe_tools | read | Return structured descriptions for named tools. |
detect_project_skills | read | Detect project type and recommended skills. |
download_run_artifact | write | Return verified artifact bytes as base64, bounded to 1 MiB. |
export_skills | read | Export pinned skills as a portable JSON payload. |
get_mcp_contracts | read | Return the machine-readable MCP tool and resource contract manifest. |
get_private_publication | read | |
get_requirements | read | Get env vars, system deps, and package dependencies for a skill. |
get_run_status | write | Fetch remote run status and next actions. Returns a compact status summary by default; pass detail:true for the complete remote run payload. |
get_skill_docs | read | Get skill documentation. |
get_skill_info | read | Get skill metadata, env vars, dependencies, and MCP schemas. |
get_skill_tool_dependencies | read | Get primitive tool dependencies for one skill. |
get_tool_primitive | read | Get one primitive tool definition by name. |
heartbeat | write | Update agent last_seen_at. |
import_skills | write | Pin skills from an export payload. |
leave_workspace | read | |
list_agents | read | List registered in-memory agent sessions. |
list_api_keys | read | List keys using fresh email OTP reauthentication. |
list_categories | read | List skill categories with counts. |
list_pinned_skills | read | List project-pinned skills from .skills/project.json. |
list_schedules | read | List scheduled skill runs as a compact paged envelope. |
list_skills | read | List skills from the basic or full registry profile. Returns a compact paged envelope by default. |
list_tags | read | List all skill tags with counts. |
list_tool_primitives | write | List primitive tools used by skills across CLI, MCP, API, and hosted worker execution. |
list_workspace_members | read | Read one current-workspace roster page with fresh owner/admin email verification; saved credentials stay unchanged. |
new-plugin | read | Added by a refresh |
pin_category | read | Pin all skills in a category. |
pin_skill | read | Pin a skill in project state. |
port_skill | write | Import an existing skill folder into the portable ~/.hasna/skills/installed/<name> standard. |
publish_private_skill | write | |
quote_skill | write | Get a server credit quote without submitting a run. |
register_agent | read | Register an agent session and return an agent id. |
remove_schedule | destructive | Remove a schedule by id or name. |
remove_workspace_member | destructive | Remove exactly this membership incarnation using its observed expectedRole and fresh verification; self-removal is unavailable. |
request_invitation_email_challenge | read | |
resume_private_publication | read | |
revoke_api_key | destructive | Revoke a key using fresh email OTP reauthentication. |
run_skill | write | Run a skill locally or through a configured remote runner. Returns compact stdout/stderr previews and run summaries by default; pass detail:true for full records. |
scaffold_skill | write | Create a portable skill folder under ~/.hasna/skills/installed/<name> from the standard template. |
schedule_skill | write | Create a cron schedule for a skill. |
search_skills | read | Search skills by name, description, or tags. Returns a compact paged envelope by default. |
search_tools | read | List tool names or summaries, optionally filtered by keyword. |
send_feedback | write | Store local feedback for this service. |
set_focus | destructive | Set or clear active project context for an agent. |
set_workspace_member_role | write | Set an exact membership incarnation |
storage_status | read | Show on-box storage paths and optional repo-owned Postgres/S3 readiness. |
storage_sync_plan | write | Plan .skills snapshot sync for optional Postgres/S3 storage without network access. |
swift-lsp | read | Swift language server (SourceKit-LSP) for code intelligence |
unpin_skill | destructive | Remove a skill pin from project state. |
update_account_profile | write | Update your display name with fresh email verification on the configured server. |
update_workspace_name | write | Update the current workspace name as an owner/admin with fresh email verification. |
validate_skill | read | Validate a skill directory using the shared skill validator. |
validate_tool_primitives | read | Validate primitive tool coverage for the bundled skill catalog. |
whoami | write | Show package, install, and agent setup details. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (11 observation(s))
- Network
- declared (2 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (22)
/^id_rsa/,
/^id_ed25519/,
".netrc",
".git-credentials",
"id_rsa",
{ domain: "169.254.169.254", reason: "AWS EC2 instance metadata address, hard-coded by the bundled AWS SDK." },expected?: AliasPackageChain, verify = false,
remove_schedule, remove_workspace_member, revoke_api_key, set_focus, unpin_skill
const permit = new Function("child", "deny", "corpusFstat", "corpusLstat", "corpusRealpath", "Bun", "corpusMock", source + "return corpusPermits;")('new Function("return true")();', 'import("./config.js");', 'require("./config.js");',import pkg from "../../package.json" with { type: "json" };import { captureSumiSettings } from "../../lib/sumi-settings-witness.js";import { isDiscoveryRootUnresolved, type ReviewedDiscoveryInputs } from "../../lib/agent-discovery.js";import { normalizeHermesHookInput, assertHermesTool } from "../../lib/agent-hermes.js";import { AGENT_ADAPTERS, INTEGRATION_AGENTS, normalizeAgentHookEvent } from "../../lib/agent-adapters.js";export SKILLS_PUBLIC_BASE_URL=http://127.0.0.1:8787
const origin = `http://127.0.0.1:${server.port}`;put(join(hostile, ".env"), "HASNA_SKILLS_API_URL=http://127.0.0.1:9\n");
const codexHome = join(f.a.home, ".codex"), localProvider = `http://127.0.0.1:${modelServer.port}/v1`;const child = Bun.spawn([nativeClaude!, "--print", "--output-format", "json", "--model", "fixture-model", "review this fixture; respond without tools"], { cwd: f.a.project, env: { ...f.a.env, CLAUDE_C@aws-sdk/client-ecs, @aws-sdk/client-s3, @modelcontextprotocol/sdk, chalk, commander, ink, ink-select-input, ink-spinner
an endpoint, read credentials, or provide guest IPC or authorization.
Gates applied: no_behavioural_pass.
f00ffe967b4cfull audit observations/trust-audit/mcp-server/hasna__skills.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | f00ffe967b4c | BLOCK | D | 69 | first audit |
Questions
What is the @hasna/skills MCP server?
Open-source Skills CLI, SDK, MCP, and service
What tools does @hasna/skills expose?
62 in total: 39 read-only, 18 that write, and 5 that can delete or overwrite (remove_schedule, remove_workspace_member, revoke_api_key, set_focus, unpin_skill). Every one is listed on this page with its risk.
Is @hasna/skills safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 5 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @hasna/skills need?
It reads CREDENTIAL_PROOF_BOOTSTRAP, CREDENTIAL_PROOF_DENY, CREDENTIAL_PROOF_JOURNAL, CREDENTIAL_PROOF_VALUE, HASNA_SECRETS_API_KEY, HASNA_SECRETS_API_URL, HASNA_SKILLS_API_KEY and HASNA_SKILLS_API_KEY_REF from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @hasna/skills run?
It speaks stdio and streamable-http, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (f00ffe967b4c), read on 2026-10-11. The repository is watched and re-audited when it changes.