Atlas / MCP servers / hasna / Skills release source

Skills release sourceBLOCK

mcp/hasna/skills

Open-source Skills CLI, SDK, MCP, and service

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
62 39r · 18w · 5d
Transport
stdio · streamable-http
License
Apache-2.0
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

This repository is the public, standalone release source for `@hasna/skills`. The package source, CLI, MCP server, SDK, service, tests and release checks are in apps/skills.

This repository contains Skills software. Skill instructions, executable bundles, account catalogs, aliases and selection profiles are user or operator data held outside the software repository. Publishing a package here does not publish anyone's skills.

Development uses Bun 1.3.14 and the lockfile in apps/skills:

cd apps/skills
bun install --frozen-lockfile --ignore-scripts --backend copyfile
bun run typecheck
bun run build
bun test
bun run verify:release

The root release workflow requires a protected-main commit, an independently reviewed annotated tag bound to the packed archive, and npm provenance with registry integrity readback. See the package's release procedure for the linkage format. Package publication remains disabled until the repository protection, required-reviewer environment and npm trusted-publisher binding have been configured and verified.

Licensed under Apache-2.0; see LICENSE.

Read from source at commit f00ffe967b4cOBSERVED · 2026-10-11
Advertisement
02

Exposed tools (62)

39 read · 18 write · 5 destructive. Blast radius: 5 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
FixturereadPreserved
accept_invitation_email_challengeread
amd-skillsreadAMD skills
atomic-agentsreadAgents
cancel_private_publicationread
claude-plugins-officialreadDirectory of popular Claude Code extensions
cloud_skill_eligibilityread
context7readDocs lookup
create_api_keywriteCreate a key with fresh email OTP reauthentication; returns the secret once.
describe_toolsreadReturn structured descriptions for named tools.
detect_project_skillsreadDetect project type and recommended skills.
download_run_artifactwriteReturn verified artifact bytes as base64, bounded to 1 MiB.
export_skillsreadExport pinned skills as a portable JSON payload.
get_mcp_contractsreadReturn the machine-readable MCP tool and resource contract manifest.
get_private_publicationread
get_requirementsreadGet env vars, system deps, and package dependencies for a skill.
get_run_statuswriteFetch remote run status and next actions. Returns a compact status summary by default; pass detail:true for the complete remote run payload.
get_skill_docsreadGet skill documentation.
get_skill_inforeadGet skill metadata, env vars, dependencies, and MCP schemas.
get_skill_tool_dependenciesreadGet primitive tool dependencies for one skill.
get_tool_primitivereadGet one primitive tool definition by name.
heartbeatwriteUpdate agent last_seen_at.
import_skillswritePin skills from an export payload.
leave_workspaceread
list_agentsreadList registered in-memory agent sessions.
list_api_keysreadList keys using fresh email OTP reauthentication.
list_categoriesreadList skill categories with counts.
list_pinned_skillsreadList project-pinned skills from .skills/project.json.
list_schedulesreadList scheduled skill runs as a compact paged envelope.
list_skillsreadList skills from the basic or full registry profile. Returns a compact paged envelope by default.
list_tagsreadList all skill tags with counts.
list_tool_primitiveswriteList primitive tools used by skills across CLI, MCP, API, and hosted worker execution.
list_workspace_membersreadRead one current-workspace roster page with fresh owner/admin email verification; saved credentials stay unchanged.
new-pluginreadAdded by a refresh
pin_categoryreadPin all skills in a category.
pin_skillreadPin a skill in project state.
port_skillwriteImport an existing skill folder into the portable ~/.hasna/skills/installed/<name> standard.
publish_private_skillwrite
quote_skillwriteGet a server credit quote without submitting a run.
register_agentreadRegister an agent session and return an agent id.
remove_scheduledestructiveRemove a schedule by id or name.
remove_workspace_memberdestructiveRemove exactly this membership incarnation using its observed expectedRole and fresh verification; self-removal is unavailable.
request_invitation_email_challengeread
resume_private_publicationread
revoke_api_keydestructiveRevoke a key using fresh email OTP reauthentication.
run_skillwriteRun a skill locally or through a configured remote runner. Returns compact stdout/stderr previews and run summaries by default; pass detail:true for full records.
scaffold_skillwriteCreate a portable skill folder under ~/.hasna/skills/installed/<name> from the standard template.
schedule_skillwriteCreate a cron schedule for a skill.
search_skillsreadSearch skills by name, description, or tags. Returns a compact paged envelope by default.
search_toolsreadList tool names or summaries, optionally filtered by keyword.
send_feedbackwriteStore local feedback for this service.
set_focusdestructiveSet or clear active project context for an agent.
set_workspace_member_rolewriteSet an exact membership incarnation
storage_statusreadShow on-box storage paths and optional repo-owned Postgres/S3 readiness.
storage_sync_planwritePlan .skills snapshot sync for optional Postgres/S3 storage without network access.
swift-lspreadSwift language server (SourceKit-LSP) for code intelligence
unpin_skilldestructiveRemove a skill pin from project state.
update_account_profilewriteUpdate your display name with fresh email verification on the configured server.
update_workspace_namewriteUpdate the current workspace name as an owner/admin with fresh email verification.
validate_skillreadValidate a skill directory using the shared skill validator.
validate_tool_primitivesreadValidate primitive tool coverage for the bundled skill catalog.
whoamiwriteShow package, install, and agent setup details.
03

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (11 observation(s))
Network
declared (2 observation(s))
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (22)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
apps/skills/src/lib/portable-snapshot-filter.ts:87
/^id_rsa/,
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
apps/skills/src/lib/portable-snapshot-filter.ts:88
/^id_ed25519/,
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
apps/skills/src/lib/skill-bundle.ts:69
".netrc",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
apps/skills/src/lib/skill-bundle.ts:72
".git-credentials",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
apps/skills/src/lib/skill-bundle.ts:74
"id_rsa",
Why it matters. touches a credential store
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
apps/skills/src/lib/vendor-host-policy.ts:53
{ domain: "169.254.169.254", reason: "AWS EC2 instance metadata address, hard-coded by the bundled AWS SDK." },
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
apps/skills/src/cli/commands/runtime-copyfile.ts:807
expected?: AliasPackageChain, verify = false,
Why it matters. certificate verification is disabled
Fix. leave verification on
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
remove_schedule, remove_workspace_member, revoke_api_key, set_focus, unpin_skill
Why it matters. 5 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
apps/skills/src/lib/codex-corpus-guard.test.ts:23
const permit = new Function("child", "deny", "corpusFstat", "corpusLstat", "corpusRealpath", "Bun", "corpusMock", source + "return corpusPermits;")(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
apps/skills/src/lib/unconfigured-client-boundary.test.ts:978
'new Function("return true")();', 'import("./config.js");', 'require("./config.js");',
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/skills/src/cli/cli.test-utils.ts:4
import pkg from "../../package.json" with { type: "json" };
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/skills/src/cli/commands/agent-integration.ts:1
import { captureSumiSettings } from "../../lib/sumi-settings-witness.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/skills/src/cli/commands/agent-integration.ts:8
import { isDiscoveryRootUnresolved, type ReviewedDiscoveryInputs } from "../../lib/agent-discovery.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/skills/src/cli/commands/agent-integration.ts:9
import { normalizeHermesHookInput, assertHermesTool } from "../../lib/agent-hermes.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/skills/src/cli/commands/agent-integration.ts:11
import { AGENT_ADAPTERS, INTEGRATION_AGENTS, normalizeAgentHookEvent } from "../../lib/agent-adapters.js";
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/skills/README.md:2009
export SKILLS_PUBLIC_BASE_URL=http://127.0.0.1:8787
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/skills/src/cli/cli.profile-hooks-e2e.test.ts:54
const origin = `http://127.0.0.1:${server.port}`;
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/skills/src/cli/cli.profile-hooks-e2e.test.ts:203
put(join(hostile, ".env"), "HASNA_SKILLS_API_URL=http://127.0.0.1:9\n");
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/skills/src/cli/cli.profile-hooks-e2e.test.ts:755
const codexHome = join(f.a.home, ".codex"), localProvider = `http://127.0.0.1:${modelServer.port}/v1`;
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/skills/src/cli/cli.profile-hooks-e2e.test.ts:804
const child = Bun.spawn([nativeClaude!, "--print", "--output-format", "json", "--model", "fixture-model", "review this fixture; respond without tools"], { cwd: f.a.project, env: { ...f.a.env, CLAUDE_C
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
apps/skills/package.json
@aws-sdk/client-ecs, @aws-sdk/client-s3, @modelcontextprotocol/sdk, chalk, commander, ink, ink-select-input, ink-spinner
Why it matters. 15 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
apps/skills/README.md:2620
an endpoint, read credentials, or provide guest IPC or authorization.
Why it matters. asks the agent to read credentials

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha f00ffe967b4cfull audit observations/trust-audit/mcp-server/hasna__skills.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11f00ffe967b4cBLOCKD69first audit
05

Questions

What is the @hasna/skills MCP server?

Open-source Skills CLI, SDK, MCP, and service

What tools does @hasna/skills expose?

62 in total: 39 read-only, 18 that write, and 5 that can delete or overwrite (remove_schedule, remove_workspace_member, revoke_api_key, set_focus, unpin_skill). Every one is listed on this page with its risk.

Is @hasna/skills safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 5 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does @hasna/skills need?

It reads CREDENTIAL_PROOF_BOOTSTRAP, CREDENTIAL_PROOF_DENY, CREDENTIAL_PROOF_JOURNAL, CREDENTIAL_PROOF_VALUE, HASNA_SECRETS_API_KEY, HASNA_SECRETS_API_URL, HASNA_SKILLS_API_KEY and HASNA_SKILLS_API_KEY_REF from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does @hasna/skills run?

It speaks stdio and streamable-http, so it runs as a local process your client starts.

How current is this page?

The grade is for one exact copy of the source (f00ffe967b4c), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement