Atlas / MCP servers / jasoncolapietro / Suede Creator Skills

Suede Creator SkillsBLOCK

mcp/jasoncolapietro/suede-creator-skills

Open-source AI skills for SEO, AI search visibility, conversion copy, marketing strategy, and business operations. Reusable workflows for Claude Code and Codex, plus code review, app delivery, and creator tools.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
28 21r · 7w · 0d
Transport
stdio
License
MIT
Stars
127
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](#the-skills) [](NOTICE.md) [](#install-in-30-seconds) [](#install-in-30-seconds) [](#mcp-server) [](https://www.skillsdirectory.com/skills/jasoncolapietro-suede-design) [](https://github.com/JasonColapietro/suede-creator-skills/stargazers)

Install · The skills · [Docs site](https://skills.suedeai.ai/) · [Skill catalog](https://skills.suedeai.ai/skills/) · [Blog](https://skills.suedeai.ai/blog/) · MCP · [@johnnysuede](https://x.com/johnnysuede)

By Jason Colapietro / Suede AI

Suede Creator Skills for SEO and business growth

Suede Creator Skills gives founders, marketers, and small teams reusable workflows for SEO audits, AI search visibility, conversion copy, and business operations. Run them in Claude Code or OpenAI Codex, with instructions you can inspect and adapt to your business.

Start with the business task:

  • Search visibility: audit a page with suede-seo-audit, or plan content for AI search with suede-ai-seo.
  • Positioning and conversion:
Read from source at commit 2792928dd1c1OBSERVED · 2026-10-07
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add suede-skills-mcp -- npx -y [email protected]
03

Exposed tools (28)

21 read · 7 write · 0 destructive.

ToolRiskDescription
actionreadPrimary action the page should drive.
catalogwriteStructured Suede skill, install, MCP, and public link catalog.
code-gradereadA-F code grading scaffold for diffs, PRs, branches, MCP servers, plugins, APIs, app surfaces, and release candidates.
copy-seo-auditreadFull SEO/AEO/AI EO copy audit scaffold for Suede public pages, docs, repos, and skill pages.
get_suede_skillreadReturn details for one Suede skill, optionally including its full SKILL.md instructions.
intentreadPrimary search intent or reader action.
list_suede_skillsreadList Suede skills available through the current MCP profile.
list_suede_specialtiesreadList the pack
pluginsreadPublic Codex skill installs, local plugin notes, and MCP options.
qa-checklistreadMulti-agent QA checklist for skill, MCP, docs, local plugin notes, and public site changes.
scopereadfast, full, release, seo, or mcp.
search_suede_skillsreadRank Suede skills against a task description and return the best-matching routes.
specialtiesreadThe pack
suede-code-gradereadGrade a code change A-F for ship risk, explain why, and list required upgrades.
suede-copy-seo-auditreadAudit a Suede page, README, skill page, or docs surface for SEO, AEO, AI EO, and copy quality.
suede-full-qawriteCreate a multi-agent QA plan for a Suede skill, MCP, docs, local plugin note, or site change.
suede-graph-flo-xrreadBounded Suede Thought Graph shipping search: Generate -> Score -> KeepBestN -> paired Refute -> Improve -> Aggregate -> Select -> winner-only Build -> Gate -> Handoff
suede-plugin-installwriteExplain public skill, local plugin, MCP, and skill-copy install options.
suede-ship-copyreadCopy-only DAG: intake -> multi-lens research -> claim audit -> angle panel -> section map with message ownership -> disjoint section writers -> assemble -> four-lens review -> adversarial refute -> deslop -> graphic spec + channel package -> publish-readiness gate -> evidence handoff
suede-visibility-gradereadGrade a public page A-F for findability, CTA pull, proof, AI readability, design signal, and action clarity.
suede_code_gradewriteCreate a Suede A-F code grading scaffold for a diff, PR, branch, MCP server, plugin, API, app surface, public-site change, or release candidate.
suede_copy_seo_auditwriteCreate a Suede-specific SEO/AEO/AI EO copy audit scaffold for a page, repo, or docs surface.
suede_install_optionswriteReturn public Codex skill, local plugin, MCP, and skill-copy install options.
suede_qa_checklistreadGenerate a multi-lane QA checklist for Suede skills, local plugin notes, MCP servers, docs, or public pages.
suede_visibility_gradewriteCreate a Suede A-F visibility and CTA grading scaffold for a public page, docs surface, repo page, launch page, or campaign page.
surfacereadcodex, mcp, claude, plugin, or all.
targetreadURL, file, repo, or page to audit.
visibility-gradereadA-F website visibility and CTA grading scaffold for public pages, docs, repos, launch pages, and campaign pages.
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (15 observation(s))
Network
declared (6 observation(s))
Shell
declared (5 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (25)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
skills/suede-release-linter/scripts/lint_release.py:72
".netrc",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
skills/suede-release-linter/scripts/lint_release.py:77
"id_ed25519",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
skills/suede-release-linter/scripts/lint_release.py:78
"id_rsa",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
skills/suede-rights-passport/scripts/create_transfer_package.py:72
".netrc",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
skills/suede-rights-passport/scripts/create_transfer_package.py:77
"id_ed25519",
Why it matters. touches a credential store
LOWInventory / provenance · inv.binary · CWE-1104
skills/suede-release-linter/scripts/fixtures/sample-clean-project/audio/paper-moons-master.wav
paper-moons-master.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
skills/suede-release-linter/scripts/fixtures/sample-clean-project/stems/bass-stem.wav
bass-stem.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
skills/suede-release-linter/scripts/fixtures/sample-clean-project/stems/drums-stem.wav
drums-stem.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
skills/suede-release-linter/scripts/fixtures/sample-clean-project/stems/vocals-stem.wav
vocals-stem.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
.codexignore
.codexignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.plugin-scanner.toml
.plugin-scanner.toml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
docs/.nojekyll
.nojekyll
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/build-skill-cards.mjs:179
lines.push(`${plugin.author.name}, Suede AI (<${plugin.author.url}>). Security contact: \`[email protected]\` per [SECURITY.md](../../SECURITY.md).`);
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/build-skill-cards.mjs:185
`Pack license: MIT ([LICENSE](../../LICENSE)). This skill additionally bundles third-party licensed material — see ${bundledLicenses
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/build-skill-cards.mjs:190
lines.push(`MIT ([LICENSE](../../LICENSE)). The pack's combined license expression is \`${plugin.license}\`; this skill bundles no third-party licensed material of its own.`);
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/build-skill-cards.mjs:241
"- Security policy and reviewed scanner exceptions: [SECURITY.md](../../SECURITY.md) and [`.plugin-scanner.toml`](../../.plugin-scanner.toml) at the repo root",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/build-skill-cards.mjs:261
`${version} — the pack is single-versioned, so every skill releases together; see [VERSION](../../VERSION) and [CITATION.cff](../../CITATION.cff) for the release identifier this card describes.`,
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
skills/suede-play-release/scripts/play-preflight.py:54
return json.loads(base64.b64decode(result.stdout.strip()))
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/cracked.html:674
Obviously not medical advice, not an actual stimulant, and no pharmacy is involved: it's four Markdown folders. The only thing this stack doses is your token bill, and the skills say so on their own l
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/llms.txt:40
- [Suede Play Release](https://skills.suedeai.ai/skills/suede-play-release.html): Google Play delivery where every claim is a readback: credential preflight against the live API, AAB signature and ver
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/skills/index.html:1092
<div class="row-wrap"><a class="row" href="./suede-play-release.html"><b>suede-play-release</b><span>Google Play delivery: credential preflight, AAB verification, promote instead of re-upload, staged
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOInventory / provenance · inv.oversize · CWE-1104
docs/assets/location-stamps.png
docs/assets/location-stamps.png
Why it matters. 2683635 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
docs/assets/og-image.png
docs/assets/og-image.png
Why it matters. 1340282 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
docs/assets/passport-hero.png
docs/assets/passport-hero.png
Why it matters. 2488929 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
docs/assets/social/award-76-skills.png
docs/assets/social/award-76-skills.png
Why it matters. 1300088 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-07 · audit v0.4.1 · source sha 2792928dd1c1full audit observations/trust-audit/mcp-server/jasoncolapietro__suede-creator-skills.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-072792928dd1c1BLOCKD69first audit
06

Questions

What is the Suede Creator Skills MCP server?

Open-source AI skills for SEO, AI search visibility, conversion copy, marketing strategy, and business operations. Reusable workflows for Claude Code and Codex, plus code review, app delivery, and creator tools.

What tools does Suede Creator Skills expose?

28 in total: 21 read-only, 7 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Suede Creator Skills safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Suede Creator Skills need?

No credential environment variables were found in its source, so it appears to need none.

How does Suede Creator Skills run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as suede-creator-skills at 0.19.1.

How current is this page?

The grade is for one exact copy of the source (2792928dd1c1), read on 2026-10-07. The repository is watched and re-audited when it changes.

Advertisement