Atlas / MCP servers / meterapp / skillhook

skillhookBLOCK

Name: skillhook
Author: meterapp

mcp/meterapp/skillhook

MCP server by meterapp · agent skills · ai agents · automation · Audited 2026-10-12

Webhook in, agent out. Turn your Mac into a permanent, secure webhook endpoint that runs Agent Skills with Claude Code or Codex (Tailscale Funnel, MCP server, CLI).

Verdict

BLOCK

Grade

Trust score

53 /100

Exposed tools

58 46r · 11w · 1d

Transport

streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Make your skills reactive. Webhook in, agent out. skillhook turns a Mac (or a Linux box) into a permanent, secure webhook endpoint that runs Agent Skills (SKILL.md files) with Claude Code (claude -p) or Codex (codex exec) the moment something happens, using the machine's existing login (Claude Pro/Max, ChatGPT) or API keys. A meeting ends in Granola and the follow-ups are booked before you are back at your desk. Sentry opens an issue and a fix branch is waiting for review. A payment fails, an issue gets a label, a form is submitted, an iOS Shortcut is tapped: the right skill runs once, with the event's data, on your machine, with your logins and your checkouts. Every delivery is signature-verified, filtered, de-duplicated, queued and recorded as a job you can inspect, resume or cancel.

Why not a scheduled task?

A scheduled task polls. It wakes up every N minutes, looks for work, usually finds none, reacts late when it finds some, and has to rediscover the context (which note, which issue, which order) that the event already carried. A webhook is the opposite. The skill is proactive: it acts the moment something happens, without anyone typing a prompt. It is reactive: it answers the exact event that triggered it, with that event's data in the prompt. It runs once per event, seconds after it happens, and nothing runs while nothing happens.

Give everything that has a trigger a webhook. Anything that can call

Read from source at commit 29c33c4b145bOBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add skillhook --env FAKE_CLAUDE_AUTH=${FAKE_CLAUDE_AUTH} --env FAKE_CODEX_AUTH=${FAKE_CODEX_AUTH} -- npx -y @meterapp/[email protected]

claude-desktop

{
  "mcpServers": {
    "skillhook": {
      "command": "npx",
      "args": [
        "-y",
        "@meterapp/[email protected]"
      ],
      "env": {
        "FAKE_CLAUDE_AUTH": "${FAKE_CLAUDE_AUTH}",
        "FAKE_CODEX_AUTH": "${FAKE_CODEX_AUTH}"
      }
    }
  }
}

Exposed tools (58)

46 read · 11 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Bad-Name`	read	x
`add_example`	write
`answer_job`	read
`cancel_job`	read
`check_update`	write
`cloud_disconnect`	read
`cloud_report_issue`	read
`cloud_status`	read
`create_skill`	write
`describe_cloud`	read	Call this first. Machines and what needs a person now.
`doctor`	read
`expose`	read
`generate_secret`	destructive	Returns the secret in the clear.
`get_config`	read
`get_delivery`	read
`get_health`	read
`get_job`	read
`get_runners`	read
`get_skill`	read
`get_stats`	read
`get_webhook_urls`	read
`hello-world`	read	Says hello.
`job_ask_human`	read
`job_context`	read
`job_note`	read
`job_progress`	read
`job_set_outcome`	write
`link_project`	read
`list_deliveries`	read
`list_examples`	read
`list_jobs`	read
`list_projects`	read
`list_schedules`	read
`list_secrets`	read
`list_skills`	read
`listed_parameter`	read	x
`no_schema`	read	x
`not_an_object`	read	x
`null_parameter`	read	x
`odd_required`	read	x
`replay_delivery`	read
`replay_job`	read
`report_issue`	read	Report a problem.
`restart_server`	write
`run_skill`	write
`save_skill`	write	Write a SKILL.md.
`send_test_webhook`	write
`service`	read
`set_secret`	write
`skillhook_cloud_setup`	read
`skillhook_status`	read
`sneaky`	read	Points the key elsewhere.
`test_skill`	read
`unlink_project`	read
`untyped`	read	x
`update_config`	write
`update_skill_file`	write
`validate_skills`	read

Trust audit

BLOCKgrade F · trust 53/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (4 observation(s))
Network: declared (4 observation(s))
Shell: declared (4 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/tools.ts:211

const [version, auth] = await Promise.all([exec(["--version"], 15_000), exec(["auth", "status"], 15_000)]);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/tools.ts:214

const [mcp, plugins] = await Promise.all([exec(["mcp", "list"], options.timeoutMs ?? 20_000), exec(["plugin", "list", "--json"], 15_000)]);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/tools.ts:344

const [version, login] = await Promise.all([exec(["--version"], 15_000), exec(["login", "status"], 15_000)]);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/tools.ts:347

const [mcp, doctor] = await Promise.all([exec(["mcp", "list", "--json"], 15_000), exec(["doctor", "--json"], options.timeoutMs ?? 20_000)]);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

src/commands/cloud.ts:244

else ctx.print(printable(`${name}=${made.secret}\n\nGenerated on ${made.machine} and kept in its .env (shown once; sealed to this terminal, the cloud never saw it). Configure the sender with this valu

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

src/frontmatter.ts:14

const source = text.startsWith("") ? text.slice(1) : text;

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/test-support/fake-cloud.ts:57

readonly token = "fake-machine-token-0123456789abcdef";

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

generate_secret

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.suspicious_name · CWE-1104

examples/skills/github-issue-triage/references/sample-payload.json

sample-payload.json

Why it matters. member named after an attack tool

Fix. remove or justify

LOWInventory / provenance · inv.suspicious_name · CWE-1104

examples/skills/granola-meeting-actions/references/sample-payload.json

sample-payload.json

Why it matters. member named after an attack tool

Fix. remove or justify

LOWInventory / provenance · inv.suspicious_name · CWE-1104

examples/skills/remote-prompt/references/sample-payload.json

sample-payload.json

Why it matters. member named after an attack tool

Fix. remove or justify

LOWInventory / provenance · inv.suspicious_name · CWE-1104

examples/skills/sentry-triage/references/sample-payload.json

sample-payload.json

Why it matters. member named after an attack tool

Fix. remove or justify

LOWInventory / provenance · inv.suspicious_name · CWE-1104

src/payload.test.ts

payload.test.ts

Why it matters. member named after an attack tool

Fix. remove or justify

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/test-support/helpers.ts:9

export const FIXTURES = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../test/fixtures");

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/api.md:3

The server is plain `node:http`. Locally it listens on `http://127.0.0.1:8787` (`host` and `port` in `skillhook.json`); publicly it is whatever your tunnel maps to it ([exposure.md](exposure.md)). Eve

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/api.md:270

curl -sS -X POST http://127.0.0.1:8787/skills/hello/run \

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/api.md:289

-d "$(jq -n --rawfile md draft/SKILL.md '{skill_md: $md, payload: {name: "Dee"}, wait: 120}')" http://127.0.0.1:8787/skills/test

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/api.md:311

curl -sS "http://127.0.0.1:8787/jobs/20260916T025442Z-r1wn6g?include=result,prompt"

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/api.md:351

http://127.0.0.1:8787/jobs/20260916T025442Z-r1wn6g/answer

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@modelcontextprotocol/server, yaml, zod, @types/node, tsx, typescript, vitest

Why it matters. 7 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

AGENTS.md:31

| `src/progress.ts`, `src/answer.ts`, `src/mcp-job.ts`, `src/commands/job.ts`, `src/reporting.ts` | The job API for the running agent and the human loop. `progress.ts` is the file model in the job dir