← All skills
audit-posture
80 / 100 · Low risk
Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.
By melodic-software/claude-code-plugins (GitHub) · coding · 30 stars · scanned at commit 677e798
Audit the MCP servers configured in Claude Code for supply-chain posture, meaning whether each one is safe to run. Use when: 'is it safe to run my MCP servers', 'mcp supply chain', 'floating MCP versions', 'npx @latest MCP', 'MCP server inventory', 'mcp posture', 'unpinned MCP server', 'which MCP servers run on my host'. Reads user, local, project, managed, and passed-in config statically through a bundled inventory script and returns a dated, diffable inventory (scope, transport, launcher, pac…
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 425 places.
Show 17 more
- plugins/mcp-tools/skills/audit-posture/scripts/inventory.sh, line 518
elif $b == "uvx" then pkgrow("uvx"; $t[1:] | py_pkg; py_spec) | with_index($t[1:]) - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 107
"shared": {"command": "npx", "args": ["-y", "shared-user@1.0.0"]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 108
"pu": {"command": "npx", "args": ["pu-user@1.0.0"]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 109
"useronly": {"command": "uvx", "args": ["useronly==1.0.0"]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 110
"dis": {"command": "npx", "args": ["dis@1.0.0"]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 111
"corp": {"command": "npx", "args": ["corp-user@1.0.0"]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 112
"ghp_LEAKNAMEDIS1": {"command": "npx", "args": ["gh@1.0.0"]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 113
"evil\tna\nme\u001b[31m": {"command": "npx", "args": ["ctl@1.0.0"]} - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 118
"shared": {"command": "npx", "args": ["shared-local@1.0.0"]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 119
"localonly": {"command": "npx", "args": ["localonly@1.0.0"]} - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 127
"mcpServers": {"otherproj": {"command": "npx", "args": ["other@1.0.0"]}} - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 136
"shared": {"command": "npx", "args": ["shared-project@1.0.0"]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 137
"pu": {"command": "npx", "args": ["pu-project@1.0.0"]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 138
"projonly": {"command": "npx", "args": ["projonly@1.0.0"]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 139
"rejected": {"command": "npx", "args": ["rejected@1.0.0"]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 140
"projdis": {"command": "npx", "args": ["projdis@1.0.0"]} - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 148
"npx-bare": {"command": "npx", "args": ["-y", "bare-mcp"]},
and 405 more places
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 6 places.
Show 3 more
- plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 1216
"c303":{"command":"pwsh","args":["-c","bash -c \"'X=1' zqy304\""]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 1218
"c306":{"command":"bash","args":["-c","bash -c \"'X=1' zqy307\""]}, - plugins/mcp-tools/skills/audit-posture/scripts/inventory.test.sh, line 1219
"c307":{"command":"cmd","args":["/c","bash -c \"'X=1' zqy308\""]},
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'audit-posture' ] || [ -L ~/.agents/skills/'audit-posture' ]; then echo 'A skill folder named audit-posture already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/melodic-software/claude-code-plugins' "$d" && git -C "$d" checkout --quiet '677e7988f432dacb5e2d4df2b124f96da8e8f9f3' -- 'plugins/mcp-tools/skills/audit-posture' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/mcp-tools/skills/audit-posture' ~/.agents/skills/'audit-posture' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'audit-posture' ~/.claude/skills/'audit-posture' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for melodic-software/claude-code-plugins shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/melodic-software/claude-code-plugins/)
Score history
| Date | Version | Score |
|---|
| 2026-11-09 | 677e798 | 80 |
| 2026-11-07 | 81c7244 | 80 |