dsh-skills-anywhere

Name: dsh-skills-anywhere
Author: io.github.noteflowai

MCPattested

v0.12.1io.github.noteflowaiUnknownUpdated 2d agonpm GitHub

Discover and load Agent Skills from configured local directories and Git sources over stdio MCP.

Works in

ClaudeCursorCopilotGemini

Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Attested build

A verified provenance attestation binds this artifact to the listed repository. Nobody has claimed the listing yet — this proves where the code was built, not who stands behind it.

6GitHub stars

2d agoLast update

Package

Authorio.github.noteflowai

LicenseUnknown

Version0.12.1

Sourcenpm+mcp-registry

npmdsh-skills-anywhere

GitHubnoteflowai/dsh-skills-anywhere

SBOMCycloneDX 1.6 ↓

Trust Status

85/100Trusted

✓Listed in Forge index+10/10

✓Identity verified · attested build+20/20

—Ed25519 publish signature+0/5

→ Included automatically when the publisher runs `forge publish`

—Domain verification+0/5

→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }

✓npm Trusted Publishing (Sigstore)+5/5

—npm maintainer match+0/5

→ Publisher: add the verified GitHub login to the npm package's maintainers (npm owner add <login>)

✓CVE scan · clean+30/30

✓Static analysis · clean+20/20

Paste into Claude Code, Cursor, or any AI assistant to fix all gaps

StatusIdentity verified

PublisherUnverified

SignatureUnsigned

Domain—

Provenance✓ Sigstore-verified · 31bce4e

Dependencies✓ 6 resolved · none vulnerable

Tool surface3 tools · none privileged

Security scan✓ Cleanv0.12.1 · 1d agoHow well does this scan work?

EvalsNone

IndexedSep 14, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

3 tools · none privileged

Statically extracted from the published packagev0.12.1 · 1d ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

list_skillsList installed Agent Skills (name, description, origin) available through this server. Use find_skills to search a large pool instead of paging through it.

List installed Agent Skills (name, description, origin) available through this server. Use find_skills to search a large pool instead of paging through it.

No input schema was published for this tool.

find_skillsSearch installed Agent Skills by keyword across names, descriptions and origins. Returns the best matches; load one with open_skill.

Search installed Agent Skills by keyword across names, descriptions and origins. Returns the best matches; load one with open_skill.

No input schema was published for this tool.

open_skillLoad the full instructions of an installed Agent Skill by exact name, together with the directory its scripts and references live in.

Load the full instructions of an installed Agent Skill by exact name, together with the directory its scripts and references live in.

No input schema was published for this tool.

3 of 3 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

Discover and load Agent Skills from configured local directories and Git sources over stdio MCP.

Keywords

mcp

Alternatives

Comparing tool surfaces…

dsh-skills-anywhere

Tools

Tools exposed

Dependency tree