github.com/datadog/dd-trace-php · master · scanned 2 h ago · 7 config files

7 agent components (2 MCP servers), declared 8 times in datadog/dd-trace-php: 2 credentials handed to agents, 5 unvetted.

Components72 MCP servers
High blast radius1credentials, shell or unvetted code
Credentials handed to agents2GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_API_URL
Not vetted5of 6 local servers, skills and plugins
ComponentWhereVerdictBlast radius
gitlabMCP server · Claude Code · stdionpm:@modelcontextprotocol/server-gitlab
.mcp.json66 · caution
high
  • is handed 2 credentials: GITLAB_PERSONAL_ACCESS_TOKEN, GITLAB_API_URL
  • runs on the developer's machine with their files, network and shell
  • its verdict is Caution (66/100)
GITLAB_PERSONAL_ACCESS_TOKENGITLAB_API_URL
speak_when_doneMCP server · Claude Code · stdiouvx
.mcp.jsonnot vetted
medium
  • runs on the developer's machine with their files, network and shell
  • is not a registry package, so there is no verdict to check
check-ciSkill · Claude Code
.claude/skills/check-ci/SKILL.mdnot vetted
low
  • adds instructions and scripts the agent will follow
  • has no KillerSkills verdict yet
CLAUDE.mdInstructions · any agent
CLAUDE.mdclean
low
  • is read by the agent as instructions on every session
CLAUDE.mdInstructions · any agent
appsec/helper-rust/CLAUDE.mdclean
low
  • is read by the agent as instructions on every session
crash-analysisSkill · Claude Code
.claude/skills/crash-analysis/SKILL.mdnot vetted
low
  • adds instructions and scripts the agent will follow
  • has no KillerSkills verdict yet
php-lintSkill · Claude Code
.claude/skills/php-lint/SKILL.mdnot vetted
low
  • adds instructions and scripts the agent will follow
  • has no KillerSkills verdict yet
release-notesSkill · Claude Code
.claude/skills/release-notes/SKILL.mdnot vetted
low
  • adds instructions and scripts the agent will follow
  • has no KillerSkills verdict yet
What to do about it
  • Each credential listed is readable by the server it is given to. Scope keys to what that server needs, and prefer servers with a Verified verdict for anything holding cloud or payment keys.
  • Unvetted means we have no sandbox run for that exact package. Ask your agent to check before installing: claude mcp add killerskills -- npx -y vet-skills mcp
  • For a whole organization (every repo and laptop, rescanned daily, with removal across machines), see Discovery for teams.
Share: https://killerskills.ai/scan/github/datadog/dd-trace-phpRescan nowScan another