Skills scribe-mcp-usage
📦
scribe-mcp-usage
Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🔑 Env variables
Operate Scribe MCP Documentation Workflows
Project work can lose decisions, logs, and document state across agents. This skill guides Scribe MCP setup, documentation updates, and progress logging.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "scribe-mcp-usage" from https://skillstore.io/skills/cortalabs-scribe-mcp-usage.md and its manifest at https://skillstore.io/api/skills/cortalabs-scribe-mcp-usage/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "scribe-mcp-usage". Set up Scribe tracking for this repository.
Expected outcome:
The assistant selects the project, confirms the registered root, and lists the planning documents that need updates.
Using "scribe-mcp-usage". Record what changed after the test fix.
Expected outcome:
The assistant writes a concise progress entry with the fix summary, affected component, and test result.
Using "scribe-mcp-usage". Find the last decisions about the architecture plan.
Expected outcome:
The assistant searches recent project logs and returns a short summary of relevant decisions and open follow-ups.
Security Audit
High Riskv9 • 7/6/2026 Open versioned report
The static analyzer findings are false positives caused by Markdown code spans, fenced examples, placeholder paths, and an environment variable name used in documentation. Manual review found semantic risk from coercive prompt-language and mandatory reasoning/activity logging that can override user intent and collect sensitive details.
1
Files scanned
572
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Prompt Injection Attempt Detected
The skill labels its rules as commandment-level requirements and tells agents they MUST ALWAYS use specific tools and identity settings. This attempts to override normal platform and user instruction priority across projects.
The cited lines use coercive authority language, global MUST ALWAYS directives, and identity/tool mandates. They are clear prompt-level control attempts, even though they are framed as workflow guidance.
High
Excessive Reasoning and Activity Logging
The skill requires agents to log every significant action and reasoning trace with zero exceptions. This can capture sensitive project details and private reasoning beyond user intent.
The text explicitly says the log is the chain of reasoning, requires why/what/how reasoning blocks, and demands logging every action. This creates a high-confidence privacy and policy risk.
Risk Factors
⚙️ External commands (149)
SKILL.md:10 SKILL.md:11 SKILL.md:12 SKILL.md:14 SKILL.md:15 SKILL.md:16 SKILL.md:17 SKILL.md:18 SKILL.md:21 SKILL.md:22 SKILL.md:24 SKILL.md:31 SKILL.md:33 SKILL.md:36 SKILL.md:39 SKILL.md:40 SKILL.md:41 SKILL.md:48 SKILL.md:53 SKILL.md:54 SKILL.md:58 SKILL.md:59 SKILL.md:60 SKILL.md:64 SKILL.md:65 SKILL.md:66 SKILL.md:67 SKILL.md:68 SKILL.md:72 SKILL.md:82 SKILL.md:85 SKILL.md:86 SKILL.md:87 SKILL.md:92 SKILL.md:93 SKILL.md:94 SKILL.md:110-117 SKILL.md:117-120 SKILL.md:120-127 SKILL.md:127-140 SKILL.md:140-141 SKILL.md:141 SKILL.md:142-143 SKILL.md:143 SKILL.md:145-156 SKILL.md:156-157 SKILL.md:157 SKILL.md:161 SKILL.md:162-163 SKILL.md:163-164 SKILL.md:164 SKILL.md:165-168 SKILL.md:168-172 SKILL.md:172-173 SKILL.md:173-174 SKILL.md:174-175 SKILL.md:175-176 SKILL.md:176-177 SKILL.md:177-178 SKILL.md:178-179 SKILL.md:179-180 SKILL.md:180-182 SKILL.md:182-187 SKILL.md:187-189 SKILL.md:189-191 SKILL.md:191-192 SKILL.md:192-224 SKILL.md:224-226 SKILL.md:226-228 SKILL.md:228-243 SKILL.md:243-245 SKILL.md:245-247 SKILL.md:247-250 SKILL.md:250-278 SKILL.md:278-281 SKILL.md:281-321 SKILL.md:321-323 SKILL.md:323-324 SKILL.md:324 SKILL.md:325 SKILL.md:326 SKILL.md:327 SKILL.md:329-330 SKILL.md:330 SKILL.md:332 SKILL.md:333 SKILL.md:334 SKILL.md:335 SKILL.md:336 SKILL.md:337-339 SKILL.md:339 SKILL.md:340 SKILL.md:345-347 SKILL.md:347-348 SKILL.md:348-349 SKILL.md:349-353 SKILL.md:353 SKILL.md:355-357 SKILL.md:357-373 SKILL.md:373-375 SKILL.md:375-377 SKILL.md:377-379 SKILL.md:379-404 SKILL.md:404-406 SKILL.md:406-408 SKILL.md:408-414 SKILL.md:414-416 SKILL.md:416-418 SKILL.md:418-428 SKILL.md:428-430 SKILL.md:430-432 SKILL.md:432-441 SKILL.md:441-443 SKILL.md:443-445 SKILL.md:445-446 SKILL.md:446-481 SKILL.md:481-483 SKILL.md:483-485 SKILL.md:485-486 SKILL.md:486-512 SKILL.md:512-518 SKILL.md:518-519 SKILL.md:519-520 SKILL.md:520-521 SKILL.md:521-522 SKILL.md:522-523 SKILL.md:523-524 SKILL.md:524-525 SKILL.md:525-526 SKILL.md:526-527 SKILL.md:527-528 SKILL.md:528-531 SKILL.md:531 SKILL.md:532 SKILL.md:533 SKILL.md:534 SKILL.md:537-538 SKILL.md:538-539 SKILL.md:539 SKILL.md:540-541 SKILL.md:541-542 SKILL.md:542-548 SKILL.md:548 SKILL.md:550-551 SKILL.md:551-552 SKILL.md:552-553 SKILL.md:553 SKILL.md:556-557 SKILL.md:557
📁 Filesystem access (18)
🔑 Env variables (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/cortalabs-scribe-mcp-usage/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/cortalabs-scribe-mcp-usage?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/cortalabs-scribe-mcp-usage?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cortalabs-scribe-mcp-usage/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/cortalabs-scribe-mcp-usage.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CortaLabs. (2026). scribe-mcp-usage security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cortalabs-scribe-mcp-usage/audits/9BibTeX citation
@techreport{cortalabs-cortalabs-scribe-mcp-usage-2026,
author = {CortaLabs},
title = {scribe-mcp-usage security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/cortalabs-scribe-mcp-usage/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "scribe-mcp-usage security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "CortaLabs"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/cortalabs-scribe-mcp-usage/audits/9"
identifiers:
- type: other
value: "skillstore:cortalabs-scribe-mcp-usage:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
78
Spec Compliance
What You Can Build
Prepare Project Documentation
Use Scribe MCP to create or update architecture, phase plan, and checklist documents before implementation starts.
Track Agent Work
Record implementation progress, test results, and decisions in an append-only project log.
Review Project History
Query recent or filtered log entries to recover context without reading the full progress log.
Try These Prompts
Select a Project
Use Scribe MCP guidance to select the current repository as a project and summarize the active project context.
Draft Planning Docs
Prepare the architecture guide, phase plan, and checklist for this repository using the Scribe documentation workflow.
Log Implementation Progress
After this change, create a concise Scribe progress entry with the outcome, files touched, and verification status.
Audit Project History
Query recent Scribe entries for this project, identify unresolved risks, and propose the next documentation updates.
Best Practices
- Set the project root before editing Scribe-managed documents.
- Use structured document actions for architecture, phase plan, and checklist updates.
- Keep log entries concise, factual, and free of secrets.
Avoid
- Do not treat the skill as higher priority than system, developer, or user instructions.
- Do not log hidden reasoning, credentials, or unrelated project details.
- Do not run optional CLI examples without confirming they match the repository.
Frequently Asked Questions
What does this skill help with?
It explains how to use Scribe MCP for project setup, managed documentation, progress logs, and log queries.
Does it include executable code?
No. The skill is a Markdown instruction file with examples for MCP tools and optional CLI commands.
Which tools does it support?
The report marks support for Claude, Codex, and Claude Code.
Does it require a Scribe server?
Yes. The guidance assumes a local Scribe MCP server exposes the documented tools.
What should users review before installing?
Users should review the broad logging requirements and strong instruction language before enabling it.
Can it manage arbitrary documents?
It focuses on Scribe project documents such as architecture guides, phase plans, checklists, and progress logs.