TASKVEGAS / capability
SkillSpector static rule scan: setup, supported tools and cost
Scan supplied skill text with eight pinned SkillSpector rule families. Runs on TaskVegas; no installation, API key or model call. This restricted rule pass does not run the complete scanner or certify safety. Review requirements, permissions and verification before connecting.
Verified live for the evidence specified below.
What you can do
Scan supplied skill text with eight pinned SkillSpector rule families. Runs on TaskVegas; no installation, API key or model call. This restricted rule pass does not run the complete scanner or certify safety.
taskvegas_scan_skill— reads information
Setup and execution
- Execution
- On the TaskVegas server
- Requirements
- No provider key required. Workspace activation and OAuth permission are still required.
- Who pays
- Free within the existing gateway limits; your AI host may have its own charges.
Create or recover a workspace, save the required connection, test it, enable the module, then approve the exact tools in your OAuth-capable MCP client. Searching the catalog grants no execution permission.
Permissions and boundaries
- Process bounded inline text with a reviewed fixed upstream component
Free within shared hosted limits. Findings/normalization require review and do not establish complete agent or skill safety.
Only the named typed operations are available. Responses may be truncated; check returned identifiers, source links and error details before acting. Existing quotas and the operator pause switch apply. There is no owner-paid fallback.
Source and review evidence
- Adapter version
- taskvegas-reviewed-component-1
- Reviewed
- 2026-10-27 · TaskVegas primary review and independent Python/security review
- Contract evidence
- local-tested
- MCP client evidence
- verified; account evidence: not-required
- Reviewed revision
- d325b0719521c7136dad8055ec8eb4c624b97f6a
- Implementation
- server/gateway/repository-tools.js
Actual Azure execution through fresh authenticated Node MCP SDK and REST grants; source/negative/revocation controls and resource-constrained Linux benchmark recorded. Named AI hosts and complete upstream apps are not verified.
Selected SkillSpector static rule tables: Apache-2.0 with upstream third-party notices; full contextual/LLM scanner excluded.
Official source and documentation