Why this verdict
- inconclusive: gap frontmatter_unparseable at SKILL.md
- inconclusive: gap no_tools_extracted at server.json
- inconclusive: gap skill_frontmatter_invalid at SKILL.md
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the coverage gaps below; 1 candidate finding was refuted on review.
Refuted findings 1
Candidates the review stage examined and rejected, kept for transparency.
Supply chain
criticalRefutedmedium confidenceInstall docs direct users to download server.js from a mutable API URL (not the pinned npm package) and run it with node, so the executed code can change at any time without review.
curl -sS https://api.screenverity.com/mcp/server.js -o ~/.screenverity/server.js
Why it was refuted
The curl line sits in a fenced install block of the vendor's own docs. It fetches the vendor's own dependency-free server from the vendor's own API, which is the openly stated install method, so it falls under the vendor-installer carve-out. It is not concealed and does not contradict any declaration. The lack of a pin or checksum is a hardening gap, not undeclared harmful behavior.
Coverage gaps 3
Parts of the artifact the static analysis could not fully examine.
skill_frontmatter_invalid missing name/description frontmatter
SKILL.md
frontmatter_unparseable no closed frontmatter block
SKILL.md
no_tools_extracted MCP server target with no statically extractable tools/prompts/resources
server.json
