Dashform

• Verdict: Pass
• Confidence: Medium
• Analyzed: Feb 25, 2026, 2:32 PM
• Findings: 0
• Version: 0.1.0

Overview

The skill's files and runtime instructions are internally consistent with a form-creation integration that uses the Dashform MCP API, but it asks you to paste a browser session cookie (sensitive) and contains a small documentation/wording inconsistency about the server location—so review and caution are warranted before use.

This skill generally does what it claims (create forms via the Dashform MCP API), but it requires you to supply a browser session cookie value (better-auth.session_token). Before installing: 1) Verify you trust https://getaiform.com — using a site session cookie grants access to that account. 2) Prefer a documented API key or OAuth flow if available; avoid pasting session cookies for unrelated sites. 3) Inspect the included scripts (setup-credentials.sh and create-form.sh) — they do not persist the session token but will store userId/organizationId/userName/userEmail in .claude/skills/dashform/credentials.json unencrypted. 4) If you proceed, run the scripts in a controlled environment and ensure the credentials.json file has appropriate filesystem permissions. 5) Ask the skill author to clarify the 'local server' vs https://getaiform.com wording and to offer a less sensitive authentication method.