{ "executive_summary": { "badge": "Unsafe", "security_score": null, "view": "composite", "aggregate_verdict_withheld": false, "aggregate_verdict_withheld_reason": null, "scanner_badges": { "agentshield": "not_applicable", "cisco-skill-scanner": "Unsafe", "agent-audit-kit": "Unsafe", "bearer": "not_applicable", "nerlo-behavioral": "not_applicable", "nerlo-install-instruction": "Verified", "capslock": "not_applicable" }, "finding_counts": { "critical": 32, "high": 17, "medium": 28, "low": 18, "informational": 83 }, "recommendation": "accessibility-audit is NOT recommended for integration: the scan surfaced 32 critical and 17 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering." }, "source_provenance": { "repository_url": "https://github.com/charlesjones-dev/claude-code-plugins-dev", "commit_sha_scanned": null, "license": null, "maintainer": null, "name": "accessibility-audit", "version": null }, "per_scanner_detail": [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.39175900601549074, "status": "not_applicable", "examined": { "unit": "scan_targets", "count": 0 }, "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [] }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/skills/swift-preflight/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/skills/swift-verify/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/skills/swift-diagnose/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/skills/swift-ci-scaffold/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/skills/swift-concurrency-review/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-geo/skills/geo-llms-txt/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-geo/skills/geo-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-geo/skills/geo-fix/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-workflow/skills/workflow-preflight/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-workflow/skills/workflow-rules/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-workflow/skills/workflow-principles/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-workflow/skills/workflow-ship/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-seo/skills/seo-fix/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-seo/skills/seo-schema/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-seo/skills/seo-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-compliance/skills/compliance-license-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-compliance/skills/compliance-notice-generate/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-accessibility/skills/accessibility-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-statusline/skills/statusline-wizard/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-statusline/skills/statusline-edit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-timesheet-report/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-init/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-log-story-work/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-create-story/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-work-items/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-create-task/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-create-feature/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-writing/skills/writing-humanize/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-absorb/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-import/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-upgrade/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-search/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-ingest/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-query/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-harvest/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-init/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-remove/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-load/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-auto/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-list/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-add/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-discover/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-organize/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-learn/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-prune/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-performance/skills/performance-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-modernize/skills/modernize-scan/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-modernize/skills/modernize-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-git/skills/git-commit-push-pr/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-git/skills/git-commit-push/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-git/skills/git-pr-codex-loop/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 66, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 84, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 174, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Testing", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 221, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Testing", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 264, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 286, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 287, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 523, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 538, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 598, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Proceed without user", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 599, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 645, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Testing", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 652, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Testing", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-security/skills/security-scan-dependencies/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-security/skills/security-supply-chain/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-supply-chain/SKILL.md", "line_number": 92, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-supply-chain/SKILL.md", "line_number": 306, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Proceed without user", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-supply-chain/SKILL.md", "line_number": 307, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": 60, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": 78, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": 223, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": 238, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": 288, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Proceed without user", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": 289, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-security/skills/security-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/.", "line_number": null, "rule_identifier": "EXCESSIVE_FILE_COUNT", "title": "Skill package contains many files", "description": "Skill package contains 115 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.", "remediation": "Review file inventory and remove unnecessary files." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/.DS_Store", "line_number": null, "rule_identifier": "UNANALYZABLE_BINARY", "title": "Unanalyzable binary file", "description": "Binary file 'plugins/ai-ado/.DS_Store' cannot be inspected by the scanner. Reason: Binary file () - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.", "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/plugins/ai-ado/.DS_Store", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: plugins/ai-ado/.DS_Store. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/.DS_Store", "line_number": null, "rule_identifier": "BINARY_FILE_DETECTED", "title": "Binary file detected in skill package", "description": "Binary file found: plugins/ai-ado/.DS_Store. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.", "remediation": "Review binary file necessity. Replace with auditable scripts if possible." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-swift/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-geo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-geo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-workflow/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-workflow/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-seo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-seo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-compliance/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-compliance/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-accessibility/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-accessibility/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-statusline/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-statusline/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/.DS_Store", "line_number": null, "rule_identifier": "UNANALYZABLE_BINARY", "title": "Unanalyzable binary file", "description": "Binary file '.DS_Store' cannot be inspected by the scanner. Reason: Binary file () - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.", "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/plugins/ai-ado/.DS_Store", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .DS_Store. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/.DS_Store", "line_number": null, "rule_identifier": "BINARY_FILE_DETECTED", "title": "Binary file detected in skill package", "description": "Binary file found: .DS_Store. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.", "remediation": "Review binary file necessity. Replace with auditable scripts if possible." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-ado/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-writing/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-writing/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-knowledge/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-performance/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-performance/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-modernize/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-modernize/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-git/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-git/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-security/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-security/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-accessibility/agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-performance/agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-modernize/agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-security/agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 12.9835099959746, "status": "complete", "examined": { "unit": "skills", "count": 76 }, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "swift-preflight", "swift-verify", "swift-diagnose", "swift-ci-scaffold", "swift-concurrency-review", "geo-llms-txt", "geo-audit", "geo-fix", "workflow-preflight", "workflow-rules", "workflow-principles", "workflow-ship", "seo-fix", "seo-schema", "seo-audit", "compliance-license-audit", "compliance-notice-generate", "accessibility-audit", "statusline-wizard", "statusline-edit", "ado-timesheet-report", "ado-init", "ado-log-story-work", "ado-create-story", "ado-work-items", "ado-create-task", "ado-create-feature", "writing-humanize", "kb-absorb", "kb-import", "kb-upgrade", "kb-search", "kb-ingest", "kb-query", "kb-harvest", "kb-init", "kb-remove", "kb-load", "kb-auto", "kb-list", "kb-add", "kb-discover", "kb-organize", "kb-learn", "kb-prune", "performance-audit", "modernize-scan", "modernize-audit", "git-commit-push-pr", "git-commit-push", "git-pr-codex-loop", "git-init", "security-scan-dependencies", "security-supply-chain", "security-init", "security-audit", "repo", "ai-swift", "ai-geo", "ai-workflow", "ai-seo", "ai-compliance", "ai-accessibility", "ai-statusline", "ai-ado", "ai-writing", "ai-knowledge", "ai-performance", "ai-modernize", "ai-git", "ai-security", "swift-release-auditor", "accessibility-auditor", "performance-auditor", "modernize-auditor", "security-auditor" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 18, "high": 0, "medium": 24, "critical": 0, "informational": 78 }, "artifact_type_policy": "claude_skill" }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 25, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 28, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 30, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 34, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 50, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 51, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 51, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 51, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 51, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 64, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 81, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 157, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 89, "rule_identifier": "AAK-AGENT-002", "title": "Agent instructions reference external URLs", "description": "Agent instruction files reference external URLs that could serve as C2 channels or data exfiltration endpoints.", "remediation": "Remove external URL references from agent instructions." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 116, "rule_identifier": "AAK-AGENT-002", "title": "Agent instructions reference external URLs", "description": "Agent instruction files reference external URLs that could serve as C2 channels or data exfiltration endpoints.", "remediation": "Remove external URL references from agent instructions." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 14, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 36, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 57, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 81, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 101, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 127, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 161, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 182, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 204, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 227, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 251, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 277, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 304, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 332, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "tool-poisoning", "file_path": "plugins/ai-modernize/skills/modernize-audit/SKILL.md", "line_number": null, "rule_identifier": "AAK-SKILL-003", "title": "SKILL.md embeds data-exfiltration primitives", "description": "A SKILL.md references outbound HTTP tools (fetch/curl/request) combined with instructions to send local data (files, environment, credentials).", "remediation": "Remove the exfil instruction. Skills that genuinely need outbound HTTP should declare it explicitly with a documented purpose." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "CHANGELOG.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/ai-swift/README.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/ai-swift/skills/swift-diagnose/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/ai-workflow/skills/workflow-preflight/SKILL.md", "line_number": 603, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/ai-statusline/skills/statusline-wizard/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." } ], "execution_duration_seconds": 2.4000627439818345, "status": "complete", "examined": { "unit": "files", "count": 99 }, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 0, "high": 17, "medium": 4, "critical": 32, "informational": 0 } }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.1183227919973433, "status": "not_applicable", "examined": { "unit": "files", "count": 0 }, "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"", "environment_note": "bearer found no supported-language source files to analyze (see _SUPPORTED_SOURCE_EXTENSIONS); reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute" }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 4.0445786829805, "status": "not_applicable", "examined": { "unit": "files", "count": 0 }, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "ruleset_paths": [ "/opt/nerlo-rules/exfiltration.yaml", "/opt/nerlo-rules/clipboard_exfiltration.yaml", "/opt/nerlo-rules/rce_endpoint.yaml", "/opt/nerlo-rules/taint_egress.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 97.5, "scanner_badge": "Verified", "findings": [ { "tool_name": "nerlo-install-instruction", "severity": "informational", "category": "install-instruction-run", "file_path": "/repo/plugins/ai-geo/skills/geo-fix/SKILL.md", "line_number": 226, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "informational", "category": "install-instruction-run", "file_path": "/repo/plugins/ai-geo/skills/geo-llms-txt/SKILL.md", "line_number": 56, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "informational", "category": "install-instruction-run", "file_path": "/repo/plugins/ai-geo/skills/geo-llms-txt/SKILL.md", "line_number": 250, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "informational", "category": "install-instruction-run", "file_path": "/repo/plugins/ai-geo/skills/geo-llms-txt/SKILL.md", "line_number": 392, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "informational", "category": "install-instruction-run", "file_path": "/repo/plugins/ai-statusline/skills/statusline-wizard/SKILL.md", "line_number": 146, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.", "remediation": null } ], "execution_duration_seconds": 4.0479270000359975, "status": "complete", "examined": { "unit": "files", "count": 83 }, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "ruleset_paths": [ "/opt/nerlo-rules/install_instructions.yaml", "/opt/nerlo-rules/cursor_rules.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "severity_counts": { "low": 0, "high": 0, "medium": 0, "critical": 0, "informational": 5 }, "merged_invocation": true }, "display_score": 97.5, "display_badge": "Verified" }, { "scanner_name": "capslock", "scanner_version": "v0.3.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.17133761796867475, "status": "not_applicable", "examined": { "unit": "packages", "count": 0 }, "metadata": { "source": "go-module-proxy", "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2", "report_type": "go-capability", "vendor_mode": false, "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2 # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=", "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute", "go_files_present": 0, "artifact_type_policy": "claude_skill", "expected_capabilities": null, "artifact_type_explicit": true }, "display_score": null, "display_badge": "not_applicable" } ], "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.", "audit_chain": { "scan_job_id": "b12646fb-da9d-4817-b4ef-bbcd5d189e3f", "scan_completed_at": "2026-08-12T12:31:09.357868+00:00", "scanner_versions": { "agentshield": "1.4.0", "cisco-skill-scanner": "2.0.11", "agent-audit-kit": "0.3.26", "bearer": "2.0.2", "nerlo-behavioral": "0.1.0", "nerlo-install-instruction": "0.1.0", "capslock": "v0.3.2" }, "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:d5aaefa8b517d1f03832091ab094e20dc73160a07ae1102af1b2e395ce6ce852", "ai_decision_log_ids": [ "b604b931-7b15-4d1d-9d84-7312ebae8357" ], "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation" }, "appendix": { "raw_scanner_reports": [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.39175900601549074, "status": "not_applicable", "examined": { "unit": "scan_targets", "count": 0 }, "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [] }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/skills/swift-preflight/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/skills/swift-verify/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/skills/swift-diagnose/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/skills/swift-ci-scaffold/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/skills/swift-concurrency-review/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-geo/skills/geo-llms-txt/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-geo/skills/geo-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-geo/skills/geo-fix/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-workflow/skills/workflow-preflight/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-workflow/skills/workflow-rules/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-workflow/skills/workflow-principles/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-workflow/skills/workflow-ship/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-seo/skills/seo-fix/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-seo/skills/seo-schema/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-seo/skills/seo-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-compliance/skills/compliance-license-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-compliance/skills/compliance-notice-generate/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-accessibility/skills/accessibility-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-statusline/skills/statusline-wizard/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-statusline/skills/statusline-edit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-timesheet-report/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-init/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-log-story-work/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-create-story/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-work-items/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-create-task/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/skills/ado-create-feature/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-writing/skills/writing-humanize/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-absorb/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-import/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-upgrade/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-search/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-ingest/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-query/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-harvest/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-init/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-remove/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-load/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-auto/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-list/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-add/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-discover/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-organize/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-learn/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/skills/kb-prune/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-performance/skills/performance-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-modernize/skills/modernize-scan/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-modernize/skills/modernize-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-git/skills/git-commit-push-pr/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-git/skills/git-commit-push/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-git/skills/git-pr-codex-loop/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 66, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 84, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 174, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Testing", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 221, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Testing", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 264, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 286, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 287, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 523, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 538, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 598, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Proceed without user", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 599, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 645, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Testing", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-git/skills/git-init/SKILL.md", "line_number": 652, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Testing", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-security/skills/security-scan-dependencies/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-security/skills/security-supply-chain/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-supply-chain/SKILL.md", "line_number": 92, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-supply-chain/SKILL.md", "line_number": 306, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Proceed without user", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-supply-chain/SKILL.md", "line_number": 307, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": 60, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": 78, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": 223, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": 238, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": 288, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: Proceed without user", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "autonomy_abuse", "file_path": "/repo/plugins/ai-security/skills/security-init/SKILL.md", "line_number": 289, "rule_identifier": "YARA_autonomy_abuse_generic", "title": "AUTONOMY ABUSE detected by YARA", "description": "Detects unbounded autonomy patterns that bypass user control: test", "remediation": "Review and remove autonomy abuse pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-security/skills/security-audit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/.", "line_number": null, "rule_identifier": "EXCESSIVE_FILE_COUNT", "title": "Skill package contains many files", "description": "Skill package contains 115 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.", "remediation": "Review file inventory and remove unnecessary files." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/.DS_Store", "line_number": null, "rule_identifier": "UNANALYZABLE_BINARY", "title": "Unanalyzable binary file", "description": "Binary file 'plugins/ai-ado/.DS_Store' cannot be inspected by the scanner. Reason: Binary file () - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.", "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/plugins/ai-ado/.DS_Store", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: plugins/ai-ado/.DS_Store. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/.DS_Store", "line_number": null, "rule_identifier": "BINARY_FILE_DETECTED", "title": "Binary file detected in skill package", "description": "Binary file found: plugins/ai-ado/.DS_Store. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.", "remediation": "Review binary file necessity. Replace with auditable scripts if possible." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-swift/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-geo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-geo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-workflow/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-workflow/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-seo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-seo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-compliance/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-compliance/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-accessibility/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-accessibility/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-statusline/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-statusline/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/.DS_Store", "line_number": null, "rule_identifier": "UNANALYZABLE_BINARY", "title": "Unanalyzable binary file", "description": "Binary file '.DS_Store' cannot be inspected by the scanner. Reason: Binary file () - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.", "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/plugins/ai-ado/.DS_Store", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .DS_Store. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/.DS_Store", "line_number": null, "rule_identifier": "BINARY_FILE_DETECTED", "title": "Binary file detected in skill package", "description": "Binary file found: .DS_Store. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.", "remediation": "Review binary file necessity. Replace with auditable scripts if possible." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-ado/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-ado/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-writing/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-writing/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-knowledge/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-knowledge/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-performance/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-performance/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-modernize/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-modernize/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-git/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-git/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/ai-security/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-security/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-swift/agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-accessibility/agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-performance/agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-modernize/agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/ai-security/agents/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 12.9835099959746, "status": "complete", "examined": { "unit": "skills", "count": 76 }, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "swift-preflight", "swift-verify", "swift-diagnose", "swift-ci-scaffold", "swift-concurrency-review", "geo-llms-txt", "geo-audit", "geo-fix", "workflow-preflight", "workflow-rules", "workflow-principles", "workflow-ship", "seo-fix", "seo-schema", "seo-audit", "compliance-license-audit", "compliance-notice-generate", "accessibility-audit", "statusline-wizard", "statusline-edit", "ado-timesheet-report", "ado-init", "ado-log-story-work", "ado-create-story", "ado-work-items", "ado-create-task", "ado-create-feature", "writing-humanize", "kb-absorb", "kb-import", "kb-upgrade", "kb-search", "kb-ingest", "kb-query", "kb-harvest", "kb-init", "kb-remove", "kb-load", "kb-auto", "kb-list", "kb-add", "kb-discover", "kb-organize", "kb-learn", "kb-prune", "performance-audit", "modernize-scan", "modernize-audit", "git-commit-push-pr", "git-commit-push", "git-pr-codex-loop", "git-init", "security-scan-dependencies", "security-supply-chain", "security-init", "security-audit", "repo", "ai-swift", "ai-geo", "ai-workflow", "ai-seo", "ai-compliance", "ai-accessibility", "ai-statusline", "ai-ado", "ai-writing", "ai-knowledge", "ai-performance", "ai-modernize", "ai-git", "ai-security", "swift-release-auditor", "accessibility-auditor", "performance-auditor", "modernize-auditor", "security-auditor" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 18, "high": 0, "medium": 24, "critical": 0, "informational": 78 }, "artifact_type_policy": "claude_skill" }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 25, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 28, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 30, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 34, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 50, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 51, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 51, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 51, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 51, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 64, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 81, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 157, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 89, "rule_identifier": "AAK-AGENT-002", "title": "Agent instructions reference external URLs", "description": "Agent instruction files reference external URLs that could serve as C2 channels or data exfiltration endpoints.", "remediation": "Remove external URL references from agent instructions." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 116, "rule_identifier": "AAK-AGENT-002", "title": "Agent instructions reference external URLs", "description": "Agent instruction files reference external URLs that could serve as C2 channels or data exfiltration endpoints.", "remediation": "Remove external URL references from agent instructions." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 14, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 36, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 57, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 81, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 101, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 127, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 161, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 182, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 204, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 227, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 251, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 277, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 304, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 332, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "tool-poisoning", "file_path": "plugins/ai-modernize/skills/modernize-audit/SKILL.md", "line_number": null, "rule_identifier": "AAK-SKILL-003", "title": "SKILL.md embeds data-exfiltration primitives", "description": "A SKILL.md references outbound HTTP tools (fetch/curl/request) combined with instructions to send local data (files, environment, credentials).", "remediation": "Remove the exfil instruction. Skills that genuinely need outbound HTTP should declare it explicitly with a documented purpose." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "CHANGELOG.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/ai-swift/README.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/ai-swift/skills/swift-diagnose/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/ai-workflow/skills/workflow-preflight/SKILL.md", "line_number": 603, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/ai-statusline/skills/statusline-wizard/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." } ], "execution_duration_seconds": 2.4000627439818345, "status": "complete", "examined": { "unit": "files", "count": 99 }, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 0, "high": 17, "medium": 4, "critical": 32, "informational": 0 } }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.1183227919973433, "status": "not_applicable", "examined": { "unit": "files", "count": 0 }, "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"", "environment_note": "bearer found no supported-language source files to analyze (see _SUPPORTED_SOURCE_EXTENSIONS); reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute" }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 4.0445786829805, "status": "not_applicable", "examined": { "unit": "files", "count": 0 }, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "ruleset_paths": [ "/opt/nerlo-rules/exfiltration.yaml", "/opt/nerlo-rules/clipboard_exfiltration.yaml", "/opt/nerlo-rules/rce_endpoint.yaml", "/opt/nerlo-rules/taint_egress.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 97.5, "scanner_badge": "Verified", "findings": [ { "tool_name": "nerlo-install-instruction", "severity": "informational", "category": "install-instruction-run", "file_path": "/repo/plugins/ai-geo/skills/geo-fix/SKILL.md", "line_number": 226, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "informational", "category": "install-instruction-run", "file_path": "/repo/plugins/ai-geo/skills/geo-llms-txt/SKILL.md", "line_number": 56, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "informational", "category": "install-instruction-run", "file_path": "/repo/plugins/ai-geo/skills/geo-llms-txt/SKILL.md", "line_number": 250, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "informational", "category": "install-instruction-run", "file_path": "/repo/plugins/ai-geo/skills/geo-llms-txt/SKILL.md", "line_number": 392, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "informational", "category": "install-instruction-run", "file_path": "/repo/plugins/ai-statusline/skills/statusline-wizard/SKILL.md", "line_number": 146, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.", "remediation": null } ], "execution_duration_seconds": 4.0479270000359975, "status": "complete", "examined": { "unit": "files", "count": 83 }, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "ruleset_paths": [ "/opt/nerlo-rules/install_instructions.yaml", "/opt/nerlo-rules/cursor_rules.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "severity_counts": { "low": 0, "high": 0, "medium": 0, "critical": 0, "informational": 5 }, "merged_invocation": true }, "display_score": 97.5, "display_badge": "Verified" }, { "scanner_name": "capslock", "scanner_version": "v0.3.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.17133761796867475, "status": "not_applicable", "examined": { "unit": "packages", "count": 0 }, "metadata": { "source": "go-module-proxy", "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2", "report_type": "go-capability", "vendor_mode": false, "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2 # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=", "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute", "go_files_present": 0, "artifact_type_policy": "claude_skill", "expected_capabilities": null, "artifact_type_explicit": true }, "display_score": null, "display_badge": "not_applicable" } ] }, "report": { "report_id": "d9584f26-bd41-4444-8216-1cd37e47fb3d", "format": "json", "generated_at": "2026-08-12T17:07:42.680775+00:00", "scanner_filter": null, "signature": null } }