{
  "executive_summary": {
    "badge": "Unsafe",
    "security_score": null,
    "view": "composite",
    "aggregate_verdict_withheld": false,
    "aggregate_verdict_withheld_reason": null,
    "scanner_badges": {
      "agentshield": "Verified",
      "cisco-skill-scanner": "Unsafe",
      "agent-audit-kit": "Unsafe",
      "bearer": "Unsafe",
      "nerlo-behavioral": "Unsafe",
      "nerlo-install-instruction": "Unsafe",
      "capslock": "not_applicable"
    },
    "finding_counts": {
      "critical": 68,
      "high": 48,
      "medium": 102,
      "low": 172,
      "informational": 385
    },
    "recommendation": "1password-cli is NOT recommended for integration: the scan surfaced 68 critical and 48 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering."
  },
  "source_provenance": {
    "repository_url": "https://github.com/radorigin-llc/rad-claude-skills",
    "commit_sha_scanned": null,
    "license": null,
    "maintainer": null,
    "name": "1password-cli",
    "version": "1.0.0"
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.6715245270170271,
      "status": "complete",
      "examined": {
        "unit": "scan_targets",
        "count": 1
      },
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": [
          "claude_config"
        ],
        "score_breakdown": {
          "mcp": 100,
          "hooks": 100,
          "agents": 100,
          "secrets": 100,
          "permissions": 100
        }
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 0.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-planner/skills/replan/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-planner/skills/review-plan/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-planner/skills/rescue/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-planner/skills/plan/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-brainstormer/skills/design-sprint/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-brainstormer/skills/idea-evaluation/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-brainstormer/skills/brainstorm-session/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-brainstormer/skills/five-whys/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/skills/op-ssh-keys/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "unauthorized_tool_use",
          "file_path": "/repo/plugins/rad-1password/skills/op-ssh-keys/SKILL.md",
          "line_number": 115,
          "rule_identifier": "YARA_system_manipulation_generic",
          "title": "SYSTEM MANIPULATION detected by YARA",
          "description": "Detects system manipulation, privilege escalation, and destructive file operations: shred -u /",
          "remediation": "Review and remove system manipulation pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/skills/op-find/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/skills/op-service-accounts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/skills/1password-cli/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/skills/op-provisioning/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/skills/op-secrets-injection/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "data_exfiltration",
          "file_path": "/repo/plugins/rad-1password/skills/op-secrets-injection/SKILL.md",
          "line_number": 3,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline reads sensitive data and sends it over the network: `curl -sSf https://downloads.1password.com/linux/keys/1password.asc | sudo gpg --dearmor -o /usr/share/keyrings/1password-archive-keyring.gpg`. This is likely data exfiltration.",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "hardcoded_secrets",
          "file_path": "/repo/plugins/rad-1password/skills/op-secrets-injection/SKILL.md",
          "line_number": 70,
          "rule_identifier": "SECRET_CONNECTION_STRING",
          "title": "Database connection string with embedded credentials",
          "description": "Pattern detected: post****",
          "remediation": "Remove credentials from connection strings"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/skills/op-item-management/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/skills/op-signin/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/skills/op-status/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/skills/op-secret-template/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/skills/op-shell-plugins/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-codex/skills/delegate/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-codex/skills/review/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-cicd/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-security/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
          "line_number": 1,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/multi-server-setup.md",
          "line_number": 1,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://get.docker.com | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-databases/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-observability/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-actions/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-status/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/SKILL.md",
          "line_number": 3,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-deploy/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-repo-manager/skills/adopt/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-repo-manager/skills/startup/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-repo-manager/skills/ship/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-repo-manager/skills/wrapup/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-repo-manager/skills/repo-init/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-repo-manager/skills/repo-align/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/skills/rad-brainstormer/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'RAD Brainstormer' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/skills/rad-brainstormer/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/skills/use-codex/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/skills/rad-writer/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'RAD Writer' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/skills/rad-writer/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-ui-react/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-messaging/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-testing/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-permissions/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-storage/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "transitive_trust_abuse",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/debugging-guide.md",
          "line_number": 61,
          "rule_identifier": "YARA_indirect_prompt_injection_generic",
          "title": "TRANSITIVE TRUST ABUSE detected by YARA",
          "description": "Detects indirect prompt injection via instruction manipulation from external sources: execute inline script",
          "remediation": "Review and remove transitive trust abuse pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-security/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-best-practices/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-service-worker/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-astro/skills/astro-security/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-astro/skills/astro-performance/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-astro/skills/astro-accessibility/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-astro/skills/astro-best-practices/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-astro/skills/astro-troubleshooting/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/SKILL.md",
          "line_number": 38,
          "rule_identifier": "YARA_code_execution_generic",
          "title": "CODE EXECUTION detected by YARA",
          "description": "Detects dangerous code execution patterns with untrusted input in agent skills: http://localhost:3000`) \u2014 use relative paths in all tests.\n- Never start the server using `cy.exec(",
          "remediation": "Review and remove code execution pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-troubleshooting/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-security/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-best-practices/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-a11y/skills/a11y-aria-patterns/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-a11y/skills/a11y-forms/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-a11y/skills/a11y-testing/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-a11y/skills/a11y-semantic-html/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-a11y/skills/a11y-keyboard-focus/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-a11y/skills/a11y-review/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-zod-contracts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-handling/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-security/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-testing/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-best-practices/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-subscription-lifecycle/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-idempotency/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-type-patterns/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-strict-mode/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-modern-features/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-api-safety/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-error-handling/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-anti-patterns/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-schemas-validation/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-troubleshooting/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-testing/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-typescript/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-production/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-logging/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-best-practices/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-hooks-lifecycle/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-security/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "hardcoded_secrets",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-security/SKILL.md",
          "line_number": 121,
          "rule_identifier": "YARA_credential_harvesting_generic",
          "title": "CREDENTIAL HARVESTING detected by YARA",
          "description": "Detects potential exposure of sensitive information like API keys, passwords, tokens, and certificates: steal the token",
          "remediation": "Review and remove credential harvesting pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-app-building/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-accessibility/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-engineering/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-performance/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-foundations/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/progressive-summarization/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/express-workflow/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/twelve-favorite-problems/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/para-organize/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/hemingway-bridge/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stack-guide/skills/review-for-ship/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stack-guide/skills/detect-stack/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-shared/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-drive/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-exec-assistant/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-drive-upload/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-send-team-announcement/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-people/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-doc-from-template/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-schedule-recurring-event/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-workflow-meeting-prep/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-review-meet-participants/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-send/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-bulk-download-folder/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-workflow-standup-report/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-workflow-file-announce/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-calendar/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-meet-space/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-watch/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-forward/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-sheets-append/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-organize-drive-folder/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-forward-labeled-emails/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-modelarmor-sanitize-prompt/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-docs-write/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-classroom/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-save-email-attachments/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-reply-all/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-save-email-to-doc/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-watch-drive-changes/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-collect-form-responses/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-researcher/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-share-event-materials/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-events-renew/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-read/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-block-focus-time/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-script-push/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-hr-coordinator/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-reply/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-forms/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-workflow-weekly-digest/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-events-subscribe/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-log-deal-update/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-email-drive-link/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-label-and-archive-emails/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-project-manager/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-draft-email-from-doc/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-calendar-insert/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-share-doc-and-notify/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-sales-ops/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-script/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-vacation-responder/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-meet/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-triage/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-sheets/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-feedback-form/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-review-overdue-tasks/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-task-list/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-post-mortem-setup/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-keep/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-backup-sheet-as-csv/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-expense-tracker/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-classroom-course/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-events/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-modelarmor-create-template/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-shared-drive/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-generate-report-from-sheet/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-tasks/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-plan-weekly-schedule/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-sheets-read/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-modelarmor/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-it-admin/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-gmail-filter/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-sync-contacts-to-sheet/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-event-coordinator/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-share-folder-with-team/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-workflow/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-reschedule-meeting/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-find-free-time/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-batch-invite-to-event/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-find-large-files/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-customer-support/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-workflow-email-to-task/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-content-creator/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-slides/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-compare-sheet-tabs/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-chat-send/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-presentation/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-modelarmor-sanitize-response/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-chat/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-copy-sheet-for-new-month/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-admin-reports/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-calendar-agenda/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-team-lead/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-events-from-sheet/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-decompiler/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-engineering/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-context-prompter/skills/loop-goal-engineering/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/skills/startup/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
          "title": "Skill description exceeds agent skills length limit",
          "description": "Skill description is 1037 characters; Agent skills limit the `description` field to 1024 characters.",
          "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/skills/startup/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/skills/wrapup/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/skills/add-resource/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/keyword-discovery/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/broken-link-fixer/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/competitor-intelligence/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/content-strategist/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/seo-report-generator/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/aeo-optimizer/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/technical-seo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/fix-seo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/full-seo-audit/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/schema-architect/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/on-page-optimizer/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/link-building-strategy/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-best-practices/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'Zod Best Practices' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-best-practices/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-schema-design/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'Zod Schema Design' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-schema-design/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-integrations/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'Zod Framework Integrations' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-integrations/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-error-handling/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'Zod Error Handling' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-error-handling/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-v4-migration/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'Zod v4 Migration and New APIs' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-v4-migration/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-security/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'Zod Security' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-security/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-explain/skills/explain-document/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-explain/skills/narrate-project/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-explain/skills/ground-readme/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-explain/skills/elevator-pitch/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-explain/skills/draft-pitch/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-council/skills/convene/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/skills/rad-seo-aeo-reviewer/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'RAD SEO AEO Reviewer' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/skills/rad-seo-aeo-reviewer/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/.",
          "line_number": null,
          "rule_identifier": "EXCESSIVE_FILE_COUNT",
          "title": "Skill package contains many files",
          "description": "Skill package contains 618 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
          "remediation": "Review file inventory and remove unnecessary files."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/.rad-repo-manager.json",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .rad-repo-manager.json. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/.rad/repo-manager-state.json",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .rad/repo-manager-state.json. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "unauthorized_tool_use",
          "file_path": "/repo/repo/AGENTS.md",
          "line_number": null,
          "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
          "title": "Undeclared network usage",
          "description": "Skill code uses network libraries but doesn't declare network requirement",
          "remediation": "Declare network usage in compatibility field or remove network calls"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-a11y/agents/a11y-reviewer.md",
          "line_number": 135,
          "rule_identifier": "YARA_script_injection_generic",
          "title": "INJECTION ATTACK detected by YARA",
          "description": "Detects malicious script injection patterns in agent skills: href=\"javascript:v",
          "remediation": "Review and remove injection attack pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/audit-manifest.py",
          "line_number": 289,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
          "line_number": 7,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
          "line_number": 80,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
          "line_number": 86,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "transitive_trust_abuse",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/debugging-guide.md",
          "line_number": 61,
          "rule_identifier": "YARA_indirect_prompt_injection_generic",
          "title": "TRANSITIVE TRUST ABUSE detected by YARA",
          "description": "Detects indirect prompt injection via instruction manipulation from external sources: execute inline script",
          "remediation": "Review and remove transitive trust abuse pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/SKILL.md",
          "line_number": 51,
          "rule_identifier": "YARA_code_execution_generic",
          "title": "CODE EXECUTION detected by YARA",
          "description": "Detects dangerous code execution patterns with untrusted input in agent skills: http://localhost:3000`) \u2014 use relative paths in all tests.\n- Never start the server using `cy.exec(",
          "remediation": "Review and remove code execution pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
          "line_number": 133,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
          "line_number": 135,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 109,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 113,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 148,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 153,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 195,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 197,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: archive/plugins/rad-session/fixtures/codex-only-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: archive/plugins/rad-session/fixtures/dev-mode-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: archive/plugins/rad-session/fixtures/dual-scope-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: archive/plugins/rad-session/fixtures/nonstandard-manual/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/packages/coolify-mcp/index.js",
          "line_number": 41,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "data_exfiltration",
          "file_path": "/repo/plugins/rad-1password/skills/op-secrets-injection/SKILL.md",
          "line_number": 3,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline reads sensitive data and sends it over the network: `curl -sSf https://downloads.1password.com/linux/keys/1password.asc | sudo gpg --dearmor -o /usr/share/keyrings/1password-archive-keyring.gpg`. This is likely data exfiltration.",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "unauthorized_tool_use",
          "file_path": "/repo/plugins/rad-1password/skills/op-ssh-keys/SKILL.md",
          "line_number": 121,
          "rule_identifier": "YARA_system_manipulation_generic",
          "title": "SYSTEM MANIPULATION detected by YARA",
          "description": "Detects system manipulation, privilege escalation, and destructive file operations: shred -u /",
          "remediation": "Review and remove system manipulation pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
          "line_number": 1,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/multi-server-setup.md",
          "line_number": 1,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://get.docker.com | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/SKILL.md",
          "line_number": 3,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-repo-manager/scripts/pre_ship.py",
          "line_number": 126,
          "rule_identifier": "COMMAND_INJECTION_SHELL_TRUE",
          "title": "Shell command execution with shell=True enabled",
          "description": "Pattern detected: subprocess.run(command, cwd=root, shell=True",
          "remediation": "Use shell=False and pass commands as lists"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-repo-manager/scripts/structure-drift.py",
          "line_number": 103,
          "rule_identifier": "GLOB_HIDDEN_FILE_TARGETING",
          "title": "Glob or find pattern targeting hidden (dot) files, which may expose sensitive configurations",
          "description": "Pattern detected: glob(\"route.*",
          "remediation": "Avoid targeting hidden files with glob patterns. Be explicit about which files to access"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/.claude/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/.claude/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name '.claude' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/.claude/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/skills/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/skills/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/.github/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/.github/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name '.github' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/.github/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/archive/.",
          "line_number": null,
          "rule_identifier": "EXCESSIVE_FILE_COUNT",
          "title": "Skill package contains many files",
          "description": "Skill package contains 420 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
          "remediation": "Review file inventory and remove unnecessary files."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "unauthorized_tool_use",
          "file_path": "/repo/archive/repo/archive/README.md",
          "line_number": null,
          "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
          "title": "Undeclared network usage",
          "description": "Skill code uses network libraries but doesn't declare network requirement",
          "remediation": "Declare network usage in compatibility field or remove network calls"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-a11y/agents/a11y-reviewer.md",
          "line_number": 135,
          "rule_identifier": "YARA_script_injection_generic",
          "title": "INJECTION ATTACK detected by YARA",
          "description": "Detects malicious script injection patterns in agent skills: href=\"javascript:v",
          "remediation": "Review and remove injection attack pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/audit-manifest.py",
          "line_number": 289,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
          "line_number": 7,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
          "line_number": 80,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
          "line_number": 86,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "transitive_trust_abuse",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/debugging-guide.md",
          "line_number": 61,
          "rule_identifier": "YARA_indirect_prompt_injection_generic",
          "title": "TRANSITIVE TRUST ABUSE detected by YARA",
          "description": "Detects indirect prompt injection via instruction manipulation from external sources: execute inline script",
          "remediation": "Review and remove transitive trust abuse pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/SKILL.md",
          "line_number": 51,
          "rule_identifier": "YARA_code_execution_generic",
          "title": "CODE EXECUTION detected by YARA",
          "description": "Detects dangerous code execution patterns with untrusted input in agent skills: http://localhost:3000`) \u2014 use relative paths in all tests.\n- Never start the server using `cy.exec(",
          "remediation": "Review and remove code execution pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
          "line_number": 133,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
          "line_number": 135,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 109,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 113,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 148,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 153,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 195,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 197,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: plugins/rad-session/fixtures/codex-only-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: plugins/rad-session/fixtures/dev-mode-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: plugins/rad-session/fixtures/dual-scope-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: plugins/rad-session/fixtures/nonstandard-manual/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "policy_violation",
          "file_path": "/repo/packages/coolify-mcp",
          "line_number": null,
          "rule_identifier": "LOW_ANALYZABILITY",
          "title": "Moderate analyzability score",
          "description": "Only 76% of skill content could be analyzed. 1 of 5 files are opaque to the scanner. Some content could not be verified as safe.",
          "remediation": "Review opaque files and replace with inspectable formats where possible."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/packages/coolify-mcp/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/packages/coolify-mcp/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/packages/coolify-mcp/index.js",
          "line_number": 41,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-planner/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-planner/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-brainstormer/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-brainstormer/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-1password/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "data_exfiltration",
          "file_path": "/repo/plugins/rad-1password/skills/op-secrets-injection/SKILL.md",
          "line_number": 3,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline reads sensitive data and sends it over the network: `curl -sSf https://downloads.1password.com/linux/keys/1password.asc | sudo gpg --dearmor -o /usr/share/keyrings/1password-archive-keyring.gpg`. This is likely data exfiltration.",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "unauthorized_tool_use",
          "file_path": "/repo/plugins/rad-1password/skills/op-ssh-keys/SKILL.md",
          "line_number": 121,
          "rule_identifier": "YARA_system_manipulation_generic",
          "title": "SYSTEM MANIPULATION detected by YARA",
          "description": "Detects system manipulation, privilege escalation, and destructive file operations: shred -u /",
          "remediation": "Review and remove system manipulation pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-codex/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-codex/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
          "line_number": 1,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/multi-server-setup.md",
          "line_number": 1,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://get.docker.com | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/SKILL.md",
          "line_number": 3,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-repo-manager/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-repo-manager/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-repo-manager/scripts/pre_ship.py",
          "line_number": 126,
          "rule_identifier": "COMMAND_INJECTION_SHELL_TRUE",
          "title": "Shell command execution with shell=True enabled",
          "description": "Pattern detected: subprocess.run(command, cwd=root, shell=True",
          "remediation": "Use shell=False and pass commands as lists"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-repo-manager/scripts/structure-drift.py",
          "line_number": 103,
          "rule_identifier": "GLOB_HIDDEN_FILE_TARGETING",
          "title": "Glob or find pattern targeting hidden (dot) files, which may expose sensitive configurations",
          "description": "Pattern detected: glob(\"route.*",
          "remediation": "Avoid targeting hidden files with glob patterns. Be explicit about which files to access"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-planner/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-planner/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-planner/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-planner/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-planner/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-planner/examples/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-planner/examples/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-planner/references/subagent-prompts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-planner/references/subagent-prompts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-brainstormer/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-brainstormer/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-brainstormer/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-brainstormer/references/subagent-prompts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-brainstormer/references/subagent-prompts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-1password/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-1password/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-codex/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-codex/skills/delegate/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-codex/skills/delegate/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
          "title": "Skill description exceeds agent skills length limit",
          "description": "Skill description is 1693 characters; Agent skills limit the `description` field to 1024 characters.",
          "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-cicd/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-cicd/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-security/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-security/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/SKILL.md",
          "line_number": 1,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://get.docker.com | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/multi-server-setup.md",
          "line_number": 1,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://get.docker.com | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-databases/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-databases/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-observability/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-observability/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-actions/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-actions/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-deploy/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-deploy/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-repo-manager/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-repo-manager/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-repo-manager/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-repo-manager/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-repo-manager/scripts/pre_ship.py",
          "line_number": 126,
          "rule_identifier": "COMMAND_INJECTION_SHELL_TRUE",
          "title": "Shell command execution with shell=True enabled",
          "description": "Pattern detected: subprocess.run(command, cwd=root, shell=True",
          "remediation": "Use shell=False and pass commands as lists"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "command_injection",
          "file_path": "/repo/plugins/rad-repo-manager/scripts/structure-drift.py",
          "line_number": 103,
          "rule_identifier": "GLOB_HIDDEN_FILE_TARGETING",
          "title": "Glob or find pattern targeting hidden (dot) files, which may expose sensitive configurations",
          "description": "Pattern detected: glob(\"route.*",
          "remediation": "Avoid targeting hidden files with glob patterns. Be explicit about which files to access"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/plugins/rad-repo-manager/templates/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/plugins/rad-repo-manager/templates/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/skills/rad-brainstormer/resources/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/skills/rad-brainstormer/resources/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/skills/rad-writer/resources/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/skills/rad-writer/resources/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/.github/ISSUE_TEMPLATE/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/.github/ISSUE_TEMPLATE/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_INVALID_NAME",
          "title": "Skill name does not follow agent skills naming rules",
          "description": "Skill name 'Bug Report' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
          "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/.github/ISSUE_TEMPLATE/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/audit-manifest.py",
          "line_number": 289,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
          "line_number": 7,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
          "line_number": 80,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
          "line_number": 86,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "transitive_trust_abuse",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/debugging-guide.md",
          "line_number": 61,
          "rule_identifier": "YARA_indirect_prompt_injection_generic",
          "title": "TRANSITIVE TRUST ABUSE detected by YARA",
          "description": "Detects indirect prompt injection via instruction manipulation from external sources: execute inline script",
          "remediation": "Review and remove transitive trust abuse pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-astro/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-astro/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-nextjs/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-nextjs/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/SKILL.md",
          "line_number": 51,
          "rule_identifier": "YARA_code_execution_generic",
          "title": "CODE EXECUTION detected by YARA",
          "description": "Detects dangerous code execution patterns with untrusted input in agent skills: http://localhost:3000`) \u2014 use relative paths in all tests.\n- Never start the server using `cy.exec(",
          "remediation": "Review and remove code execution pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-a11y/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-a11y/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-a11y/agents/a11y-reviewer.md",
          "line_number": 135,
          "rule_identifier": "YARA_script_injection_generic",
          "title": "INJECTION ATTACK detected by YARA",
          "description": "Detects malicious script injection patterns in agent skills: href=\"javascript:v",
          "remediation": "Review and remove injection attack pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-code-review/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-code-review/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-typescript/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-fastify/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-fastify/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-react/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-stack-guide/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stack-guide/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-google-workspace/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-google-workspace/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-context-prompter/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-context-prompter/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: fixtures/codex-only-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: fixtures/dev-mode-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: fixtures/dual-scope-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: fixtures/nonstandard-manual/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "unauthorized_tool_use",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/repo/archive/plugins/rad-seo-optimizer/README.md",
          "line_number": null,
          "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
          "title": "Undeclared network usage",
          "description": "Skill code uses network libraries but doesn't declare network requirement",
          "remediation": "Declare network usage in compatibility field or remove network calls"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
          "line_number": 133,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
          "line_number": 135,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 109,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 113,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 148,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 153,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 195,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 197,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-zod/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-explain/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-explain/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-council/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-council/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
          "title": "Skill description exceeds agent skills length limit",
          "description": "Skill description is 1588 characters; Agent skills limit the `description` field to 1024 characters.",
          "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/audit-manifest.py",
          "line_number": 289,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
          "line_number": 7,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
          "line_number": 80,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
          "line_number": 86,
          "rule_identifier": "COMMAND_INJECTION_EVAL",
          "title": "Dangerous code execution functions that can execute arbitrary code",
          "description": "Pattern detected: eval(",
          "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-ui-react/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-ui-react/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-messaging/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-messaging/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-testing/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-testing/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-permissions/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-permissions/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-storage/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-storage/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "transitive_trust_abuse",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/SKILL.md",
          "line_number": 61,
          "rule_identifier": "YARA_indirect_prompt_injection_generic",
          "title": "TRANSITIVE TRUST ABUSE detected by YARA",
          "description": "Detects indirect prompt injection via instruction manipulation from external sources: execute inline script",
          "remediation": "Review and remove transitive trust abuse pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "transitive_trust_abuse",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/debugging-guide.md",
          "line_number": 61,
          "rule_identifier": "YARA_indirect_prompt_injection_generic",
          "title": "TRANSITIVE TRUST ABUSE detected by YARA",
          "description": "Detects indirect prompt injection via instruction manipulation from external sources: execute inline script",
          "remediation": "Review and remove transitive trust abuse pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-security/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-security/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-best-practices/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-best-practices/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-service-worker/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-service-worker/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-astro/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-astro/skills/astro-best-practices/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-astro/skills/astro-best-practices/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-nextjs/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-troubleshooting/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-troubleshooting/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-security/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-security/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-best-practices/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-best-practices/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-a11y/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-a11y/agents/SKILL.md",
          "line_number": 107,
          "rule_identifier": "YARA_script_injection_generic",
          "title": "INJECTION ATTACK detected by YARA",
          "description": "Detects malicious script injection patterns in agent skills: href=\"javascript:v",
          "remediation": "Review and remove injection attack pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-a11y/agents/a11y-reviewer.md",
          "line_number": 135,
          "rule_identifier": "YARA_script_injection_generic",
          "title": "INJECTION ATTACK detected by YARA",
          "description": "Detects malicious script injection patterns in agent skills: href=\"javascript:v",
          "remediation": "Review and remove injection attack pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-a11y/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-a11y/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
          "title": "Skill description exceeds agent skills length limit",
          "description": "Skill description is 1723 characters; Agent skills limit the `description` field to 1024 characters.",
          "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-handling/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-handling/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-testing/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-testing/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-best-practices/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-best-practices/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-subscription-lifecycle/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-subscription-lifecycle/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-code-review/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-code-review/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/workflows/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/workflows/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "hardcoded_secrets",
          "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/workflows/SKILL.md",
          "line_number": 115,
          "rule_identifier": "SECRET_CONNECTION_STRING",
          "title": "Database connection string with embedded credentials",
          "description": "Pattern detected: post****",
          "remediation": "Remove credentials from connection strings"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/templates/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/templates/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/references/subagent-prompts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/references/subagent-prompts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
          "title": "Skill description exceeds agent skills length limit",
          "description": "Skill description is 1738 characters; Agent skills limit the `description` field to 1024 characters.",
          "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-type-patterns/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-type-patterns/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-strict-mode/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-strict-mode/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-modern-features/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-modern-features/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-api-safety/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-api-safety/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-error-handling/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-error-handling/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-anti-patterns/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-anti-patterns/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-fastify/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-security/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-security/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-app-building/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-app-building/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-accessibility/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-accessibility/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-engineering/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-engineering/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-performance/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-performance/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-foundations/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-react/skills/react-foundations/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
          "title": "Skill description exceeds agent skills length limit",
          "description": "Skill description is 1748 characters; Agent skills limit the `description` field to 1024 characters.",
          "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "high",
          "category": "command_injection",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/agents/SKILL.md",
          "line_number": 279,
          "rule_identifier": "FIND_EXEC_PATTERN",
          "title": "find command with -exec flag can execute arbitrary commands on discovered files",
          "description": "Pattern detected: find \"$PARA_ROOT/Projects\" -maxdepth 1 -mindepth 1 -type d -exec ",
          "remediation": "Avoid find -exec with untrusted directories. Use explicit file lists instead"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/progressive-summarization/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/progressive-summarization/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/para-organize/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/para-organize/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-stack-guide/skills/detect-stack/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-stack-guide/skills/detect-stack/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-context-prompter/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
          "title": "Skill description exceeds agent skills length limit",
          "description": "Skill description is 2232 characters; Agent skills limit the `description` field to 1024 characters.",
          "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-context-prompter/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-decompiler/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-decompiler/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-engineering/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-engineering/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "critical",
          "category": "prompt_injection",
          "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-engineering/references/SKILL.md",
          "line_number": 2238,
          "rule_identifier": "YARA_coercive_injection_generic",
          "title": "PROMPT INJECTION detected by YARA",
          "description": "Detects coercive prompt injections in tool description fields: You MUST use this tool",
          "remediation": "Review and remove prompt injection pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-context-prompter/skills/loop-goal-engineering/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-context-prompter/skills/loop-goal-engineering/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: codex-only-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: dev-mode-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: dual-scope-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: nonstandard-manual/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/.rad/profile",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/docs/decisions/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/docs/decisions/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/docs/planning/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/docs/planning/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/docs/planning/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/docs/planning/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/docs/decisions/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/docs/decisions/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/docs/planning/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/docs/planning/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/docs/planning/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/docs/planning/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "unauthorized_tool_use",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/repo/archive/plugins/rad-seo-optimizer/scripts/README.md",
          "line_number": null,
          "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
          "title": "Undeclared network usage",
          "description": "Skill code uses network libraries but doesn't declare network requirement",
          "remediation": "Declare network usage in compatibility field or remove network calls"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
          "line_number": 133,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
          "line_number": 135,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 109,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 113,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 148,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 153,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 195,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.Request(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "data_exfiltration",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 197,
          "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
          "title": "Outbound network request primitives that can transmit data externally",
          "description": "Pattern detected: urllib.request.urlopen(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/references/subagent-prompts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/references/subagent-prompts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
          "title": "Skill description exceeds agent skills length limit",
          "description": "Skill description is 2226 characters; Agent skills limit the `description` field to 1024 characters.",
          "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-best-practices/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-best-practices/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-schema-design/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-schema-design/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-integrations/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-integrations/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-error-handling/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-error-handling/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-v4-migration/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-v4-migration/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-security/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-zod/skills/zod-security/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-explain/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-explain/scripts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-council/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-council/references/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-council/agents/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-council/references/examples/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-council/references/examples/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/plugins/rad-council/references/subagent-prompts/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/plugins/rad-council/references/subagent-prompts/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/archive/skills/rad-seo-aeo-reviewer/resources/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/archive/skills/rad-seo-aeo-reviewer/resources/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        }
      ],
      "execution_duration_seconds": 44.46300129801966,
      "status": "complete",
      "examined": {
        "unit": "skills",
        "count": 369
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "replan",
          "review-plan",
          "rescue",
          "plan",
          "design-sprint",
          "idea-evaluation",
          "brainstorm-session",
          "five-whys",
          "op-ssh-keys",
          "op-find",
          "op-service-accounts",
          "1password-cli",
          "op-provisioning",
          "op-secrets-injection",
          "op-item-management",
          "op-signin",
          "op-status",
          "op-secret-template",
          "op-shell-plugins",
          "delegate",
          "review",
          "coolify-cicd",
          "coolify-security",
          "coolify-infrastructure",
          "coolify-databases",
          "coolify-observability",
          "coolify-actions",
          "coolify-status",
          "coolify-troubleshoot",
          "coolify-deploy",
          "adopt",
          "startup",
          "ship",
          "wrapup",
          "repo-init",
          "repo-align",
          "RAD Brainstormer",
          "use-codex",
          "RAD Writer",
          "chrome-ext-ui-react",
          "chrome-ext-messaging",
          "chrome-ext-testing",
          "chrome-ext-permissions",
          "chrome-ext-storage",
          "chrome-ext-troubleshooting",
          "chrome-ext-security",
          "chrome-ext-best-practices",
          "chrome-ext-service-worker",
          "astro-security",
          "astro-performance",
          "astro-accessibility",
          "astro-best-practices",
          "astro-troubleshooting",
          "nextjs-testing",
          "nextjs-troubleshooting",
          "nextjs-security",
          "nextjs-best-practices",
          "a11y-aria-patterns",
          "a11y-forms",
          "a11y-testing",
          "a11y-semantic-html",
          "a11y-keyboard-focus",
          "a11y-review",
          "stripe-zod-contracts",
          "stripe-webhook-handling",
          "stripe-webhook-security",
          "stripe-webhook-testing",
          "stripe-webhook-best-practices",
          "stripe-subscription-lifecycle",
          "stripe-webhook-idempotency",
          "rad-code-review",
          "typescript-type-patterns",
          "typescript-strict-mode",
          "typescript-modern-features",
          "typescript-api-safety",
          "typescript-error-handling",
          "typescript-anti-patterns",
          "fastify-schemas-validation",
          "fastify-troubleshooting",
          "fastify-testing",
          "fastify-typescript",
          "fastify-production",
          "fastify-logging",
          "fastify-best-practices",
          "fastify-hooks-lifecycle",
          "react-security",
          "react-app-building",
          "react-accessibility",
          "react-engineering",
          "react-performance",
          "react-foundations",
          "progressive-summarization",
          "express-workflow",
          "twelve-favorite-problems",
          "para-organize",
          "hemingway-bridge",
          "review-for-ship",
          "detect-stack",
          "gws-shared",
          "gws-drive",
          "persona-exec-assistant",
          "gws-drive-upload",
          "recipe-send-team-announcement",
          "gws-people",
          "recipe-create-doc-from-template",
          "recipe-schedule-recurring-event",
          "gws-workflow-meeting-prep",
          "recipe-review-meet-participants",
          "gws-gmail-send",
          "recipe-bulk-download-folder",
          "gws-workflow-standup-report",
          "gws-workflow-file-announce",
          "gws-calendar",
          "recipe-create-meet-space",
          "gws-gmail-watch",
          "gws-gmail-forward",
          "gws-sheets-append",
          "recipe-organize-drive-folder",
          "recipe-forward-labeled-emails",
          "gws-modelarmor-sanitize-prompt",
          "gws-docs-write",
          "gws-classroom",
          "recipe-save-email-attachments",
          "gws-gmail-reply-all",
          "gws-docs",
          "recipe-save-email-to-doc",
          "recipe-watch-drive-changes",
          "recipe-collect-form-responses",
          "persona-researcher",
          "recipe-share-event-materials",
          "gws-events-renew",
          "gws-gmail-read",
          "recipe-block-focus-time",
          "gws-script-push",
          "persona-hr-coordinator",
          "gws-gmail-reply",
          "gws-forms",
          "gws-workflow-weekly-digest",
          "gws-events-subscribe",
          "recipe-log-deal-update",
          "recipe-email-drive-link",
          "recipe-label-and-archive-emails",
          "persona-project-manager",
          "recipe-draft-email-from-doc",
          "gws-calendar-insert",
          "recipe-share-doc-and-notify",
          "persona-sales-ops",
          "gws-script",
          "recipe-create-vacation-responder",
          "gws-meet",
          "gws-gmail-triage",
          "gws-sheets",
          "recipe-create-feedback-form",
          "recipe-review-overdue-tasks",
          "recipe-create-task-list",
          "recipe-post-mortem-setup",
          "gws-keep",
          "recipe-backup-sheet-as-csv",
          "recipe-create-expense-tracker",
          "recipe-create-classroom-course",
          "gws-events",
          "gws-modelarmor-create-template",
          "recipe-create-shared-drive",
          "recipe-generate-report-from-sheet",
          "gws-tasks",
          "recipe-plan-weekly-schedule",
          "gws-sheets-read",
          "gws-modelarmor",
          "persona-it-admin",
          "recipe-create-gmail-filter",
          "recipe-sync-contacts-to-sheet",
          "persona-event-coordinator",
          "recipe-share-folder-with-team",
          "gws-workflow",
          "recipe-reschedule-meeting",
          "recipe-find-free-time",
          "recipe-batch-invite-to-event",
          "recipe-find-large-files",
          "persona-customer-support",
          "gws-workflow-email-to-task",
          "persona-content-creator",
          "gws-slides",
          "recipe-compare-sheet-tabs",
          "gws-chat-send",
          "gws-gmail",
          "recipe-create-presentation",
          "gws-modelarmor-sanitize-response",
          "gws-chat",
          "recipe-copy-sheet-for-new-month",
          "gws-admin-reports",
          "gws-calendar-agenda",
          "persona-team-lead",
          "recipe-create-events-from-sheet",
          "prompt-decompiler",
          "prompt-engineering",
          "loop-goal-engineering",
          "startup",
          "wrapup",
          "add-resource",
          "keyword-discovery",
          "broken-link-fixer",
          "competitor-intelligence",
          "content-strategist",
          "seo-report-generator",
          "aeo-optimizer",
          "technical-seo",
          "fix-seo",
          "full-seo-audit",
          "schema-architect",
          "on-page-optimizer",
          "link-building-strategy",
          "Zod Best Practices",
          "Zod Schema Design",
          "Zod Framework Integrations",
          "Zod Error Handling",
          "Zod v4 Migration and New APIs",
          "Zod Security",
          "explain-document",
          "narrate-project",
          "ground-readme",
          "elevator-pitch",
          "draft-pitch",
          "convene",
          "RAD SEO AEO Reviewer",
          "repo",
          ".claude",
          "skills",
          ".github",
          "docs",
          "archive",
          "coolify-mcp",
          "rad-planner",
          "rad-brainstormer",
          "rad-1password",
          "rad-codex",
          "rad-coolify-orchestrator",
          "rad-repo-manager",
          "references",
          "risk-assessor",
          "scripts",
          "examples",
          "subagent-prompts",
          "references",
          "domain-researcher",
          "subagent-prompts",
          "scripts",
          "codex-worker",
          "references",
          "coolify-reviewer",
          "scripts",
          "references",
          "references",
          "references",
          "references",
          "references",
          "references",
          "references",
          "references",
          "references",
          "scripts",
          "templates",
          "resources",
          "resources",
          "Bug Report",
          "rad-chrome-extension",
          "rad-astro",
          "rad-nextjs",
          "rad-a11y",
          "rad-stripe-fastify-webhooks",
          "rad-code-review",
          "rad-typescript",
          "rad-fastify",
          "rad-react",
          "rad-para-second-brain",
          "rad-stack-guide",
          "rad-google-workspace",
          "rad-context-prompter",
          "rad-session",
          "rad-seo-optimizer",
          "rad-zod",
          "rad-explain",
          "rad-council",
          "chrome-ext-reviewer",
          "scripts",
          "references",
          "references",
          "references",
          "references",
          "references",
          "references",
          "references",
          "references",
          "references",
          "astro-reviewer",
          "references",
          "nextjs-reviewer",
          "references",
          "references",
          "references",
          "references",
          "a11y-reviewer",
          "scripts",
          "stripe-webhook-reviewer",
          "references",
          "references",
          "references",
          "references",
          "scripts",
          "workflows",
          "references",
          "templates",
          "subagent-prompts",
          "typescript-reviewer",
          "references",
          "references",
          "references",
          "references",
          "references",
          "references",
          "fastify-reviewer",
          "react-reviewer",
          "references",
          "references",
          "references",
          "references",
          "references",
          "references",
          "para-auditor",
          "references",
          "references",
          "references",
          "prompt-debugger",
          "references",
          "references",
          "references",
          "references",
          "scripts",
          "fixtures",
          "codex-only-project",
          "nonstandard-manual",
          "dual-scope-project",
          "dev-mode-project",
          "docs",
          "decisions",
          "planning",
          "docs",
          "planning",
          "docs",
          "decisions",
          "planning",
          "docs",
          "planning",
          "references",
          "competitor-spy",
          "scripts",
          "subagent-prompts",
          "zod-reviewer",
          "references",
          "references",
          "references",
          "references",
          "references",
          "references",
          "scripts",
          "references",
          "council-advisor",
          "examples",
          "subagent-prompts",
          "resources"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 171,
          "high": 9,
          "medium": 52,
          "critical": 26,
          "informational": 381
        },
        "artifact_type_policy": "claude_skill"
      },
      "display_score": 0.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 0.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": "plugins/rad-coolify-orchestrator/.mcp.json",
          "line_number": 4,
          "rule_identifier": "AAK-MCP-005",
          "title": "MCP server uses npx/uvx to fetch and execute remote packages",
          "description": "The command uses npx, uvx, bunx, or pnpx which fetches the latest version from a registry at runtime, vulnerable to typosquatting and dependency confusion.",
          "remediation": "Pin exact package versions or use locally installed packages."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "low",
          "category": "mcp-config",
          "file_path": "plugins/rad-coolify-orchestrator/.mcp.json",
          "line_number": 5,
          "rule_identifier": "AAK-MCP-007",
          "title": "MCP server lacks version pinning in args",
          "description": "Package name in args lacks @version suffix when using npx/uvx. Unpinned packages can silently update to malicious versions.",
          "remediation": "Pin with @x.y.z suffix, e.g., @modelcontextprotocol/server-filesystem@2025.1.1"
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "secret-exposure",
          "file_path": "plugins/rad-coolify-orchestrator/scripts/audit-cicd.py",
          "line_number": 65,
          "rule_identifier": "AAK-SECRET-004",
          "title": "Generic high-entropy secret",
          "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
          "remediation": "Move to environment variables or secrets manager."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "secret-exposure",
          "file_path": "plugins/rad-coolify-orchestrator/scripts/audit-cicd.py",
          "line_number": 66,
          "rule_identifier": "AAK-SECRET-004",
          "title": "Generic high-entropy secret",
          "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
          "remediation": "Move to environment variables or secrets manager."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "secret-exposure",
          "file_path": "plugins/rad-coolify-orchestrator/scripts/audit-cicd.py",
          "line_number": 92,
          "rule_identifier": "AAK-SECRET-004",
          "title": "Generic high-entropy secret",
          "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
          "remediation": "Move to environment variables or secrets manager."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "secret-exposure",
          "file_path": "plugins/rad-repo-manager/scripts/align-index.py",
          "line_number": 127,
          "rule_identifier": "AAK-SECRET-004",
          "title": "Generic high-entropy secret",
          "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
          "remediation": "Move to environment variables or secrets manager."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "secret-exposure",
          "file_path": "archive/plugins/rad-explain/scripts/check-grounding.py",
          "line_number": 140,
          "rule_identifier": "AAK-SECRET-004",
          "title": "Generic high-entropy secret",
          "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
          "remediation": "Move to environment variables or secrets manager."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 8,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 9,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 10,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 11,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 11,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 11,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 12,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 16,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 17,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 17,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 17,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 18,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 18,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 18,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "AGENTS.md",
          "line_number": 16,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 8,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 9,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 10,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 11,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 11,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 11,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 12,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 16,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 17,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 17,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 17,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 18,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 18,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 18,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "agent-config",
          "file_path": "CLAUDE.md",
          "line_number": 16,
          "rule_identifier": "AAK-AGENT-001",
          "title": "Agent instruction file contains shell command directives",
          "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
          "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": ".claude-plugin/marketplace.json",
          "line_number": 14,
          "rule_identifier": "AAK-MARKETPLACE-001",
          "title": "Unsigned marketplace.json manifest",
          "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.",
          "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": ".claude-plugin/marketplace.json",
          "line_number": 22,
          "rule_identifier": "AAK-MARKETPLACE-001",
          "title": "Unsigned marketplace.json manifest",
          "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.",
          "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": ".claude-plugin/marketplace.json",
          "line_number": 30,
          "rule_identifier": "AAK-MARKETPLACE-001",
          "title": "Unsigned marketplace.json manifest",
          "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.",
          "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": ".claude-plugin/marketplace.json",
          "line_number": 38,
          "rule_identifier": "AAK-MARKETPLACE-001",
          "title": "Unsigned marketplace.json manifest",
          "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.",
          "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": ".claude-plugin/marketplace.json",
          "line_number": 46,
          "rule_identifier": "AAK-MARKETPLACE-001",
          "title": "Unsigned marketplace.json manifest",
          "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.",
          "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": ".claude-plugin/marketplace.json",
          "line_number": 54,
          "rule_identifier": "AAK-MARKETPLACE-001",
          "title": "Unsigned marketplace.json manifest",
          "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.",
          "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "tool-poisoning",
          "file_path": "archive/plugins/rad-nextjs/skills/nextjs-troubleshooting/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-SKILL-003",
          "title": "SKILL.md embeds data-exfiltration primitives",
          "description": "A SKILL.md references outbound HTTP tools (fetch/curl/request) combined with instructions to send local data (files, environment, credentials).",
          "remediation": "Remove the exfil instruction. Skills that genuinely need outbound HTTP should declare it explicitly with a documented purpose."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "tool-poisoning",
          "file_path": "archive/plugins/rad-nextjs/skills/nextjs-security/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-SKILL-003",
          "title": "SKILL.md embeds data-exfiltration primitives",
          "description": "A SKILL.md references outbound HTTP tools (fetch/curl/request) combined with instructions to send local data (files, environment, credentials).",
          "remediation": "Remove the exfil instruction. Skills that genuinely need outbound HTTP should declare it explicitly with a documented purpose."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "tool-poisoning",
          "file_path": "archive/plugins/rad-typescript/skills/typescript-api-safety/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-SKILL-003",
          "title": "SKILL.md embeds data-exfiltration primitives",
          "description": "A SKILL.md references outbound HTTP tools (fetch/curl/request) combined with instructions to send local data (files, environment, credentials).",
          "remediation": "Remove the exfil instruction. Skills that genuinely need outbound HTTP should declare it explicitly with a documented purpose."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "tool-poisoning",
          "file_path": "archive/plugins/rad-fastify/skills/fastify-logging/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-SKILL-003",
          "title": "SKILL.md embeds data-exfiltration primitives",
          "description": "A SKILL.md references outbound HTTP tools (fetch/curl/request) combined with instructions to send local data (files, environment, credentials).",
          "remediation": "Remove the exfil instruction. Skills that genuinely need outbound HTTP should declare it explicitly with a documented purpose."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "tool-poisoning",
          "file_path": "archive/plugins/rad-react/skills/react-performance/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-SKILL-003",
          "title": "SKILL.md embeds data-exfiltration primitives",
          "description": "A SKILL.md references outbound HTTP tools (fetch/curl/request) combined with instructions to send local data (files, environment, credentials).",
          "remediation": "Remove the exfil instruction. Skills that genuinely need outbound HTTP should declare it explicitly with a documented purpose."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "tool-poisoning",
          "file_path": "archive/plugins/rad-google-workspace/skills/gws-modelarmor-create-template/SKILL.md",
          "line_number": 4,
          "rule_identifier": "AAK-SKILL-005",
          "title": "SKILL.md frontmatter contains prompt-injection triggers",
          "description": "A SKILL.md frontmatter or YAML header embeds phrases targeted at the loading model ('ignore previous', 'you are now', 'system:'). These are prompt-injection probes rather than legitimate skill metadata.",
          "remediation": "Remove the injection trigger. Skill frontmatter should only contain name, description, tags, and similar metadata."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": "packages/coolify-mcp/index.js",
          "line_number": 2,
          "rule_identifier": "AAK-MCP-018",
          "title": "Missing rate limiting on MCP endpoint",
          "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.",
          "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": "plugins/rad-planner/scripts/plan-lint.py",
          "line_number": null,
          "rule_identifier": "AAK-TASKS-003",
          "title": "MCP task has no TTL or cancellation path",
          "description": "A task record has no expiration and no cancellation endpoint. Orphaned tasks accumulate forever, including their inputs.",
          "remediation": "Set a TTL on every task; expose a cancellation endpoint that zeroizes inputs and credentials."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "secret-exposure",
          "file_path": "archive/plugins/rad-zod/skills/zod-schema-design/references/edge-cases.md",
          "line_number": 95,
          "rule_identifier": "AAK-INDIA-PII-001",
          "title": "Aadhaar number in source / config",
          "description": "A 12-digit Aadhaar number passed the Verhoeff checksum and is embedded in project text. Aadhaar is restricted under the UIDAI Act and India DPDP \u00a78(4). Storing in code is a reportable breach.",
          "remediation": "Remove the Aadhaar number. If Aadhaar is genuinely needed, route it through an encrypted vault (e.g. AWS KMS / Azure Key Vault) and never log or commit it."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "critical",
          "category": "secret-exposure",
          "file_path": "archive/plugins/rad-zod/skills/zod-schema-design/references/edge-cases.md",
          "line_number": 95,
          "rule_identifier": "AAK-INDIA-PII-001",
          "title": "Aadhaar number in source / config",
          "description": "A 12-digit Aadhaar number passed the Verhoeff checksum and is embedded in project text. Aadhaar is restricted under the UIDAI Act and India DPDP \u00a78(4). Storing in code is a reportable breach.",
          "remediation": "Remove the Aadhaar number. If Aadhaar is genuinely needed, route it through an encrypted vault (e.g. AWS KMS / Azure Key Vault) and never log or commit it."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "plugins/rad-coolify-orchestrator/coverage-report.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "plugins/rad-coolify-orchestrator/README.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "plugins/rad-brainstormer/references/facilitation-principles.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "plugins/rad-brainstormer/references/methodology-catalog.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "legal-compliance",
          "file_path": "plugins/rad-brainstormer/references/methodology-catalog.md",
          "line_number": 516,
          "rule_identifier": "AAK-HEALTHCARE-AI-005",
          "title": "Crisis keywords handled without escalation path",
          "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
          "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "plugins/rad-brainstormer/skills/five-whys/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "plugins/rad-codex/skills/delegate/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "plugins/rad-codex/skills/delegate/references/prompt-blocks.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "legal-compliance",
          "file_path": "plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
          "line_number": 277,
          "rule_identifier": "AAK-HEALTHCARE-AI-005",
          "title": "Crisis keywords handled without escalation path",
          "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
          "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "plugins/rad-coolify-orchestrator/skills/coolify-databases/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "legal-compliance",
          "file_path": "plugins/rad-coolify-orchestrator/skills/coolify-databases/SKILL.md",
          "line_number": 251,
          "rule_identifier": "AAK-HEALTHCARE-AI-005",
          "title": "Crisis keywords handled without escalation path",
          "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
          "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "plugins/rad-coolify-orchestrator/skills/coolify-status/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/traefik-debugging.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "plugins/rad-repo-manager/references/shelf-spec.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "skills/rad-brainstormer/README.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "skills/rad-brainstormer/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "skills/rad-writer/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "skills/rad-brainstormer/resources/facilitation-principles.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "skills/rad-brainstormer/resources/methodology-catalog.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "legal-compliance",
          "file_path": "skills/rad-brainstormer/resources/methodology-catalog.md",
          "line_number": 551,
          "rule_identifier": "AAK-HEALTHCARE-AI-005",
          "title": "Crisis keywords handled without escalation path",
          "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
          "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "legal-compliance",
          "file_path": "skills/rad-writer/resources/sentence-craft.md",
          "line_number": 135,
          "rule_identifier": "AAK-HEALTHCARE-AI-005",
          "title": "Crisis keywords handled without escalation path",
          "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
          "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "skills/rad-writer/resources/domain-prose.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "skills/rad-writer/resources/voice-profile-schema.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "skills/rad-writer/resources/ai-writing-patterns.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "skills/rad-writer/resources/domain-business-report.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "skills/rad-writer/resources/domain-presentation.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-para-second-brain/README.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-context-prompter/README.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-chrome-extension/skills/chrome-ext-service-worker/references/lifecycle-patterns.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-astro/skills/astro-troubleshooting/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-nextjs/.claude-plugin/plugin.json",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-nextjs/skills/nextjs-troubleshooting/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-nextjs/skills/nextjs-best-practices/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-nextjs/skills/nextjs-troubleshooting/references/common-errors.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-fastify/skills/fastify-troubleshooting/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-para-second-brain/skills/para-organize/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-context-prompter/agents/prompt-debugger.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-context-prompter/skills/prompt-decompiler/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-context-prompter/skills/prompt-engineering/references/techniques.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-seo-optimizer/references/google-ranking-systems.md",
          "line_number": 72,
          "rule_identifier": "AAK-HEALTHCARE-AI-005",
          "title": "Crisis keywords handled without escalation path",
          "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
          "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-seo-optimizer/references/eeat-checklist.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-seo-optimizer/skills/broken-link-fixer/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-seo-optimizer/skills/technical-seo/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-seo-optimizer/skills/fix-seo/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-seo-optimizer/skills/on-page-optimizer/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-seo-optimizer/skills/link-building-strategy/SKILL.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/plugins/rad-zod/skills/zod-integrations/references/monorepo-guide.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "legal-compliance",
          "file_path": "archive/skills/rad-seo-aeo-reviewer/resources/google-ranking-systems.md",
          "line_number": 71,
          "rule_identifier": "AAK-HEALTHCARE-AI-005",
          "title": "Crisis keywords handled without escalation path",
          "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
          "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "archive/skills/rad-seo-aeo-reviewer/resources/eeat-checklist.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        }
      ],
      "execution_duration_seconds": 12.286152978020255,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 601
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211,
        "severity_counts": {
          "low": 1,
          "high": 19,
          "medium": 47,
          "critical": 37,
          "informational": 0
        }
      },
      "display_score": 0.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "bearer",
      "scanner_version": "2.0.2",
      "score": 0.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "bearer",
          "severity": "critical",
          "category": null,
          "file_path": "/repo/plugins/rad-repo-manager/hooks/session-start.py",
          "line_number": 33,
          "rule_identifier": null,
          "title": "Unsanitized user input in OS command",
          "description": "## Description\n\nDirectly incorporating external or user-defined input into an OS command exposes the system to possible command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially leading to a compromise of system integrity.\n\n## Remediations\n\n- **Do not** use OS commands that include dynamic input directly. Instead, explore safer alternatives such as libraries or built-in functions that achieve the same goal without executi",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "critical",
          "category": null,
          "file_path": "/repo/plugins/rad-repo-manager/hooks/stop-nudge.py",
          "line_number": 39,
          "rule_identifier": null,
          "title": "Unsanitized user input in OS command",
          "description": "## Description\n\nDirectly incorporating external or user-defined input into an OS command exposes the system to possible command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially leading to a compromise of system integrity.\n\n## Remediations\n\n- **Do not** use OS commands that include dynamic input directly. Instead, explore safer alternatives such as libraries or built-in functions that achieve the same goal without executi",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "critical",
          "category": null,
          "file_path": "/repo/plugins/rad-repo-manager/scripts/doc-freshness.py",
          "line_number": 83,
          "rule_identifier": null,
          "title": "Unsanitized user input in OS command",
          "description": "## Description\n\nDirectly incorporating external or user-defined input into an OS command exposes the system to possible command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially leading to a compromise of system integrity.\n\n## Remediations\n\n- **Do not** use OS commands that include dynamic input directly. Instead, explore safer alternatives such as libraries or built-in functions that achieve the same goal without executi",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "critical",
          "category": null,
          "file_path": "/repo/plugins/rad-repo-manager/scripts/pre_ship.py",
          "line_number": 126,
          "rule_identifier": null,
          "title": "Unsanitized user input in OS command",
          "description": "## Description\n\nDirectly incorporating external or user-defined input into an OS command exposes the system to possible command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially leading to a compromise of system integrity.\n\n## Remediations\n\n- **Do not** use OS commands that include dynamic input directly. Instead, explore safer alternatives such as libraries or built-in functions that achieve the same goal without executi",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "critical",
          "category": null,
          "file_path": "/repo/plugins/rad-repo-manager/scripts/repo-scan.py",
          "line_number": 223,
          "rule_identifier": null,
          "title": "Unsanitized user input in OS command",
          "description": "## Description\n\nDirectly incorporating external or user-defined input into an OS command exposes the system to possible command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially leading to a compromise of system integrity.\n\n## Remediations\n\n- **Do not** use OS commands that include dynamic input directly. Instead, explore safer alternatives such as libraries or built-in functions that achieve the same goal without executi",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/archive/plugins/rad-code-review/scripts/check-hallucinated-imports.py",
          "line_number": 238,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/archive/plugins/rad-code-review/scripts/check-hallucinated-imports.py",
          "line_number": 416,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/archive/plugins/rad-code-review/scripts/findings-index.py",
          "line_number": 119,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
          "line_number": 432,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
          "line_number": 452,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 204,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
          "line_number": 213,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/plugins/rad-planner/scripts/plan-lint.py",
          "line_number": 382,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/plugins/rad-planner/scripts/validate-json.py",
          "line_number": 187,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/plugins/rad-planner/scripts/validate-json.py",
          "line_number": 192,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "high",
          "category": null,
          "file_path": "/repo/plugins/rad-repo-manager/scripts/align-index.py",
          "line_number": 182,
          "rule_identifier": null,
          "title": "Unsanitized dynamic input in file path",
          "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "medium",
          "category": null,
          "file_path": "/repo/archive/plugins/rad-session/scripts/audit-plugin-bloat.py",
          "line_number": 471,
          "rule_identifier": null,
          "title": "Unsanitized user input in regular expression",
          "description": "## Description\n\nCreating regular expressions from user input can lead to a vulnerability known as Regular Expression Denial of Service (ReDoS). This issue arises because some regular expressions can be processed with exponential time complexity. When attackers exploit this, it can significantly drain CPU resources, effectively causing a denial of service.\n\n## Remediations\n\n- **Do not** construct regular expressions directly from user inputs. This can make your application susceptible to ReDoS at",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "medium",
          "category": null,
          "file_path": "/repo/archive/plugins/rad-code-review/scripts/findings-index.py",
          "line_number": 88,
          "rule_identifier": null,
          "title": "Usage of weak hashing library (SHA-1)",
          "description": "## Description\n\nUsing a weak hashing library like SHA-1 increases the risk of data breaches. SHA-1 in particular is vulnerable to collision attacks, where two different inputs can produce the same hash value, compromising data integrity and security.\n\n## Remediations\n\n- **Do not** use SHA-1 for hashing. It is no longer considered secure due to its vulnerability to collision attacks.\n  ```python\n  hashlib.sha1('password').digest() # unsafe\n  ```\n- **Do** opt for stronger hashing algorithms such a",
          "remediation": null
        },
        {
          "tool_name": "bearer",
          "severity": "medium",
          "category": null,
          "file_path": "/repo/plugins/rad-repo-manager/scripts/align-index.py",
          "line_number": 129,
          "rule_identifier": null,
          "title": "Usage of weak hashing library (SHA-1)",
          "description": "## Description\n\nUsing a weak hashing library like SHA-1 increases the risk of data breaches. SHA-1 in particular is vulnerable to collision attacks, where two different inputs can produce the same hash value, compromising data integrity and security.\n\n## Remediations\n\n- **Do not** use SHA-1 for hashing. It is no longer considered secure due to its vulnerability to collision attacks.\n  ```python\n  hashlib.sha1('password').digest() # unsafe\n  ```\n- **Do** opt for stronger hashing algorithms such a",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 90.89539955498185,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 55
      },
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/Bearer/bearer",
        "report_type": "security",
        "rules_loaded": 554,
        "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"",
        "severity_counts": {
          "low": 0,
          "high": 11,
          "medium": 3,
          "critical": 5,
          "informational": 0
        }
      },
      "display_score": 0.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 59.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "nerlo-behavioral",
          "severity": "high",
          "category": "data-exfiltration",
          "file_path": "/repo/packages/coolify-mcp/index.js",
          "line_number": 41,
          "rule_identifier": "opt.nerlo-rules.nerlo-js-secret-to-network-egress",
          "title": "opt.nerlo-rules.nerlo-js-secret-to-network-egress",
          "description": "A secret / environment variable / token value flows into a network request (fetch / axios / XMLHttpRequest). This is the postmark-mcp supply-chain exfiltration shape reproduced in Node/JS: a credential read from the environment is shipped off-box. Confirm the egress is expected and the value is not being exfiltrated to an attacker-controlled host.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-behavioral",
          "severity": "high",
          "category": "dynamic-execution",
          "file_path": "/repo/plugins/rad-repo-manager/scripts/pre_ship.py",
          "line_number": 126,
          "rule_identifier": "opt.nerlo-rules.nerlo-py-dynamic-exec",
          "title": "opt.nerlo-rules.nerlo-py-dynamic-exec",
          "description": "Dynamic code/command execution (eval/exec/os.system/subprocess shell=True with a non-literal argument) \u2014 a backdoor primitive.",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 6.937513993005268,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 42
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/exfiltration.yaml",
          "/opt/nerlo-rules/clipboard_exfiltration.yaml",
          "/opt/nerlo-rules/rce_endpoint.yaml",
          "/opt/nerlo-rules/taint_egress.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "severity_counts": {
          "low": 0,
          "high": 2,
          "medium": 0,
          "critical": 0,
          "informational": 0
        },
        "merged_invocation": true
      },
      "display_score": 59.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 0.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "informational",
          "category": "install-instruction-run",
          "file_path": "/repo/plugins/rad-1password/skills/op-secrets-injection/SKILL.md",
          "line_number": 236,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
          "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
          "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "informational",
          "category": "install-instruction-run",
          "file_path": "/repo/plugins/rad-1password/skills/op-service-accounts/SKILL.md",
          "line_number": 118,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
          "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
          "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "informational",
          "category": "install-instruction-run",
          "file_path": "/repo/plugins/rad-1password/skills/op-shell-plugins/SKILL.md",
          "line_number": 106,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
          "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
          "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
          "line_number": 226,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
          "line_number": 256,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/multi-server-setup.md",
          "line_number": 12,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/SKILL.md",
          "line_number": 269,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "informational",
          "category": "install-instruction-run",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/common-errors.md",
          "line_number": 64,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
          "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
          "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/common-errors.md",
          "line_number": 64,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/common-errors.md",
          "line_number": 96,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "high",
          "category": "install-instruction-exec",
          "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/traefik-debugging.md",
          "line_number": 50,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
          "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 6.9726024540141225,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 503
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/install_instructions.yaml",
          "/opt/nerlo-rules/cursor_rules.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "severity_counts": {
          "low": 0,
          "high": 7,
          "medium": 0,
          "critical": 0,
          "informational": 4
        },
        "merged_invocation": true
      },
      "display_score": 0.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "capslock",
      "scanner_version": "v0.3.2",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.14271300099790096,
      "status": "not_applicable",
      "examined": {
        "unit": "packages",
        "count": 0
      },
      "metadata": {
        "source": "go-module-proxy",
        "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2",
        "report_type": "go-capability",
        "vendor_mode": false,
        "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2  # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=",
        "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute",
        "go_files_present": 0,
        "artifact_type_policy": "claude_skill",
        "expected_capabilities": null,
        "artifact_type_explicit": true
      },
      "display_score": null,
      "display_badge": "not_applicable"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "7f9cdc36-3ad3-4b87-b210-b266b0a77271",
    "scan_completed_at": "2026-08-12T21:39:02.077725+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "bearer": "2.0.2",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "capslock": "v0.3.2"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:d5aaefa8b517d1f03832091ab094e20dc73160a07ae1102af1b2e395ce6ce852",
    "ai_decision_log_ids": [
      "1c1eadd4-ee30-48a4-bc6e-944acf4d8066"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.6715245270170271,
        "status": "complete",
        "examined": {
          "unit": "scan_targets",
          "count": 1
        },
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": [
            "claude_config"
          ],
          "score_breakdown": {
            "mcp": 100,
            "hooks": 100,
            "agents": 100,
            "secrets": 100,
            "permissions": 100
          }
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 0.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-planner/skills/replan/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-planner/skills/review-plan/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-planner/skills/rescue/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-planner/skills/plan/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-brainstormer/skills/design-sprint/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-brainstormer/skills/idea-evaluation/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-brainstormer/skills/brainstorm-session/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-brainstormer/skills/five-whys/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/skills/op-ssh-keys/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "unauthorized_tool_use",
            "file_path": "/repo/plugins/rad-1password/skills/op-ssh-keys/SKILL.md",
            "line_number": 115,
            "rule_identifier": "YARA_system_manipulation_generic",
            "title": "SYSTEM MANIPULATION detected by YARA",
            "description": "Detects system manipulation, privilege escalation, and destructive file operations: shred -u /",
            "remediation": "Review and remove system manipulation pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/skills/op-find/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/skills/op-service-accounts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/skills/1password-cli/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/skills/op-provisioning/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/skills/op-secrets-injection/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "data_exfiltration",
            "file_path": "/repo/plugins/rad-1password/skills/op-secrets-injection/SKILL.md",
            "line_number": 3,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline reads sensitive data and sends it over the network: `curl -sSf https://downloads.1password.com/linux/keys/1password.asc | sudo gpg --dearmor -o /usr/share/keyrings/1password-archive-keyring.gpg`. This is likely data exfiltration.",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "hardcoded_secrets",
            "file_path": "/repo/plugins/rad-1password/skills/op-secrets-injection/SKILL.md",
            "line_number": 70,
            "rule_identifier": "SECRET_CONNECTION_STRING",
            "title": "Database connection string with embedded credentials",
            "description": "Pattern detected: post****",
            "remediation": "Remove credentials from connection strings"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/skills/op-item-management/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/skills/op-signin/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/skills/op-status/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/skills/op-secret-template/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/skills/op-shell-plugins/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-codex/skills/delegate/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-codex/skills/review/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-cicd/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-security/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
            "line_number": 1,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/multi-server-setup.md",
            "line_number": 1,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://get.docker.com | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-databases/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-observability/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-actions/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-status/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/SKILL.md",
            "line_number": 3,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-deploy/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-repo-manager/skills/adopt/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-repo-manager/skills/startup/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-repo-manager/skills/ship/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-repo-manager/skills/wrapup/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-repo-manager/skills/repo-init/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-repo-manager/skills/repo-align/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/skills/rad-brainstormer/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'RAD Brainstormer' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/skills/rad-brainstormer/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/skills/use-codex/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/skills/rad-writer/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'RAD Writer' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/skills/rad-writer/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-ui-react/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-messaging/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-testing/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-permissions/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-storage/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "transitive_trust_abuse",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/debugging-guide.md",
            "line_number": 61,
            "rule_identifier": "YARA_indirect_prompt_injection_generic",
            "title": "TRANSITIVE TRUST ABUSE detected by YARA",
            "description": "Detects indirect prompt injection via instruction manipulation from external sources: execute inline script",
            "remediation": "Review and remove transitive trust abuse pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-security/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-best-practices/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-service-worker/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-astro/skills/astro-security/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-astro/skills/astro-performance/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-astro/skills/astro-accessibility/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-astro/skills/astro-best-practices/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-astro/skills/astro-troubleshooting/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/SKILL.md",
            "line_number": 38,
            "rule_identifier": "YARA_code_execution_generic",
            "title": "CODE EXECUTION detected by YARA",
            "description": "Detects dangerous code execution patterns with untrusted input in agent skills: http://localhost:3000`) \u2014 use relative paths in all tests.\n- Never start the server using `cy.exec(",
            "remediation": "Review and remove code execution pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-troubleshooting/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-security/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-best-practices/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-a11y/skills/a11y-aria-patterns/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-a11y/skills/a11y-forms/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-a11y/skills/a11y-testing/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-a11y/skills/a11y-semantic-html/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-a11y/skills/a11y-keyboard-focus/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-a11y/skills/a11y-review/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-zod-contracts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-handling/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-security/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-testing/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-best-practices/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-subscription-lifecycle/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-idempotency/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-type-patterns/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-strict-mode/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-modern-features/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-api-safety/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-error-handling/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-anti-patterns/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-schemas-validation/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-troubleshooting/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-testing/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-typescript/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-production/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-logging/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-best-practices/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-fastify/skills/fastify-hooks-lifecycle/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-security/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "hardcoded_secrets",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-security/SKILL.md",
            "line_number": 121,
            "rule_identifier": "YARA_credential_harvesting_generic",
            "title": "CREDENTIAL HARVESTING detected by YARA",
            "description": "Detects potential exposure of sensitive information like API keys, passwords, tokens, and certificates: steal the token",
            "remediation": "Review and remove credential harvesting pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-app-building/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-accessibility/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-engineering/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-performance/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-foundations/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/progressive-summarization/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/express-workflow/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/twelve-favorite-problems/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/para-organize/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/hemingway-bridge/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stack-guide/skills/review-for-ship/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stack-guide/skills/detect-stack/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-shared/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-drive/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-exec-assistant/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-drive-upload/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-send-team-announcement/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-people/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-doc-from-template/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-schedule-recurring-event/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-workflow-meeting-prep/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-review-meet-participants/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-send/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-bulk-download-folder/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-workflow-standup-report/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-workflow-file-announce/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-calendar/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-meet-space/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-watch/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-forward/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-sheets-append/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-organize-drive-folder/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-forward-labeled-emails/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-modelarmor-sanitize-prompt/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-docs-write/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-classroom/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-save-email-attachments/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-reply-all/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-save-email-to-doc/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-watch-drive-changes/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-collect-form-responses/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-researcher/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-share-event-materials/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-events-renew/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-read/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-block-focus-time/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-script-push/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-hr-coordinator/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-reply/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-forms/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-workflow-weekly-digest/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-events-subscribe/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-log-deal-update/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-email-drive-link/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-label-and-archive-emails/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-project-manager/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-draft-email-from-doc/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-calendar-insert/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-share-doc-and-notify/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-sales-ops/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-script/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-vacation-responder/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-meet/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail-triage/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-sheets/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-feedback-form/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-review-overdue-tasks/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-task-list/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-post-mortem-setup/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-keep/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-backup-sheet-as-csv/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-expense-tracker/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-classroom-course/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-events/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-modelarmor-create-template/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-shared-drive/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-generate-report-from-sheet/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-tasks/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-plan-weekly-schedule/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-sheets-read/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-modelarmor/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-it-admin/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-gmail-filter/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-sync-contacts-to-sheet/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-event-coordinator/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-share-folder-with-team/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-workflow/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-reschedule-meeting/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-find-free-time/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-batch-invite-to-event/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-find-large-files/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-customer-support/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-workflow-email-to-task/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-content-creator/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-slides/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-compare-sheet-tabs/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-chat-send/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-gmail/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-presentation/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-modelarmor-sanitize-response/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-chat/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-copy-sheet-for-new-month/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-admin-reports/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/gws-calendar-agenda/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/persona-team-lead/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/skills/recipe-create-events-from-sheet/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-decompiler/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-engineering/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-context-prompter/skills/loop-goal-engineering/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/skills/startup/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
            "title": "Skill description exceeds agent skills length limit",
            "description": "Skill description is 1037 characters; Agent skills limit the `description` field to 1024 characters.",
            "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/skills/startup/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/skills/wrapup/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/skills/add-resource/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/keyword-discovery/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/broken-link-fixer/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/competitor-intelligence/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/content-strategist/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/seo-report-generator/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/aeo-optimizer/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/technical-seo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/fix-seo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/full-seo-audit/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/schema-architect/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/on-page-optimizer/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/skills/link-building-strategy/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-best-practices/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'Zod Best Practices' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-best-practices/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-schema-design/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'Zod Schema Design' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-schema-design/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-integrations/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'Zod Framework Integrations' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-integrations/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-error-handling/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'Zod Error Handling' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-error-handling/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-v4-migration/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'Zod v4 Migration and New APIs' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-v4-migration/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-security/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'Zod Security' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-security/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-explain/skills/explain-document/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-explain/skills/narrate-project/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-explain/skills/ground-readme/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-explain/skills/elevator-pitch/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-explain/skills/draft-pitch/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-council/skills/convene/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/skills/rad-seo-aeo-reviewer/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'RAD SEO AEO Reviewer' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/skills/rad-seo-aeo-reviewer/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/.",
            "line_number": null,
            "rule_identifier": "EXCESSIVE_FILE_COUNT",
            "title": "Skill package contains many files",
            "description": "Skill package contains 618 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
            "remediation": "Review file inventory and remove unnecessary files."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/.rad-repo-manager.json",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .rad-repo-manager.json. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/.rad/repo-manager-state.json",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .rad/repo-manager-state.json. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "unauthorized_tool_use",
            "file_path": "/repo/repo/AGENTS.md",
            "line_number": null,
            "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
            "title": "Undeclared network usage",
            "description": "Skill code uses network libraries but doesn't declare network requirement",
            "remediation": "Declare network usage in compatibility field or remove network calls"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-a11y/agents/a11y-reviewer.md",
            "line_number": 135,
            "rule_identifier": "YARA_script_injection_generic",
            "title": "INJECTION ATTACK detected by YARA",
            "description": "Detects malicious script injection patterns in agent skills: href=\"javascript:v",
            "remediation": "Review and remove injection attack pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/audit-manifest.py",
            "line_number": 289,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
            "line_number": 7,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
            "line_number": 80,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
            "line_number": 86,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "transitive_trust_abuse",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/debugging-guide.md",
            "line_number": 61,
            "rule_identifier": "YARA_indirect_prompt_injection_generic",
            "title": "TRANSITIVE TRUST ABUSE detected by YARA",
            "description": "Detects indirect prompt injection via instruction manipulation from external sources: execute inline script",
            "remediation": "Review and remove transitive trust abuse pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/SKILL.md",
            "line_number": 51,
            "rule_identifier": "YARA_code_execution_generic",
            "title": "CODE EXECUTION detected by YARA",
            "description": "Detects dangerous code execution patterns with untrusted input in agent skills: http://localhost:3000`) \u2014 use relative paths in all tests.\n- Never start the server using `cy.exec(",
            "remediation": "Review and remove code execution pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
            "line_number": 133,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
            "line_number": 135,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 109,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 113,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 148,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 153,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 195,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 197,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: archive/plugins/rad-session/fixtures/codex-only-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: archive/plugins/rad-session/fixtures/dev-mode-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: archive/plugins/rad-session/fixtures/dual-scope-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: archive/plugins/rad-session/fixtures/nonstandard-manual/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/packages/coolify-mcp/index.js",
            "line_number": 41,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "data_exfiltration",
            "file_path": "/repo/plugins/rad-1password/skills/op-secrets-injection/SKILL.md",
            "line_number": 3,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline reads sensitive data and sends it over the network: `curl -sSf https://downloads.1password.com/linux/keys/1password.asc | sudo gpg --dearmor -o /usr/share/keyrings/1password-archive-keyring.gpg`. This is likely data exfiltration.",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "unauthorized_tool_use",
            "file_path": "/repo/plugins/rad-1password/skills/op-ssh-keys/SKILL.md",
            "line_number": 121,
            "rule_identifier": "YARA_system_manipulation_generic",
            "title": "SYSTEM MANIPULATION detected by YARA",
            "description": "Detects system manipulation, privilege escalation, and destructive file operations: shred -u /",
            "remediation": "Review and remove system manipulation pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
            "line_number": 1,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/multi-server-setup.md",
            "line_number": 1,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://get.docker.com | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/SKILL.md",
            "line_number": 3,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-repo-manager/scripts/pre_ship.py",
            "line_number": 126,
            "rule_identifier": "COMMAND_INJECTION_SHELL_TRUE",
            "title": "Shell command execution with shell=True enabled",
            "description": "Pattern detected: subprocess.run(command, cwd=root, shell=True",
            "remediation": "Use shell=False and pass commands as lists"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-repo-manager/scripts/structure-drift.py",
            "line_number": 103,
            "rule_identifier": "GLOB_HIDDEN_FILE_TARGETING",
            "title": "Glob or find pattern targeting hidden (dot) files, which may expose sensitive configurations",
            "description": "Pattern detected: glob(\"route.*",
            "remediation": "Avoid targeting hidden files with glob patterns. Be explicit about which files to access"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/.claude/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/.claude/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name '.claude' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/.claude/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/skills/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/skills/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/.github/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/.github/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name '.github' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/.github/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/archive/.",
            "line_number": null,
            "rule_identifier": "EXCESSIVE_FILE_COUNT",
            "title": "Skill package contains many files",
            "description": "Skill package contains 420 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
            "remediation": "Review file inventory and remove unnecessary files."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "unauthorized_tool_use",
            "file_path": "/repo/archive/repo/archive/README.md",
            "line_number": null,
            "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
            "title": "Undeclared network usage",
            "description": "Skill code uses network libraries but doesn't declare network requirement",
            "remediation": "Declare network usage in compatibility field or remove network calls"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-a11y/agents/a11y-reviewer.md",
            "line_number": 135,
            "rule_identifier": "YARA_script_injection_generic",
            "title": "INJECTION ATTACK detected by YARA",
            "description": "Detects malicious script injection patterns in agent skills: href=\"javascript:v",
            "remediation": "Review and remove injection attack pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/audit-manifest.py",
            "line_number": 289,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
            "line_number": 7,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
            "line_number": 80,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
            "line_number": 86,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "transitive_trust_abuse",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/debugging-guide.md",
            "line_number": 61,
            "rule_identifier": "YARA_indirect_prompt_injection_generic",
            "title": "TRANSITIVE TRUST ABUSE detected by YARA",
            "description": "Detects indirect prompt injection via instruction manipulation from external sources: execute inline script",
            "remediation": "Review and remove transitive trust abuse pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/SKILL.md",
            "line_number": 51,
            "rule_identifier": "YARA_code_execution_generic",
            "title": "CODE EXECUTION detected by YARA",
            "description": "Detects dangerous code execution patterns with untrusted input in agent skills: http://localhost:3000`) \u2014 use relative paths in all tests.\n- Never start the server using `cy.exec(",
            "remediation": "Review and remove code execution pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
            "line_number": 133,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
            "line_number": 135,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 109,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 113,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 148,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 153,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 195,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 197,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: plugins/rad-session/fixtures/codex-only-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: plugins/rad-session/fixtures/dev-mode-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: plugins/rad-session/fixtures/dual-scope-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: plugins/rad-session/fixtures/nonstandard-manual/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "policy_violation",
            "file_path": "/repo/packages/coolify-mcp",
            "line_number": null,
            "rule_identifier": "LOW_ANALYZABILITY",
            "title": "Moderate analyzability score",
            "description": "Only 76% of skill content could be analyzed. 1 of 5 files are opaque to the scanner. Some content could not be verified as safe.",
            "remediation": "Review opaque files and replace with inspectable formats where possible."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/packages/coolify-mcp/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/packages/coolify-mcp/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/packages/coolify-mcp/index.js",
            "line_number": 41,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-planner/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-planner/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-brainstormer/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-brainstormer/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-1password/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "data_exfiltration",
            "file_path": "/repo/plugins/rad-1password/skills/op-secrets-injection/SKILL.md",
            "line_number": 3,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline reads sensitive data and sends it over the network: `curl -sSf https://downloads.1password.com/linux/keys/1password.asc | sudo gpg --dearmor -o /usr/share/keyrings/1password-archive-keyring.gpg`. This is likely data exfiltration.",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "unauthorized_tool_use",
            "file_path": "/repo/plugins/rad-1password/skills/op-ssh-keys/SKILL.md",
            "line_number": 121,
            "rule_identifier": "YARA_system_manipulation_generic",
            "title": "SYSTEM MANIPULATION detected by YARA",
            "description": "Detects system manipulation, privilege escalation, and destructive file operations: shred -u /",
            "remediation": "Review and remove system manipulation pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-codex/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-codex/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
            "line_number": 1,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/multi-server-setup.md",
            "line_number": 1,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://get.docker.com | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/SKILL.md",
            "line_number": 3,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash`. This is a remote code execution pattern. (Note: appears to be instructional install text in SKILL.md; review URL trust and pinning.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-repo-manager/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-repo-manager/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-repo-manager/scripts/pre_ship.py",
            "line_number": 126,
            "rule_identifier": "COMMAND_INJECTION_SHELL_TRUE",
            "title": "Shell command execution with shell=True enabled",
            "description": "Pattern detected: subprocess.run(command, cwd=root, shell=True",
            "remediation": "Use shell=False and pass commands as lists"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-repo-manager/scripts/structure-drift.py",
            "line_number": 103,
            "rule_identifier": "GLOB_HIDDEN_FILE_TARGETING",
            "title": "Glob or find pattern targeting hidden (dot) files, which may expose sensitive configurations",
            "description": "Pattern detected: glob(\"route.*",
            "remediation": "Avoid targeting hidden files with glob patterns. Be explicit about which files to access"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-planner/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-planner/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-planner/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-planner/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-planner/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-planner/examples/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-planner/examples/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-planner/references/subagent-prompts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-planner/references/subagent-prompts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-brainstormer/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-brainstormer/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-brainstormer/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-brainstormer/references/subagent-prompts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-brainstormer/references/subagent-prompts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-1password/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-1password/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-codex/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-codex/skills/delegate/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-codex/skills/delegate/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
            "title": "Skill description exceeds agent skills length limit",
            "description": "Skill description is 1693 characters; Agent skills limit the `description` field to 1024 characters.",
            "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-cicd/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-cicd/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-security/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-security/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/SKILL.md",
            "line_number": 1,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://get.docker.com | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/multi-server-setup.md",
            "line_number": 1,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://get.docker.com | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-databases/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-databases/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-observability/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-observability/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-actions/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-actions/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-deploy/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-deploy/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-repo-manager/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-repo-manager/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-repo-manager/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-repo-manager/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-repo-manager/scripts/pre_ship.py",
            "line_number": 126,
            "rule_identifier": "COMMAND_INJECTION_SHELL_TRUE",
            "title": "Shell command execution with shell=True enabled",
            "description": "Pattern detected: subprocess.run(command, cwd=root, shell=True",
            "remediation": "Use shell=False and pass commands as lists"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "command_injection",
            "file_path": "/repo/plugins/rad-repo-manager/scripts/structure-drift.py",
            "line_number": 103,
            "rule_identifier": "GLOB_HIDDEN_FILE_TARGETING",
            "title": "Glob or find pattern targeting hidden (dot) files, which may expose sensitive configurations",
            "description": "Pattern detected: glob(\"route.*",
            "remediation": "Avoid targeting hidden files with glob patterns. Be explicit about which files to access"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/plugins/rad-repo-manager/templates/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/plugins/rad-repo-manager/templates/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/skills/rad-brainstormer/resources/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/skills/rad-brainstormer/resources/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/skills/rad-writer/resources/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/skills/rad-writer/resources/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/.github/ISSUE_TEMPLATE/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/.github/ISSUE_TEMPLATE/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_INVALID_NAME",
            "title": "Skill name does not follow agent skills naming rules",
            "description": "Skill name 'Bug Report' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.",
            "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/.github/ISSUE_TEMPLATE/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/audit-manifest.py",
            "line_number": 289,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
            "line_number": 7,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
            "line_number": 80,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
            "line_number": 86,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "transitive_trust_abuse",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/debugging-guide.md",
            "line_number": 61,
            "rule_identifier": "YARA_indirect_prompt_injection_generic",
            "title": "TRANSITIVE TRUST ABUSE detected by YARA",
            "description": "Detects indirect prompt injection via instruction manipulation from external sources: execute inline script",
            "remediation": "Review and remove transitive trust abuse pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-astro/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-astro/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-nextjs/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-nextjs/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/SKILL.md",
            "line_number": 51,
            "rule_identifier": "YARA_code_execution_generic",
            "title": "CODE EXECUTION detected by YARA",
            "description": "Detects dangerous code execution patterns with untrusted input in agent skills: http://localhost:3000`) \u2014 use relative paths in all tests.\n- Never start the server using `cy.exec(",
            "remediation": "Review and remove code execution pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-a11y/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-a11y/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-a11y/agents/a11y-reviewer.md",
            "line_number": 135,
            "rule_identifier": "YARA_script_injection_generic",
            "title": "INJECTION ATTACK detected by YARA",
            "description": "Detects malicious script injection patterns in agent skills: href=\"javascript:v",
            "remediation": "Review and remove injection attack pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-code-review/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-code-review/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-typescript/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-fastify/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-fastify/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-react/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-stack-guide/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stack-guide/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-google-workspace/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-google-workspace/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-context-prompter/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-context-prompter/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: fixtures/codex-only-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: fixtures/dev-mode-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: fixtures/dual-scope-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: fixtures/nonstandard-manual/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "unauthorized_tool_use",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/repo/archive/plugins/rad-seo-optimizer/README.md",
            "line_number": null,
            "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
            "title": "Undeclared network usage",
            "description": "Skill code uses network libraries but doesn't declare network requirement",
            "remediation": "Declare network usage in compatibility field or remove network calls"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
            "line_number": 133,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
            "line_number": 135,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 109,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 113,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 148,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 153,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 195,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 197,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-zod/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-explain/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-explain/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-council/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-council/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
            "title": "Skill description exceeds agent skills length limit",
            "description": "Skill description is 1588 characters; Agent skills limit the `description` field to 1024 characters.",
            "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/audit-manifest.py",
            "line_number": 289,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
            "line_number": 7,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
            "line_number": 80,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/scripts/scan-mv3-violations.py",
            "line_number": 86,
            "rule_identifier": "COMMAND_INJECTION_EVAL",
            "title": "Dangerous code execution functions that can execute arbitrary code",
            "description": "Pattern detected: eval(",
            "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-ui-react/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-ui-react/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-messaging/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-messaging/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-testing/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-testing/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-permissions/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-permissions/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-storage/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-storage/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "transitive_trust_abuse",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/SKILL.md",
            "line_number": 61,
            "rule_identifier": "YARA_indirect_prompt_injection_generic",
            "title": "TRANSITIVE TRUST ABUSE detected by YARA",
            "description": "Detects indirect prompt injection via instruction manipulation from external sources: execute inline script",
            "remediation": "Review and remove transitive trust abuse pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "transitive_trust_abuse",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/references/debugging-guide.md",
            "line_number": 61,
            "rule_identifier": "YARA_indirect_prompt_injection_generic",
            "title": "TRANSITIVE TRUST ABUSE detected by YARA",
            "description": "Detects indirect prompt injection via instruction manipulation from external sources: execute inline script",
            "remediation": "Review and remove transitive trust abuse pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-security/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-security/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-best-practices/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-best-practices/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-service-worker/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-chrome-extension/skills/chrome-ext-service-worker/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-astro/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-astro/skills/astro-best-practices/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-astro/skills/astro-best-practices/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-nextjs/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-testing/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-troubleshooting/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-troubleshooting/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-security/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-security/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-best-practices/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-nextjs/skills/nextjs-best-practices/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-a11y/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-a11y/agents/SKILL.md",
            "line_number": 107,
            "rule_identifier": "YARA_script_injection_generic",
            "title": "INJECTION ATTACK detected by YARA",
            "description": "Detects malicious script injection patterns in agent skills: href=\"javascript:v",
            "remediation": "Review and remove injection attack pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-a11y/agents/a11y-reviewer.md",
            "line_number": 135,
            "rule_identifier": "YARA_script_injection_generic",
            "title": "INJECTION ATTACK detected by YARA",
            "description": "Detects malicious script injection patterns in agent skills: href=\"javascript:v",
            "remediation": "Review and remove injection attack pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-a11y/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-a11y/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
            "title": "Skill description exceeds agent skills length limit",
            "description": "Skill description is 1723 characters; Agent skills limit the `description` field to 1024 characters.",
            "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-handling/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-handling/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-testing/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-testing/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-best-practices/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-webhook-best-practices/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-subscription-lifecycle/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stripe-fastify-webhooks/skills/stripe-subscription-lifecycle/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-code-review/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-code-review/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/workflows/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/workflows/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "hardcoded_secrets",
            "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/workflows/SKILL.md",
            "line_number": 115,
            "rule_identifier": "SECRET_CONNECTION_STRING",
            "title": "Database connection string with embedded credentials",
            "description": "Pattern detected: post****",
            "remediation": "Remove credentials from connection strings"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/templates/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/templates/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/references/subagent-prompts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-code-review/skills/rad-code-review/references/subagent-prompts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
            "title": "Skill description exceeds agent skills length limit",
            "description": "Skill description is 1738 characters; Agent skills limit the `description` field to 1024 characters.",
            "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-type-patterns/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-type-patterns/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-strict-mode/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-strict-mode/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-modern-features/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-modern-features/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-api-safety/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-api-safety/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-error-handling/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-error-handling/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-anti-patterns/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-typescript/skills/typescript-anti-patterns/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-fastify/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-security/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-security/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-app-building/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-app-building/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-accessibility/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-accessibility/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-engineering/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-engineering/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-performance/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-performance/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-foundations/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-react/skills/react-foundations/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
            "title": "Skill description exceeds agent skills length limit",
            "description": "Skill description is 1748 characters; Agent skills limit the `description` field to 1024 characters.",
            "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "high",
            "category": "command_injection",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/agents/SKILL.md",
            "line_number": 279,
            "rule_identifier": "FIND_EXEC_PATTERN",
            "title": "find command with -exec flag can execute arbitrary commands on discovered files",
            "description": "Pattern detected: find \"$PARA_ROOT/Projects\" -maxdepth 1 -mindepth 1 -type d -exec ",
            "remediation": "Avoid find -exec with untrusted directories. Use explicit file lists instead"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/progressive-summarization/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/progressive-summarization/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/para-organize/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-para-second-brain/skills/para-organize/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-stack-guide/skills/detect-stack/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-stack-guide/skills/detect-stack/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-context-prompter/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
            "title": "Skill description exceeds agent skills length limit",
            "description": "Skill description is 2232 characters; Agent skills limit the `description` field to 1024 characters.",
            "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-context-prompter/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-decompiler/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-decompiler/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-engineering/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-engineering/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "critical",
            "category": "prompt_injection",
            "file_path": "/repo/archive/plugins/rad-context-prompter/skills/prompt-engineering/references/SKILL.md",
            "line_number": 2238,
            "rule_identifier": "YARA_coercive_injection_generic",
            "title": "PROMPT INJECTION detected by YARA",
            "description": "Detects coercive prompt injections in tool description fields: You MUST use this tool",
            "remediation": "Review and remove prompt injection pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-context-prompter/skills/loop-goal-engineering/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-context-prompter/skills/loop-goal-engineering/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: codex-only-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: dev-mode-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: dual-scope-project/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: nonstandard-manual/.rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/.rad/profile",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .rad/profile. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/docs/decisions/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/docs/decisions/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/docs/planning/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/codex-only-project/docs/planning/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/docs/planning/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/nonstandard-manual/docs/planning/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/docs/decisions/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/docs/decisions/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/docs/planning/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dual-scope-project/docs/planning/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/docs/planning/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-session/fixtures/dev-mode-project/docs/planning/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "unauthorized_tool_use",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/repo/archive/plugins/rad-seo-optimizer/scripts/README.md",
            "line_number": null,
            "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
            "title": "Undeclared network usage",
            "description": "Skill code uses network libraries but doesn't declare network requirement",
            "remediation": "Declare network usage in compatibility field or remove network calls"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
            "line_number": 133,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
            "line_number": 135,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 109,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 113,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 148,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 153,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 195,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.Request(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "data_exfiltration",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 197,
            "rule_identifier": "DATA_EXFIL_NETWORK_REQUESTS",
            "title": "Outbound network request primitives that can transmit data externally",
            "description": "Pattern detected: urllib.request.urlopen(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/references/subagent-prompts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/references/subagent-prompts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_DESCRIPTION_TOO_LONG",
            "title": "Skill description exceeds agent skills length limit",
            "description": "Skill description is 2226 characters; Agent skills limit the `description` field to 1024 characters.",
            "remediation": "Shorten the description to 1024 characters or fewer while keeping it specific"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-best-practices/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-best-practices/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-schema-design/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-schema-design/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-integrations/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-integrations/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-error-handling/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-error-handling/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-v4-migration/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-v4-migration/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-security/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-zod/skills/zod-security/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-explain/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-explain/scripts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-council/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-council/references/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-council/agents/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-council/references/examples/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-council/references/examples/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/plugins/rad-council/references/subagent-prompts/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/plugins/rad-council/references/subagent-prompts/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/archive/skills/rad-seo-aeo-reviewer/resources/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/archive/skills/rad-seo-aeo-reviewer/resources/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          }
        ],
        "execution_duration_seconds": 44.46300129801966,
        "status": "complete",
        "examined": {
          "unit": "skills",
          "count": 369
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "replan",
            "review-plan",
            "rescue",
            "plan",
            "design-sprint",
            "idea-evaluation",
            "brainstorm-session",
            "five-whys",
            "op-ssh-keys",
            "op-find",
            "op-service-accounts",
            "1password-cli",
            "op-provisioning",
            "op-secrets-injection",
            "op-item-management",
            "op-signin",
            "op-status",
            "op-secret-template",
            "op-shell-plugins",
            "delegate",
            "review",
            "coolify-cicd",
            "coolify-security",
            "coolify-infrastructure",
            "coolify-databases",
            "coolify-observability",
            "coolify-actions",
            "coolify-status",
            "coolify-troubleshoot",
            "coolify-deploy",
            "adopt",
            "startup",
            "ship",
            "wrapup",
            "repo-init",
            "repo-align",
            "RAD Brainstormer",
            "use-codex",
            "RAD Writer",
            "chrome-ext-ui-react",
            "chrome-ext-messaging",
            "chrome-ext-testing",
            "chrome-ext-permissions",
            "chrome-ext-storage",
            "chrome-ext-troubleshooting",
            "chrome-ext-security",
            "chrome-ext-best-practices",
            "chrome-ext-service-worker",
            "astro-security",
            "astro-performance",
            "astro-accessibility",
            "astro-best-practices",
            "astro-troubleshooting",
            "nextjs-testing",
            "nextjs-troubleshooting",
            "nextjs-security",
            "nextjs-best-practices",
            "a11y-aria-patterns",
            "a11y-forms",
            "a11y-testing",
            "a11y-semantic-html",
            "a11y-keyboard-focus",
            "a11y-review",
            "stripe-zod-contracts",
            "stripe-webhook-handling",
            "stripe-webhook-security",
            "stripe-webhook-testing",
            "stripe-webhook-best-practices",
            "stripe-subscription-lifecycle",
            "stripe-webhook-idempotency",
            "rad-code-review",
            "typescript-type-patterns",
            "typescript-strict-mode",
            "typescript-modern-features",
            "typescript-api-safety",
            "typescript-error-handling",
            "typescript-anti-patterns",
            "fastify-schemas-validation",
            "fastify-troubleshooting",
            "fastify-testing",
            "fastify-typescript",
            "fastify-production",
            "fastify-logging",
            "fastify-best-practices",
            "fastify-hooks-lifecycle",
            "react-security",
            "react-app-building",
            "react-accessibility",
            "react-engineering",
            "react-performance",
            "react-foundations",
            "progressive-summarization",
            "express-workflow",
            "twelve-favorite-problems",
            "para-organize",
            "hemingway-bridge",
            "review-for-ship",
            "detect-stack",
            "gws-shared",
            "gws-drive",
            "persona-exec-assistant",
            "gws-drive-upload",
            "recipe-send-team-announcement",
            "gws-people",
            "recipe-create-doc-from-template",
            "recipe-schedule-recurring-event",
            "gws-workflow-meeting-prep",
            "recipe-review-meet-participants",
            "gws-gmail-send",
            "recipe-bulk-download-folder",
            "gws-workflow-standup-report",
            "gws-workflow-file-announce",
            "gws-calendar",
            "recipe-create-meet-space",
            "gws-gmail-watch",
            "gws-gmail-forward",
            "gws-sheets-append",
            "recipe-organize-drive-folder",
            "recipe-forward-labeled-emails",
            "gws-modelarmor-sanitize-prompt",
            "gws-docs-write",
            "gws-classroom",
            "recipe-save-email-attachments",
            "gws-gmail-reply-all",
            "gws-docs",
            "recipe-save-email-to-doc",
            "recipe-watch-drive-changes",
            "recipe-collect-form-responses",
            "persona-researcher",
            "recipe-share-event-materials",
            "gws-events-renew",
            "gws-gmail-read",
            "recipe-block-focus-time",
            "gws-script-push",
            "persona-hr-coordinator",
            "gws-gmail-reply",
            "gws-forms",
            "gws-workflow-weekly-digest",
            "gws-events-subscribe",
            "recipe-log-deal-update",
            "recipe-email-drive-link",
            "recipe-label-and-archive-emails",
            "persona-project-manager",
            "recipe-draft-email-from-doc",
            "gws-calendar-insert",
            "recipe-share-doc-and-notify",
            "persona-sales-ops",
            "gws-script",
            "recipe-create-vacation-responder",
            "gws-meet",
            "gws-gmail-triage",
            "gws-sheets",
            "recipe-create-feedback-form",
            "recipe-review-overdue-tasks",
            "recipe-create-task-list",
            "recipe-post-mortem-setup",
            "gws-keep",
            "recipe-backup-sheet-as-csv",
            "recipe-create-expense-tracker",
            "recipe-create-classroom-course",
            "gws-events",
            "gws-modelarmor-create-template",
            "recipe-create-shared-drive",
            "recipe-generate-report-from-sheet",
            "gws-tasks",
            "recipe-plan-weekly-schedule",
            "gws-sheets-read",
            "gws-modelarmor",
            "persona-it-admin",
            "recipe-create-gmail-filter",
            "recipe-sync-contacts-to-sheet",
            "persona-event-coordinator",
            "recipe-share-folder-with-team",
            "gws-workflow",
            "recipe-reschedule-meeting",
            "recipe-find-free-time",
            "recipe-batch-invite-to-event",
            "recipe-find-large-files",
            "persona-customer-support",
            "gws-workflow-email-to-task",
            "persona-content-creator",
            "gws-slides",
            "recipe-compare-sheet-tabs",
            "gws-chat-send",
            "gws-gmail",
            "recipe-create-presentation",
            "gws-modelarmor-sanitize-response",
            "gws-chat",
            "recipe-copy-sheet-for-new-month",
            "gws-admin-reports",
            "gws-calendar-agenda",
            "persona-team-lead",
            "recipe-create-events-from-sheet",
            "prompt-decompiler",
            "prompt-engineering",
            "loop-goal-engineering",
            "startup",
            "wrapup",
            "add-resource",
            "keyword-discovery",
            "broken-link-fixer",
            "competitor-intelligence",
            "content-strategist",
            "seo-report-generator",
            "aeo-optimizer",
            "technical-seo",
            "fix-seo",
            "full-seo-audit",
            "schema-architect",
            "on-page-optimizer",
            "link-building-strategy",
            "Zod Best Practices",
            "Zod Schema Design",
            "Zod Framework Integrations",
            "Zod Error Handling",
            "Zod v4 Migration and New APIs",
            "Zod Security",
            "explain-document",
            "narrate-project",
            "ground-readme",
            "elevator-pitch",
            "draft-pitch",
            "convene",
            "RAD SEO AEO Reviewer",
            "repo",
            ".claude",
            "skills",
            ".github",
            "docs",
            "archive",
            "coolify-mcp",
            "rad-planner",
            "rad-brainstormer",
            "rad-1password",
            "rad-codex",
            "rad-coolify-orchestrator",
            "rad-repo-manager",
            "references",
            "risk-assessor",
            "scripts",
            "examples",
            "subagent-prompts",
            "references",
            "domain-researcher",
            "subagent-prompts",
            "scripts",
            "codex-worker",
            "references",
            "coolify-reviewer",
            "scripts",
            "references",
            "references",
            "references",
            "references",
            "references",
            "references",
            "references",
            "references",
            "references",
            "scripts",
            "templates",
            "resources",
            "resources",
            "Bug Report",
            "rad-chrome-extension",
            "rad-astro",
            "rad-nextjs",
            "rad-a11y",
            "rad-stripe-fastify-webhooks",
            "rad-code-review",
            "rad-typescript",
            "rad-fastify",
            "rad-react",
            "rad-para-second-brain",
            "rad-stack-guide",
            "rad-google-workspace",
            "rad-context-prompter",
            "rad-session",
            "rad-seo-optimizer",
            "rad-zod",
            "rad-explain",
            "rad-council",
            "chrome-ext-reviewer",
            "scripts",
            "references",
            "references",
            "references",
            "references",
            "references",
            "references",
            "references",
            "references",
            "references",
            "astro-reviewer",
            "references",
            "nextjs-reviewer",
            "references",
            "references",
            "references",
            "references",
            "a11y-reviewer",
            "scripts",
            "stripe-webhook-reviewer",
            "references",
            "references",
            "references",
            "references",
            "scripts",
            "workflows",
            "references",
            "templates",
            "subagent-prompts",
            "typescript-reviewer",
            "references",
            "references",
            "references",
            "references",
            "references",
            "references",
            "fastify-reviewer",
            "react-reviewer",
            "references",
            "references",
            "references",
            "references",
            "references",
            "references",
            "para-auditor",
            "references",
            "references",
            "references",
            "prompt-debugger",
            "references",
            "references",
            "references",
            "references",
            "scripts",
            "fixtures",
            "codex-only-project",
            "nonstandard-manual",
            "dual-scope-project",
            "dev-mode-project",
            "docs",
            "decisions",
            "planning",
            "docs",
            "planning",
            "docs",
            "decisions",
            "planning",
            "docs",
            "planning",
            "references",
            "competitor-spy",
            "scripts",
            "subagent-prompts",
            "zod-reviewer",
            "references",
            "references",
            "references",
            "references",
            "references",
            "references",
            "scripts",
            "references",
            "council-advisor",
            "examples",
            "subagent-prompts",
            "resources"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 171,
            "high": 9,
            "medium": 52,
            "critical": 26,
            "informational": 381
          },
          "artifact_type_policy": "claude_skill"
        },
        "display_score": 0.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 0.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": "plugins/rad-coolify-orchestrator/.mcp.json",
            "line_number": 4,
            "rule_identifier": "AAK-MCP-005",
            "title": "MCP server uses npx/uvx to fetch and execute remote packages",
            "description": "The command uses npx, uvx, bunx, or pnpx which fetches the latest version from a registry at runtime, vulnerable to typosquatting and dependency confusion.",
            "remediation": "Pin exact package versions or use locally installed packages."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "low",
            "category": "mcp-config",
            "file_path": "plugins/rad-coolify-orchestrator/.mcp.json",
            "line_number": 5,
            "rule_identifier": "AAK-MCP-007",
            "title": "MCP server lacks version pinning in args",
            "description": "Package name in args lacks @version suffix when using npx/uvx. Unpinned packages can silently update to malicious versions.",
            "remediation": "Pin with @x.y.z suffix, e.g., @modelcontextprotocol/server-filesystem@2025.1.1"
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "secret-exposure",
            "file_path": "plugins/rad-coolify-orchestrator/scripts/audit-cicd.py",
            "line_number": 65,
            "rule_identifier": "AAK-SECRET-004",
            "title": "Generic high-entropy secret",
            "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
            "remediation": "Move to environment variables or secrets manager."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "secret-exposure",
            "file_path": "plugins/rad-coolify-orchestrator/scripts/audit-cicd.py",
            "line_number": 66,
            "rule_identifier": "AAK-SECRET-004",
            "title": "Generic high-entropy secret",
            "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
            "remediation": "Move to environment variables or secrets manager."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "secret-exposure",
            "file_path": "plugins/rad-coolify-orchestrator/scripts/audit-cicd.py",
            "line_number": 92,
            "rule_identifier": "AAK-SECRET-004",
            "title": "Generic high-entropy secret",
            "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
            "remediation": "Move to environment variables or secrets manager."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "secret-exposure",
            "file_path": "plugins/rad-repo-manager/scripts/align-index.py",
            "line_number": 127,
            "rule_identifier": "AAK-SECRET-004",
            "title": "Generic high-entropy secret",
            "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
            "remediation": "Move to environment variables or secrets manager."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "secret-exposure",
            "file_path": "archive/plugins/rad-explain/scripts/check-grounding.py",
            "line_number": 140,
            "rule_identifier": "AAK-SECRET-004",
            "title": "Generic high-entropy secret",
            "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
            "remediation": "Move to environment variables or secrets manager."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 8,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 9,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 10,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 11,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 11,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 11,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 12,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 16,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 17,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 17,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 17,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 18,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 18,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 18,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "AGENTS.md",
            "line_number": 16,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 8,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 9,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 10,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 11,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 11,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 11,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 12,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 16,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 17,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 17,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 17,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 18,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 18,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 18,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "agent-config",
            "file_path": "CLAUDE.md",
            "line_number": 16,
            "rule_identifier": "AAK-AGENT-001",
            "title": "Agent instruction file contains shell command directives",
            "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.",
            "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": ".claude-plugin/marketplace.json",
            "line_number": 14,
            "rule_identifier": "AAK-MARKETPLACE-001",
            "title": "Unsigned marketplace.json manifest",
            "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.",
            "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": ".claude-plugin/marketplace.json",
            "line_number": 22,
            "rule_identifier": "AAK-MARKETPLACE-001",
            "title": "Unsigned marketplace.json manifest",
            "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.",
            "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": ".claude-plugin/marketplace.json",
            "line_number": 30,
            "rule_identifier": "AAK-MARKETPLACE-001",
            "title": "Unsigned marketplace.json manifest",
            "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.",
            "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": ".claude-plugin/marketplace.json",
            "line_number": 38,
            "rule_identifier": "AAK-MARKETPLACE-001",
            "title": "Unsigned marketplace.json manifest",
            "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.",
            "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": ".claude-plugin/marketplace.json",
            "line_number": 46,
            "rule_identifier": "AAK-MARKETPLACE-001",
            "title": "Unsigned marketplace.json manifest",
            "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.",
            "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": ".claude-plugin/marketplace.json",
            "line_number": 54,
            "rule_identifier": "AAK-MARKETPLACE-001",
            "title": "Unsigned marketplace.json manifest",
            "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.",
            "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "tool-poisoning",
            "file_path": "archive/plugins/rad-nextjs/skills/nextjs-troubleshooting/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-SKILL-003",
            "title": "SKILL.md embeds data-exfiltration primitives",
            "description": "A SKILL.md references outbound HTTP tools (fetch/curl/request) combined with instructions to send local data (files, environment, credentials).",
            "remediation": "Remove the exfil instruction. Skills that genuinely need outbound HTTP should declare it explicitly with a documented purpose."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "tool-poisoning",
            "file_path": "archive/plugins/rad-nextjs/skills/nextjs-security/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-SKILL-003",
            "title": "SKILL.md embeds data-exfiltration primitives",
            "description": "A SKILL.md references outbound HTTP tools (fetch/curl/request) combined with instructions to send local data (files, environment, credentials).",
            "remediation": "Remove the exfil instruction. Skills that genuinely need outbound HTTP should declare it explicitly with a documented purpose."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "tool-poisoning",
            "file_path": "archive/plugins/rad-typescript/skills/typescript-api-safety/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-SKILL-003",
            "title": "SKILL.md embeds data-exfiltration primitives",
            "description": "A SKILL.md references outbound HTTP tools (fetch/curl/request) combined with instructions to send local data (files, environment, credentials).",
            "remediation": "Remove the exfil instruction. Skills that genuinely need outbound HTTP should declare it explicitly with a documented purpose."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "tool-poisoning",
            "file_path": "archive/plugins/rad-fastify/skills/fastify-logging/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-SKILL-003",
            "title": "SKILL.md embeds data-exfiltration primitives",
            "description": "A SKILL.md references outbound HTTP tools (fetch/curl/request) combined with instructions to send local data (files, environment, credentials).",
            "remediation": "Remove the exfil instruction. Skills that genuinely need outbound HTTP should declare it explicitly with a documented purpose."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "tool-poisoning",
            "file_path": "archive/plugins/rad-react/skills/react-performance/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-SKILL-003",
            "title": "SKILL.md embeds data-exfiltration primitives",
            "description": "A SKILL.md references outbound HTTP tools (fetch/curl/request) combined with instructions to send local data (files, environment, credentials).",
            "remediation": "Remove the exfil instruction. Skills that genuinely need outbound HTTP should declare it explicitly with a documented purpose."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "tool-poisoning",
            "file_path": "archive/plugins/rad-google-workspace/skills/gws-modelarmor-create-template/SKILL.md",
            "line_number": 4,
            "rule_identifier": "AAK-SKILL-005",
            "title": "SKILL.md frontmatter contains prompt-injection triggers",
            "description": "A SKILL.md frontmatter or YAML header embeds phrases targeted at the loading model ('ignore previous', 'you are now', 'system:'). These are prompt-injection probes rather than legitimate skill metadata.",
            "remediation": "Remove the injection trigger. Skill frontmatter should only contain name, description, tags, and similar metadata."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": "packages/coolify-mcp/index.js",
            "line_number": 2,
            "rule_identifier": "AAK-MCP-018",
            "title": "Missing rate limiting on MCP endpoint",
            "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.",
            "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": "plugins/rad-planner/scripts/plan-lint.py",
            "line_number": null,
            "rule_identifier": "AAK-TASKS-003",
            "title": "MCP task has no TTL or cancellation path",
            "description": "A task record has no expiration and no cancellation endpoint. Orphaned tasks accumulate forever, including their inputs.",
            "remediation": "Set a TTL on every task; expose a cancellation endpoint that zeroizes inputs and credentials."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "secret-exposure",
            "file_path": "archive/plugins/rad-zod/skills/zod-schema-design/references/edge-cases.md",
            "line_number": 95,
            "rule_identifier": "AAK-INDIA-PII-001",
            "title": "Aadhaar number in source / config",
            "description": "A 12-digit Aadhaar number passed the Verhoeff checksum and is embedded in project text. Aadhaar is restricted under the UIDAI Act and India DPDP \u00a78(4). Storing in code is a reportable breach.",
            "remediation": "Remove the Aadhaar number. If Aadhaar is genuinely needed, route it through an encrypted vault (e.g. AWS KMS / Azure Key Vault) and never log or commit it."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "critical",
            "category": "secret-exposure",
            "file_path": "archive/plugins/rad-zod/skills/zod-schema-design/references/edge-cases.md",
            "line_number": 95,
            "rule_identifier": "AAK-INDIA-PII-001",
            "title": "Aadhaar number in source / config",
            "description": "A 12-digit Aadhaar number passed the Verhoeff checksum and is embedded in project text. Aadhaar is restricted under the UIDAI Act and India DPDP \u00a78(4). Storing in code is a reportable breach.",
            "remediation": "Remove the Aadhaar number. If Aadhaar is genuinely needed, route it through an encrypted vault (e.g. AWS KMS / Azure Key Vault) and never log or commit it."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "plugins/rad-coolify-orchestrator/coverage-report.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "plugins/rad-coolify-orchestrator/README.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "plugins/rad-brainstormer/references/facilitation-principles.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "plugins/rad-brainstormer/references/methodology-catalog.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "legal-compliance",
            "file_path": "plugins/rad-brainstormer/references/methodology-catalog.md",
            "line_number": 516,
            "rule_identifier": "AAK-HEALTHCARE-AI-005",
            "title": "Crisis keywords handled without escalation path",
            "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
            "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "plugins/rad-brainstormer/skills/five-whys/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "plugins/rad-codex/skills/delegate/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "plugins/rad-codex/skills/delegate/references/prompt-blocks.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "legal-compliance",
            "file_path": "plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
            "line_number": 277,
            "rule_identifier": "AAK-HEALTHCARE-AI-005",
            "title": "Crisis keywords handled without escalation path",
            "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
            "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "plugins/rad-coolify-orchestrator/skills/coolify-databases/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "legal-compliance",
            "file_path": "plugins/rad-coolify-orchestrator/skills/coolify-databases/SKILL.md",
            "line_number": 251,
            "rule_identifier": "AAK-HEALTHCARE-AI-005",
            "title": "Crisis keywords handled without escalation path",
            "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
            "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "plugins/rad-coolify-orchestrator/skills/coolify-status/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/traefik-debugging.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "plugins/rad-repo-manager/references/shelf-spec.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "skills/rad-brainstormer/README.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "skills/rad-brainstormer/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "skills/rad-writer/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "skills/rad-brainstormer/resources/facilitation-principles.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "skills/rad-brainstormer/resources/methodology-catalog.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "legal-compliance",
            "file_path": "skills/rad-brainstormer/resources/methodology-catalog.md",
            "line_number": 551,
            "rule_identifier": "AAK-HEALTHCARE-AI-005",
            "title": "Crisis keywords handled without escalation path",
            "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
            "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "legal-compliance",
            "file_path": "skills/rad-writer/resources/sentence-craft.md",
            "line_number": 135,
            "rule_identifier": "AAK-HEALTHCARE-AI-005",
            "title": "Crisis keywords handled without escalation path",
            "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
            "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "skills/rad-writer/resources/domain-prose.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "skills/rad-writer/resources/voice-profile-schema.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "skills/rad-writer/resources/ai-writing-patterns.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "skills/rad-writer/resources/domain-business-report.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "skills/rad-writer/resources/domain-presentation.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-para-second-brain/README.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-context-prompter/README.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-chrome-extension/skills/chrome-ext-troubleshooting/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-chrome-extension/skills/chrome-ext-service-worker/references/lifecycle-patterns.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-astro/skills/astro-troubleshooting/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-nextjs/.claude-plugin/plugin.json",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-nextjs/skills/nextjs-troubleshooting/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-nextjs/skills/nextjs-best-practices/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-nextjs/skills/nextjs-troubleshooting/references/common-errors.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-fastify/skills/fastify-troubleshooting/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-para-second-brain/skills/para-organize/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-context-prompter/agents/prompt-debugger.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-context-prompter/skills/prompt-decompiler/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-context-prompter/skills/prompt-engineering/references/techniques.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-seo-optimizer/references/google-ranking-systems.md",
            "line_number": 72,
            "rule_identifier": "AAK-HEALTHCARE-AI-005",
            "title": "Crisis keywords handled without escalation path",
            "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
            "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-seo-optimizer/references/eeat-checklist.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-seo-optimizer/skills/broken-link-fixer/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-seo-optimizer/skills/technical-seo/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-seo-optimizer/skills/fix-seo/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-seo-optimizer/skills/on-page-optimizer/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-seo-optimizer/skills/link-building-strategy/SKILL.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/plugins/rad-zod/skills/zod-integrations/references/monorepo-guide.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "legal-compliance",
            "file_path": "archive/skills/rad-seo-aeo-reviewer/resources/google-ranking-systems.md",
            "line_number": 71,
            "rule_identifier": "AAK-HEALTHCARE-AI-005",
            "title": "Crisis keywords handled without escalation path",
            "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.",
            "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "archive/skills/rad-seo-aeo-reviewer/resources/eeat-checklist.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          }
        ],
        "execution_duration_seconds": 12.286152978020255,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 601
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211,
          "severity_counts": {
            "low": 1,
            "high": 19,
            "medium": 47,
            "critical": 37,
            "informational": 0
          }
        },
        "display_score": 0.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "bearer",
        "scanner_version": "2.0.2",
        "score": 0.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "bearer",
            "severity": "critical",
            "category": null,
            "file_path": "/repo/plugins/rad-repo-manager/hooks/session-start.py",
            "line_number": 33,
            "rule_identifier": null,
            "title": "Unsanitized user input in OS command",
            "description": "## Description\n\nDirectly incorporating external or user-defined input into an OS command exposes the system to possible command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially leading to a compromise of system integrity.\n\n## Remediations\n\n- **Do not** use OS commands that include dynamic input directly. Instead, explore safer alternatives such as libraries or built-in functions that achieve the same goal without executi",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "critical",
            "category": null,
            "file_path": "/repo/plugins/rad-repo-manager/hooks/stop-nudge.py",
            "line_number": 39,
            "rule_identifier": null,
            "title": "Unsanitized user input in OS command",
            "description": "## Description\n\nDirectly incorporating external or user-defined input into an OS command exposes the system to possible command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially leading to a compromise of system integrity.\n\n## Remediations\n\n- **Do not** use OS commands that include dynamic input directly. Instead, explore safer alternatives such as libraries or built-in functions that achieve the same goal without executi",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "critical",
            "category": null,
            "file_path": "/repo/plugins/rad-repo-manager/scripts/doc-freshness.py",
            "line_number": 83,
            "rule_identifier": null,
            "title": "Unsanitized user input in OS command",
            "description": "## Description\n\nDirectly incorporating external or user-defined input into an OS command exposes the system to possible command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially leading to a compromise of system integrity.\n\n## Remediations\n\n- **Do not** use OS commands that include dynamic input directly. Instead, explore safer alternatives such as libraries or built-in functions that achieve the same goal without executi",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "critical",
            "category": null,
            "file_path": "/repo/plugins/rad-repo-manager/scripts/pre_ship.py",
            "line_number": 126,
            "rule_identifier": null,
            "title": "Unsanitized user input in OS command",
            "description": "## Description\n\nDirectly incorporating external or user-defined input into an OS command exposes the system to possible command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially leading to a compromise of system integrity.\n\n## Remediations\n\n- **Do not** use OS commands that include dynamic input directly. Instead, explore safer alternatives such as libraries or built-in functions that achieve the same goal without executi",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "critical",
            "category": null,
            "file_path": "/repo/plugins/rad-repo-manager/scripts/repo-scan.py",
            "line_number": 223,
            "rule_identifier": null,
            "title": "Unsanitized user input in OS command",
            "description": "## Description\n\nDirectly incorporating external or user-defined input into an OS command exposes the system to possible command injection attacks. This vulnerability allows attackers to execute unauthorized commands on the operating system, potentially leading to a compromise of system integrity.\n\n## Remediations\n\n- **Do not** use OS commands that include dynamic input directly. Instead, explore safer alternatives such as libraries or built-in functions that achieve the same goal without executi",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/archive/plugins/rad-code-review/scripts/check-hallucinated-imports.py",
            "line_number": 238,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/archive/plugins/rad-code-review/scripts/check-hallucinated-imports.py",
            "line_number": 416,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/archive/plugins/rad-code-review/scripts/findings-index.py",
            "line_number": 119,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
            "line_number": 432,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/audit-ai-access.py",
            "line_number": 452,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 204,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/archive/plugins/rad-seo-optimizer/scripts/check-broken-links.py",
            "line_number": 213,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/plugins/rad-planner/scripts/plan-lint.py",
            "line_number": 382,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/plugins/rad-planner/scripts/validate-json.py",
            "line_number": 187,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/plugins/rad-planner/scripts/validate-json.py",
            "line_number": 192,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "high",
            "category": null,
            "file_path": "/repo/plugins/rad-repo-manager/scripts/align-index.py",
            "line_number": 182,
            "rule_identifier": null,
            "title": "Unsanitized dynamic input in file path",
            "description": "## Description\n\nUsing unsanitized dynamic input to determine file paths can allow attackers to gain access to files and folders outside of the intended scope. This vulnerability occurs when input provided by users is directly used to access the filesystem without proper validation or sanitization.\n\n## Remediations\n\n- **Do not** directly use external input to construct file paths. This can lead to unauthorized file access.\n- **Do** use a safelist to define accessible paths or directories. Only al",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "medium",
            "category": null,
            "file_path": "/repo/archive/plugins/rad-session/scripts/audit-plugin-bloat.py",
            "line_number": 471,
            "rule_identifier": null,
            "title": "Unsanitized user input in regular expression",
            "description": "## Description\n\nCreating regular expressions from user input can lead to a vulnerability known as Regular Expression Denial of Service (ReDoS). This issue arises because some regular expressions can be processed with exponential time complexity. When attackers exploit this, it can significantly drain CPU resources, effectively causing a denial of service.\n\n## Remediations\n\n- **Do not** construct regular expressions directly from user inputs. This can make your application susceptible to ReDoS at",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "medium",
            "category": null,
            "file_path": "/repo/archive/plugins/rad-code-review/scripts/findings-index.py",
            "line_number": 88,
            "rule_identifier": null,
            "title": "Usage of weak hashing library (SHA-1)",
            "description": "## Description\n\nUsing a weak hashing library like SHA-1 increases the risk of data breaches. SHA-1 in particular is vulnerable to collision attacks, where two different inputs can produce the same hash value, compromising data integrity and security.\n\n## Remediations\n\n- **Do not** use SHA-1 for hashing. It is no longer considered secure due to its vulnerability to collision attacks.\n  ```python\n  hashlib.sha1('password').digest() # unsafe\n  ```\n- **Do** opt for stronger hashing algorithms such a",
            "remediation": null
          },
          {
            "tool_name": "bearer",
            "severity": "medium",
            "category": null,
            "file_path": "/repo/plugins/rad-repo-manager/scripts/align-index.py",
            "line_number": 129,
            "rule_identifier": null,
            "title": "Usage of weak hashing library (SHA-1)",
            "description": "## Description\n\nUsing a weak hashing library like SHA-1 increases the risk of data breaches. SHA-1 in particular is vulnerable to collision attacks, where two different inputs can produce the same hash value, compromising data integrity and security.\n\n## Remediations\n\n- **Do not** use SHA-1 for hashing. It is no longer considered secure due to its vulnerability to collision attacks.\n  ```python\n  hashlib.sha1('password').digest() # unsafe\n  ```\n- **Do** opt for stronger hashing algorithms such a",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 90.89539955498185,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 55
        },
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/Bearer/bearer",
          "report_type": "security",
          "rules_loaded": 554,
          "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"",
          "severity_counts": {
            "low": 0,
            "high": 11,
            "medium": 3,
            "critical": 5,
            "informational": 0
          }
        },
        "display_score": 0.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 59.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "nerlo-behavioral",
            "severity": "high",
            "category": "data-exfiltration",
            "file_path": "/repo/packages/coolify-mcp/index.js",
            "line_number": 41,
            "rule_identifier": "opt.nerlo-rules.nerlo-js-secret-to-network-egress",
            "title": "opt.nerlo-rules.nerlo-js-secret-to-network-egress",
            "description": "A secret / environment variable / token value flows into a network request (fetch / axios / XMLHttpRequest). This is the postmark-mcp supply-chain exfiltration shape reproduced in Node/JS: a credential read from the environment is shipped off-box. Confirm the egress is expected and the value is not being exfiltrated to an attacker-controlled host.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-behavioral",
            "severity": "high",
            "category": "dynamic-execution",
            "file_path": "/repo/plugins/rad-repo-manager/scripts/pre_ship.py",
            "line_number": 126,
            "rule_identifier": "opt.nerlo-rules.nerlo-py-dynamic-exec",
            "title": "opt.nerlo-rules.nerlo-py-dynamic-exec",
            "description": "Dynamic code/command execution (eval/exec/os.system/subprocess shell=True with a non-literal argument) \u2014 a backdoor primitive.",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 6.937513993005268,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 42
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/exfiltration.yaml",
            "/opt/nerlo-rules/clipboard_exfiltration.yaml",
            "/opt/nerlo-rules/rce_endpoint.yaml",
            "/opt/nerlo-rules/taint_egress.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "severity_counts": {
            "low": 0,
            "high": 2,
            "medium": 0,
            "critical": 0,
            "informational": 0
          },
          "merged_invocation": true
        },
        "display_score": 59.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 0.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "informational",
            "category": "install-instruction-run",
            "file_path": "/repo/plugins/rad-1password/skills/op-secrets-injection/SKILL.md",
            "line_number": 236,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
            "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
            "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "informational",
            "category": "install-instruction-run",
            "file_path": "/repo/plugins/rad-1password/skills/op-service-accounts/SKILL.md",
            "line_number": 118,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
            "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
            "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "informational",
            "category": "install-instruction-run",
            "file_path": "/repo/plugins/rad-1password/skills/op-shell-plugins/SKILL.md",
            "line_number": 106,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
            "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
            "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
            "line_number": 226,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/SKILL.md",
            "line_number": 256,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-infrastructure/references/multi-server-setup.md",
            "line_number": 12,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/SKILL.md",
            "line_number": 269,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "informational",
            "category": "install-instruction-run",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/common-errors.md",
            "line_number": 64,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
            "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
            "description": "Run-directive inventory: documentation names a run/execute/launch verb next to an opaque-extension artifact (\"run resource.txt\", \"double-click setup.exe\") \u2014 the FakeGit README shape. On its own it is CONTEXT, not a verdict: the same shape covers a repo's own tracked scripts and its toolchain, which this pattern cannot tell from a bundled payload. Recorded at INFO so a reviewer sees every run directive in one place.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/common-errors.md",
            "line_number": 64,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/common-errors.md",
            "line_number": 96,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "high",
            "category": "install-instruction-exec",
            "file_path": "/repo/plugins/rad-coolify-orchestrator/skills/coolify-troubleshoot/references/traefik-debugging.md",
            "line_number": 50,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell",
            "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 6.9726024540141225,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 503
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/install_instructions.yaml",
            "/opt/nerlo-rules/cursor_rules.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "severity_counts": {
            "low": 0,
            "high": 7,
            "medium": 0,
            "critical": 0,
            "informational": 4
          },
          "merged_invocation": true
        },
        "display_score": 0.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "capslock",
        "scanner_version": "v0.3.2",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.14271300099790096,
        "status": "not_applicable",
        "examined": {
          "unit": "packages",
          "count": 0
        },
        "metadata": {
          "source": "go-module-proxy",
          "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2",
          "report_type": "go-capability",
          "vendor_mode": false,
          "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2  # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=",
          "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute",
          "go_files_present": 0,
          "artifact_type_policy": "claude_skill",
          "expected_capabilities": null,
          "artifact_type_explicit": true
        },
        "display_score": null,
        "display_badge": "not_applicable"
      }
    ]
  },
  "report": {
    "report_id": "a29707fd-889b-48d2-a3a9-794bf2e1e2bb",
    "format": "json",
    "generated_at": "2026-08-12T21:49:06.312541+00:00",
    "scanner_filter": null,
    "signature": null
  }
}