{ "executive_summary": { "badge": "Unsafe", "security_score": null, "view": "composite", "aggregate_verdict_withheld": false, "aggregate_verdict_withheld_reason": null, "scanner_badges": { "agentshield": "not_applicable", "cisco-skill-scanner": "Unsafe", "agent-audit-kit": "Unsafe", "bearer": "not_applicable", "nerlo-behavioral": "not_applicable", "nerlo-install-instruction": "Verified", "capslock": "not_applicable" }, "finding_counts": { "critical": 41, "high": 27, "medium": 63, "low": 42, "informational": 58 }, "recommendation": "abductive-analyst is NOT recommended for integration: the scan surfaced 41 critical and 27 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering." }, "source_provenance": { "repository_url": "https://github.com/nealcaren/social-data-analysis", "commit_sha_scanned": null, "license": null, "maintainer": null, "name": "abductive-analyst", "version": null }, "per_scanner_detail": [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.3080438749748282, "status": "not_applicable", "examined": { "unit": "scan_targets", "count": 0 }, "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [] }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/genre-skill-builder/skills/genre-skill-builder/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/peer-reviewer/skills/peer-reviewer/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-synthesis/skills/lit-synthesis/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/dag-development/skills/dag-development/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/bibliography-builder/skills/bibliography-builder/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/bibliography-builder/skills/bibliography-builder/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/abductive-analyst/skills/abductive-analyst/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-search/skills/lit-search/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/r-analyst/skills/r-analyst/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/stata-analyst/skills/stata-analyst/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/case-justification/skills/case-justification/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/revision-coordinator/skills/revision-coordinator/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/r-techniques/04_supervised.md", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File '04_supervised.md' extension (.md) suggests one format but Magika detected a different text format: R (language) (r). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-writeup/skills/interview-writeup/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-analyst/skills/interview-analyst/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/.", "line_number": null, "rule_identifier": "EXCESSIVE_FILE_COUNT", "title": "Skill package contains many files", "description": "Skill package contains 246 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.", "remediation": "Review file inventory and remove unnecessary files." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/r-techniques/04_supervised.md", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File '04_supervised.md' extension (.md) suggests one format but Magika detected a different text format: R (language) (r). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/genre-skill-builder/skills/genre-skill-builder/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/genre-skill-builder/skills/genre-skill-builder/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/genre-skill-builder/skills/genre-skill-builder/templates/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/genre-skill-builder/skills/genre-skill-builder/templates/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/clusters/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/clusters/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/peer-reviewer/skills/peer-reviewer/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/peer-reviewer/skills/peer-reviewer/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-synthesis/skills/lit-synthesis/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-synthesis/skills/lit-synthesis/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-synthesis/skills/lit-synthesis/mcp/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-synthesis/skills/lit-synthesis/mcp/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/dag-development/skills/dag-development/concepts/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/dag-development/skills/dag-development/concepts/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/dag-development/skills/dag-development/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/dag-development/skills/dag-development/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/bibliography-builder/skills/bibliography-builder/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/bibliography-builder/skills/bibliography-builder/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/abductive-analyst/skills/abductive-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/abductive-analyst/skills/abductive-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-search/skills/lit-search/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-search/skills/lit-search/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-search/skills/lit-search/api/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-search/skills/lit-search/api/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/r-analyst/skills/r-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/r-analyst/skills/r-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/r-analyst/skills/r-analyst/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/r-analyst/skills/r-analyst/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/stata-analyst/skills/stata-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/stata-analyst/skills/stata-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/stata-analyst/skills/stata-analyst/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/stata-analyst/skills/stata-analyst/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/case-justification/skills/case-justification/clusters/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/case-justification/skills/case-justification/clusters/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/case-justification/skills/case-justification/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/case-justification/skills/case-justification/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/case-justification/skills/case-justification/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/case-justification/skills/case-justification/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/revision-coordinator/skills/revision-coordinator/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/revision-coordinator/skills/revision-coordinator/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/pathways/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/pathways/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/concepts/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/concepts/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/r-techniques/04_supervised.md", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File '04_supervised.md' extension (.md) suggests one format but Magika detected a different text format: R (language) (r). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/r-techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/r-techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/python-techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/python-techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/pedagogy/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/pedagogy/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/mcp/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/mcp/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/quarto/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/quarto/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/interview-writeup/skills/interview-writeup/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-writeup/skills/interview-writeup/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/interview-writeup/skills/interview-writeup/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-writeup/skills/interview-writeup/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/clusters/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/clusters/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/interview-analyst/skills/interview-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-analyst/skills/interview-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 18.020958259003237, "status": "complete", "examined": { "unit": "skills", "count": 58 }, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "genre-skill-builder", "lit-writeup", "peer-reviewer", "lit-synthesis", "dag-development", "bibliography-builder", "abductive-analyst", "lit-search", "r-analyst", "stata-analyst", "case-justification", "revision-coordinator", "methods-writer", "text-analyst", "lecture-designer", "interview-writeup", "interview-bookends", "interview-analyst", "repo", "phases", "templates", "clusters", "phases", "techniques", "phases", "phases", "mcp", "concepts", "phases", "phases", "phases", "phases", "api", "phases", "techniques", "phases", "techniques", "clusters", "phases", "techniques", "phases", "phases", "techniques", "pathways", "concepts", "phases", "r-techniques", "python-techniques", "phases", "pedagogy", "mcp", "quarto", "phases", "techniques", "clusters", "phases", "techniques", "phases" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 42, "high": 0, "medium": 3, "critical": 0, "informational": 58 }, "artifact_type_policy": "claude_skill" }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 127, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 12, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 30, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 48, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 66, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 84, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 102, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 120, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 138, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 156, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 174, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 192, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 210, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 228, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 246, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 264, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 282, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 301, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 321, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/genre-skill-builder/skills/genre-skill-builder/phases/phase2-coding.md", "line_number": 37, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-writeup/skills/lit-writeup/phases/phase5-revision.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-writeup/skills/lit-writeup/phases/phase4-turn.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-writeup/skills/lit-writeup/phases/phase3-drafting.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-writeup/skills/lit-writeup/techniques/turn-formula.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-writeup/skills/lit-writeup/techniques/sentence-toolbox.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/dag-development/skills/dag-development/concepts/potential_outcomes.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/dag-development/skills/dag-development/concepts/selection_bias.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/dag-development/skills/dag-development/phases/phase1-identification.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/dag-development/skills/dag-development/phases/phase0-theory.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/abductive-analyst/skills/abductive-analyst/phases/phase5-integration.md", "line_number": 110, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-search/skills/lit-search/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-search/skills/lit-search/phases/phase2-screening.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/phases/phase0-design.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/phases/phase1-data.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/phases/phase3-analysis.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/phases/phase4-robustness.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/phases/phase2-specification.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/phases/phase5-output.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/05_bayesian_sensitivity.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/03_text_ml.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/07_best_practices.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/04_synthetic_control.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/02_survey_resampling.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/01_core_econometrics.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/06_visualization.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/phases/phase0-design.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/phases/phase1-data.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/phases/phase3-analysis.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/phases/phase4-robustness.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/phases/phase2-specification.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/phases/phase5-output.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/99_default_journal_pipeline.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/05_best_practices.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/00_index.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/07_postestimation_reporting.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/00_data_prep.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/stata-statistical-techniques_combined.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/03_synthetic_control.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/04_visualization.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/01_core_econometrics.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/06_modeling_basics.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/clusters/comparative.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/clusters/policy.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/clusters/policy.md", "line_number": 89, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/clusters/historical.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/clusters/standard.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/clusters/minimal.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/phases/phase1-drafting.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/phases/phase0-assessment.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/techniques/opening-moves.md", "line_number": 154, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/revision-coordinator/skills/revision-coordinator/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/revision-coordinator/skills/revision-coordinator/phases/phase1-diagnostic.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/text-analyst/skills/text-analyst/concepts/04_embeddings.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/text-analyst/skills/text-analyst/concepts/06_validation_strategies.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/text-analyst/skills/text-analyst/concepts/05_sentiment_analysis.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/text-analyst/skills/text-analyst/concepts/01_dictionary_methods.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/text-analyst/skills/text-analyst/phases/phase4-validation.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/text-analyst/skills/text-analyst/r-techniques/06_visualization.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/lecture-designer/skills/lecture-designer/phases/phase1-narrative.md", "line_number": 123, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/lecture-designer/skills/lecture-designer/pedagogy/overview.md", "line_number": 3, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/interview-writeup/skills/interview-writeup/phases/phase3-revision.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/interview-bookends/skills/interview-bookends/clusters/theory-extension.md", "line_number": 34, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/interview-bookends/skills/interview-bookends/phases/phase1-introduction.md", "line_number": 59, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/interview-bookends/skills/interview-bookends/techniques/opening-moves.md", "line_number": 154, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/interview-analyst/skills/interview-analyst/phases/phase4-quality.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." } ], "execution_duration_seconds": 2.9062988850055262, "status": "complete", "examined": { "unit": "files", "count": 245 }, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 0, "high": 27, "medium": 60, "critical": 41, "informational": 0 } }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.30166817002464086, "status": "not_applicable", "examined": { "unit": "files", "count": 0 }, "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"", "environment_note": "bearer found no supported-language source files to analyze (see _SUPPORTED_SOURCE_EXTENSIONS); reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute" }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 4.314620170043781, "status": "not_applicable", "examined": { "unit": "files", "count": 0 }, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "ruleset_paths": [ "/opt/nerlo-rules/exfiltration.yaml", "/opt/nerlo-rules/clipboard_exfiltration.yaml", "/opt/nerlo-rules/rce_endpoint.yaml", "/opt/nerlo-rules/taint_egress.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 4.321907274017576, "status": "complete", "examined": { "unit": "files", "count": 210 }, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "ruleset_paths": [ "/opt/nerlo-rules/install_instructions.yaml", "/opt/nerlo-rules/cursor_rules.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "capslock", "scanner_version": "v0.3.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.28068203799193725, "status": "not_applicable", "examined": { "unit": "packages", "count": 0 }, "metadata": { "source": "go-module-proxy", "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2", "report_type": "go-capability", "vendor_mode": false, "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2 # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=", "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute", "go_files_present": 0, "artifact_type_policy": "claude_skill", "expected_capabilities": null, "artifact_type_explicit": true }, "display_score": null, "display_badge": "not_applicable" } ], "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.", "audit_chain": { "scan_job_id": "8429512c-40cd-47c8-965b-1e71fe6a0d8a", "scan_completed_at": "2026-08-12T12:30:53.590067+00:00", "scanner_versions": { "agentshield": "1.4.0", "cisco-skill-scanner": "2.0.11", "agent-audit-kit": "0.3.26", "bearer": "2.0.2", "nerlo-behavioral": "0.1.0", "nerlo-install-instruction": "0.1.0", "capslock": "v0.3.2" }, "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:d5aaefa8b517d1f03832091ab094e20dc73160a07ae1102af1b2e395ce6ce852", "ai_decision_log_ids": [ "6f7011de-8d55-4a75-8ee6-076da03a6e01" ], "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation" }, "appendix": { "raw_scanner_reports": [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.3080438749748282, "status": "not_applicable", "examined": { "unit": "scan_targets", "count": 0 }, "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [] }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/genre-skill-builder/skills/genre-skill-builder/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/peer-reviewer/skills/peer-reviewer/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-synthesis/skills/lit-synthesis/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/dag-development/skills/dag-development/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/bibliography-builder/skills/bibliography-builder/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/bibliography-builder/skills/bibliography-builder/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/abductive-analyst/skills/abductive-analyst/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-search/skills/lit-search/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/r-analyst/skills/r-analyst/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/stata-analyst/skills/stata-analyst/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/case-justification/skills/case-justification/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/revision-coordinator/skills/revision-coordinator/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/r-techniques/04_supervised.md", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File '04_supervised.md' extension (.md) suggests one format but Magika detected a different text format: R (language) (r). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-writeup/skills/interview-writeup/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-analyst/skills/interview-analyst/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/.", "line_number": null, "rule_identifier": "EXCESSIVE_FILE_COUNT", "title": "Skill package contains many files", "description": "Skill package contains 246 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.", "remediation": "Review file inventory and remove unnecessary files." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/r-techniques/04_supervised.md", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File '04_supervised.md' extension (.md) suggests one format but Magika detected a different text format: R (language) (r). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/genre-skill-builder/skills/genre-skill-builder/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/genre-skill-builder/skills/genre-skill-builder/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/genre-skill-builder/skills/genre-skill-builder/templates/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/genre-skill-builder/skills/genre-skill-builder/templates/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/clusters/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/clusters/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-writeup/skills/lit-writeup/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/peer-reviewer/skills/peer-reviewer/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/peer-reviewer/skills/peer-reviewer/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-synthesis/skills/lit-synthesis/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-synthesis/skills/lit-synthesis/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-synthesis/skills/lit-synthesis/mcp/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-synthesis/skills/lit-synthesis/mcp/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/dag-development/skills/dag-development/concepts/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/dag-development/skills/dag-development/concepts/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/dag-development/skills/dag-development/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/dag-development/skills/dag-development/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/bibliography-builder/skills/bibliography-builder/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/bibliography-builder/skills/bibliography-builder/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/abductive-analyst/skills/abductive-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/abductive-analyst/skills/abductive-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-search/skills/lit-search/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-search/skills/lit-search/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lit-search/skills/lit-search/api/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lit-search/skills/lit-search/api/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/r-analyst/skills/r-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/r-analyst/skills/r-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/r-analyst/skills/r-analyst/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/r-analyst/skills/r-analyst/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/stata-analyst/skills/stata-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/stata-analyst/skills/stata-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/stata-analyst/skills/stata-analyst/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/stata-analyst/skills/stata-analyst/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/case-justification/skills/case-justification/clusters/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/case-justification/skills/case-justification/clusters/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/case-justification/skills/case-justification/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/case-justification/skills/case-justification/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/case-justification/skills/case-justification/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/case-justification/skills/case-justification/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/revision-coordinator/skills/revision-coordinator/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/revision-coordinator/skills/revision-coordinator/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/pathways/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/methods-writer/skills/methods-writer/pathways/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/concepts/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/concepts/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/r-techniques/04_supervised.md", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File '04_supervised.md' extension (.md) suggests one format but Magika detected a different text format: R (language) (r). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/r-techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/r-techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/python-techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/text-analyst/skills/text-analyst/python-techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/pedagogy/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/pedagogy/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/mcp/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/mcp/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/quarto/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lecture-designer/skills/lecture-designer/quarto/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/interview-writeup/skills/interview-writeup/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-writeup/skills/interview-writeup/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/interview-writeup/skills/interview-writeup/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-writeup/skills/interview-writeup/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/clusters/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/clusters/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/techniques/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-bookends/skills/interview-bookends/techniques/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/interview-analyst/skills/interview-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/interview-analyst/skills/interview-analyst/phases/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 18.020958259003237, "status": "complete", "examined": { "unit": "skills", "count": 58 }, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "genre-skill-builder", "lit-writeup", "peer-reviewer", "lit-synthesis", "dag-development", "bibliography-builder", "abductive-analyst", "lit-search", "r-analyst", "stata-analyst", "case-justification", "revision-coordinator", "methods-writer", "text-analyst", "lecture-designer", "interview-writeup", "interview-bookends", "interview-analyst", "repo", "phases", "templates", "clusters", "phases", "techniques", "phases", "phases", "mcp", "concepts", "phases", "phases", "phases", "phases", "api", "phases", "techniques", "phases", "techniques", "clusters", "phases", "techniques", "phases", "phases", "techniques", "pathways", "concepts", "phases", "r-techniques", "python-techniques", "phases", "pedagogy", "mcp", "quarto", "phases", "techniques", "clusters", "phases", "techniques", "phases" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 42, "high": 0, "medium": 3, "critical": 0, "informational": 58 }, "artifact_type_policy": "claude_skill" }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": 127, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "critical", "category": "agent-config", "file_path": "CLAUDE.md", "line_number": null, "rule_identifier": "AAK-AGENT-001", "title": "Agent instruction file contains shell command directives", "description": "An agent instruction file (AGENTS.md, .cursorrules, CLAUDE.md) contains shell commands or execution directives that could be injected into agent behavior.", "remediation": "Remove shell commands from agent instruction files. Use proper tool definitions instead." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 12, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 30, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 48, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 66, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 84, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 102, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 120, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 138, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 156, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 174, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 192, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 210, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 228, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 246, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 264, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 282, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 301, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 321, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/genre-skill-builder/skills/genre-skill-builder/phases/phase2-coding.md", "line_number": 37, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-writeup/skills/lit-writeup/phases/phase5-revision.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-writeup/skills/lit-writeup/phases/phase4-turn.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-writeup/skills/lit-writeup/phases/phase3-drafting.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-writeup/skills/lit-writeup/techniques/turn-formula.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-writeup/skills/lit-writeup/techniques/sentence-toolbox.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/dag-development/skills/dag-development/concepts/potential_outcomes.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/dag-development/skills/dag-development/concepts/selection_bias.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/dag-development/skills/dag-development/phases/phase1-identification.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/dag-development/skills/dag-development/phases/phase0-theory.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/abductive-analyst/skills/abductive-analyst/phases/phase5-integration.md", "line_number": 110, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-search/skills/lit-search/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lit-search/skills/lit-search/phases/phase2-screening.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/phases/phase0-design.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/phases/phase1-data.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/phases/phase3-analysis.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/phases/phase4-robustness.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/phases/phase2-specification.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/phases/phase5-output.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/05_bayesian_sensitivity.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/03_text_ml.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/07_best_practices.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/04_synthetic_control.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/02_survey_resampling.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/01_core_econometrics.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/r-analyst/skills/r-analyst/techniques/06_visualization.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/phases/phase0-design.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/phases/phase1-data.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/phases/phase3-analysis.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/phases/phase4-robustness.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/phases/phase2-specification.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/phases/phase5-output.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/99_default_journal_pipeline.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/05_best_practices.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/00_index.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/07_postestimation_reporting.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/00_data_prep.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/stata-statistical-techniques_combined.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/03_synthetic_control.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/04_visualization.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/01_core_econometrics.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/stata-analyst/skills/stata-analyst/techniques/06_modeling_basics.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/clusters/comparative.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/clusters/policy.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/clusters/policy.md", "line_number": 89, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/clusters/historical.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/clusters/standard.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/clusters/minimal.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/phases/phase1-drafting.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/phases/phase0-assessment.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/case-justification/skills/case-justification/techniques/opening-moves.md", "line_number": 154, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/revision-coordinator/skills/revision-coordinator/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/revision-coordinator/skills/revision-coordinator/phases/phase1-diagnostic.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/text-analyst/skills/text-analyst/concepts/04_embeddings.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/text-analyst/skills/text-analyst/concepts/06_validation_strategies.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/text-analyst/skills/text-analyst/concepts/05_sentiment_analysis.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/text-analyst/skills/text-analyst/concepts/01_dictionary_methods.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/text-analyst/skills/text-analyst/phases/phase4-validation.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/text-analyst/skills/text-analyst/r-techniques/06_visualization.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/lecture-designer/skills/lecture-designer/phases/phase1-narrative.md", "line_number": 123, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/lecture-designer/skills/lecture-designer/pedagogy/overview.md", "line_number": 3, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/interview-writeup/skills/interview-writeup/phases/phase3-revision.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/interview-bookends/skills/interview-bookends/clusters/theory-extension.md", "line_number": 34, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/interview-bookends/skills/interview-bookends/phases/phase1-introduction.md", "line_number": 59, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/interview-bookends/skills/interview-bookends/techniques/opening-moves.md", "line_number": 154, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/interview-analyst/skills/interview-analyst/phases/phase4-quality.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." } ], "execution_duration_seconds": 2.9062988850055262, "status": "complete", "examined": { "unit": "files", "count": 245 }, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 0, "high": 27, "medium": 60, "critical": 41, "informational": 0 } }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.30166817002464086, "status": "not_applicable", "examined": { "unit": "files", "count": 0 }, "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"", "environment_note": "bearer found no supported-language source files to analyze (see _SUPPORTED_SOURCE_EXTENSIONS); reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute" }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 4.314620170043781, "status": "not_applicable", "examined": { "unit": "files", "count": 0 }, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "ruleset_paths": [ "/opt/nerlo-rules/exfiltration.yaml", "/opt/nerlo-rules/clipboard_exfiltration.yaml", "/opt/nerlo-rules/rce_endpoint.yaml", "/opt/nerlo-rules/taint_egress.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": null, "display_badge": "not_applicable" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 4.321907274017576, "status": "complete", "examined": { "unit": "files", "count": 210 }, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "ruleset_paths": [ "/opt/nerlo-rules/install_instructions.yaml", "/opt/nerlo-rules/cursor_rules.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "capslock", "scanner_version": "v0.3.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.28068203799193725, "status": "not_applicable", "examined": { "unit": "packages", "count": 0 }, "metadata": { "source": "go-module-proxy", "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2", "report_type": "go-capability", "vendor_mode": false, "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2 # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=", "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute", "go_files_present": 0, "artifact_type_policy": "claude_skill", "expected_capabilities": null, "artifact_type_explicit": true }, "display_score": null, "display_badge": "not_applicable" } ] }, "report": { "report_id": "998f19e1-87c2-4351-9fee-0242853c86a7", "format": "json", "generated_at": "2026-08-12T17:06:59.139208+00:00", "scanner_filter": null, "signature": null } }