# Security Audit Report — action-telemetry - **Report ID:** `0a05403c-57f6-443b-8206-e97ef871f33f` - **Generated:** 2026-07-29T06:01:26.981960+00:00 - **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4) ## 1. Executive Summary **Badge:** Unsafe (composite) **Security score:** 41.0 | Scanner | Badge | | --- | --- | | agent-audit-kit | Unsafe | | agentshield | unavailable | | cisco-skill-scanner | Unsafe | | nerlo-behavioral | Verified | | nerlo-install-instruction | Unsafe | | nerlo-multi-source | unavailable | | osv-scanner | unavailable | | trivy | unavailable | | trivy_image | unavailable | | Severity | Findings | | --- | --- | | critical | 0 | | high | 12 | | medium | 5 | | low | 33 | action-telemetry is NOT recommended for integration: the scan surfaced 0 critical and 12 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering. ## 2. Source Provenance - **Repository:** https://github.com/lg13-21/lg13-skills - **Commit scanned:** `unknown` - **License:** unknown - **Maintainer:** unknown - **Version:** unknown ## 3. Per-Scanner Detail ### agentshield (v1.4.0) — unavailable / n/a No findings. ### cisco-skill-scanner (v2.0.11) — Unsafe / 0.0 - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/uklid-coder/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/doc-polish/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/strat-init/SKILL.md:None) - **[high] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -s http://localhost:8790/pl \| python -c "import json,sys; items=json.load(sys.stdin)['items']; [print(i['pl_id'], i['title']) for i in items if i.get('category')=='coordination' and i.get('action_status') not in ('IGNORED','APPROVED')]"'. This is a remote code execution pattern. (/repo/plugins/lg13-skills/skills/strat-init/SKILL.md.bak_20260502_2330:1) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/rag-search/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/heartbeat/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/heartbeat/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/rain/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/rain/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/i-can-hear-u/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/i-can-hear-u/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/autosave/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/rr/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/token-limit-read/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/team-launcher/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/attachment-score/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/attachment-score/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/deep-read-full/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/deep-read-full/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/save-min/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/lare/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/slack-listen/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/tool-picker/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/tmonkey-web/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/git-tmonkey-search/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/diamond-pick/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/diamond-pick/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/chatgpt-force-read/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/ping-pong/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/lg13-save/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/rt/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/rt/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/budget-watchdog/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/budget-watchdog/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/lg13-init/SKILL.md:None) - **[high] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -s http://localhost:8790/pl \| python -c "import json,sys; items=json.load(sys.stdin)['items']; [print(i['pl_id'], i['title']) for i in items if i.get('category')=='coordination' and i.get('action_status') not in ('IGNORED','APPROVED')]"'. This is a remote code execution pattern. (/repo/plugins/lg13-skills/skills/lg13-init/SKILL.md.bak_20260502_2330:1) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/restart/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/rtg/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/rtg/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/rts/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/rts/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/compact-check/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/super-start/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/chatgpt-search/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/locks-workflow/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/team-speak/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/strat-end/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/sr/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/zero-tokens/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/vlastnak/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/prtsc/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/ocr-git/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/tmonkey/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/legal-daily-brief/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/legal-daily-brief/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/avengers/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/avengers/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/dnd/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/budget-manager/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/edge-check/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/email-read/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/consistency-check/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/consistency-check/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/comm-legal/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/chatgpt-ask/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/listen-to-the-music/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/listen-to-the-music/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/skill-creator/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/skill-creator/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/tmonkey-diag/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/diamond-to-matrix/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/issue-sync/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/web-up/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/web-up/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/skills-manual/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/strat-save/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/tmonkey-bot/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/tmonkey-bot/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/lg13-end/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/diamond-sentry/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/legal-total-analysis/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/legal-total-analysis/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/tom-notify/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/github-actions-if-yaml/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/github-actions-if-yaml/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/load-from-store/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/attachment-pipeline/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/attachment-pipeline/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/isds-ship-with-capsule/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/cti-cele/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/tmonkey-arm/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/skill-picker/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/filing-pipeline/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/save-to-store/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/file-catalog-search/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/terminator/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/terminator/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/action-telemetry/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/isds/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/chatgpt-send/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/work-mode/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/tmonkey-monitor/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/cockpit/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/skills-list/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/session-bootstrap-vnext/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/thread-harvest/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/atom-search/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/tmonkey-listen/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/avengers-meeting/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/deferred-plans/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/chatgpt-find/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/plan-to-git/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/plan-to-git/SKILL.md:None) - **[low] Skill package contains many files** — Skill package contains 131 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content. (/repo/.:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/SKILL.md:None) - **[medium] File extension does not match actual content type** — File 'basic.md' extension (.md) suggests one format but Magika detected a different text format: Handlebars source (handlebars). This may indicate content obfuscation or a misnamed file. (/repo/TEMPLATES/basic.md:None) - **[high] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -s http://localhost:8790/pl \| python -c "import json,sys; items=json.load(sys.stdin)['items']; [print(i['pl_id'], i['title']) for i in items if i.get('category')=='coordination' and i.get('action_status') not in ('IGNORED','APPROVED')]"'. This is a remote code execution pattern. (/repo/plugins/lg13-skills/skills/lg13-init/SKILL.md.bak_20260502_2330:1) - **[high] Dangerous data flow in command pipeline** — Pipeline downloads data from the network and executes it: 'curl -s http://localhost:8790/pl \| python -c "import json,sys; items=json.load(sys.stdin)['items']; [print(i['pl_id'], i['title']) for i in items if i.get('category')=='coordination' and i.get('action_status') not in ('IGNORED','APPROVED')]"'. This is a remote code execution pattern. (/repo/plugins/lg13-skills/skills/strat-init/SKILL.md.bak_20260502_2330:1) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/.github/SKILL.md:None) - **[informational] Skill name does not follow agent skills naming rules** — Skill name '.github' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters. (/repo/.github/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/.github/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/TEMPLATES/SKILL.md:None) - **[informational] Skill name does not follow agent skills naming rules** — Skill name 'TEMPLATES' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters. (/repo/TEMPLATES/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/TEMPLATES/SKILL.md:None) - **[medium] File extension does not match actual content type** — File 'basic.md' extension (.md) suggests one format but Magika detected a different text format: Handlebars source (handlebars). This may indicate content obfuscation or a misnamed file. (/repo/TEMPLATES/basic.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/deep-read/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/deep-read/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/mysql/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/mysql/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/ftp/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/ftp/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/diamond-pick/prompts/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/diamond-pick/prompts/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/locks-workflow/references/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/locks-workflow/references/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/plugins/lg13-skills/skills/listen-to-the-music/references/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/plugins/lg13-skills/skills/listen-to-the-music/references/SKILL.md:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/.github/ISSUE_TEMPLATE/SKILL.md:None) - **[informational] Skill name does not follow agent skills naming rules** — Skill name 'Skill bug' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters. (/repo/.github/ISSUE_TEMPLATE/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/.github/ISSUE_TEMPLATE/SKILL.md:None) ### agent-audit-kit (v0.3.26) — Unsafe / 5.0 - **[high] Unsigned marketplace.json manifest** — .claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection. (.claude-plugin/marketplace.json:10) - **[medium] Healthcare context without explicit AI-disclosure to user** — Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions. (plugins/lg13-skills/skills/rain/SKILL.md:None) - **[high] Crisis keywords handled without escalation path** — A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure. (plugins/lg13-skills/skills/slack-listen/SKILL.md:74) - **[high] Crisis keywords handled without escalation path** — A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure. (plugins/lg13-skills/skills/ping-pong/SKILL.md:203) - **[high] Crisis keywords handled without escalation path** — A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure. (plugins/lg13-skills/skills/budget-watchdog/SKILL.md:234) - **[high] Crisis keywords handled without escalation path** — A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure. (plugins/lg13-skills/skills/compact-check/SKILL.md:24) - **[high] Indirect-prompt-injection wild payload checked into repo** — A source / config file ('.md', '.txt', '.yml', '.yaml', '.json', '.py') embeds a known wild IPI payload from the 2026-04-24 Help Net Security + Infosec Magazine catalogue. Common shapes: ignore-prior + exfil, system-role override, reveal-system-prompt, credential exfil via cURL, tool-call rerouting, delete-repository, admin role escalation, obfuscated prompt break, image-attached IPI, RAG-poisoned document. Refresh the corpus with 'aak corpus update --ipi'. (plugins/lg13-skills/skills/mysql/skill.md:3) ### nerlo-behavioral (v0.1.0) — Verified / 100.0 No findings. ### nerlo-install-instruction (v0.1.0) — Unsafe / 59.0 - **[high] opt.nerlo-rules.nerlo-install-pipe-to-shell** — Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... \| bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders — the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal. (/repo/plugins/lg13-skills/skills/lg13-init/SKILL.md.bak_20260502_2330:66) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/plugins/lg13-skills/skills/locks-workflow/scripts/lock.py:289) - **[medium] opt.nerlo-rules.nerlo-install-run-bundled-artifact** — Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. "run resource.txt", "execute install.sh", "double-click setup.exe"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected — opaque bundled executables directed by docs warrant review. (/repo/plugins/lg13-skills/skills/rain/SKILL.md:112) - **[high] opt.nerlo-rules.nerlo-install-pipe-to-shell** — Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... \| bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders — the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal. (/repo/plugins/lg13-skills/skills/strat-init/SKILL.md.bak_20260502_2330:30) ### nerlo-multi-source (v0.1.0) — unavailable / n/a No findings. ### trivy (v0.71.0) — unavailable / n/a No findings. ### osv-scanner (v2.3.8) — unavailable / n/a No findings. ### trivy_image (v0.71.0) — unavailable / n/a No findings. ## 4. Threat Model Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report. ## 5. Audit Chain - **Scan job:** `5bbff722-e07e-453c-80ad-920a1f853fe8` - **Completed:** 2026-07-28T21:15:19.707027+00:00 - **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:86a3d299a4356dfd5a34cd31cfa9f4c28d236d387691f7c8070086afe5224516` - **AI decision log entries:** 2 - `12604e78-2dad-4af7-a972-bf46e2f2794e` - `6a284bc5-6d9a-4fc8-8e5a-5ec078b3e89e` ## 6. Appendix — Raw Scanner Output ```json [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.7452827500092098, "status": "not_applicable", "examined": null, "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [] }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/uklid-coder/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/doc-polish/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/strat-init/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "command_injection", "file_path": "/repo/plugins/lg13-skills/skills/strat-init/SKILL.md.bak_20260502_2330", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -s http://localhost:8790/pl | python -c \"import json,sys; items=json.load(sys.stdin)['items']; [print(i['pl_id'], i['title']) for i in items if i.get('category')=='coordination' and i.get('action_status') not in ('IGNORED','APPROVED')]\"`. This is a remote code execution pattern.", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/rag-search/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/heartbeat/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/heartbeat/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/rain/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/rain/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/i-can-hear-u/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/i-can-hear-u/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/autosave/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/rr/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/token-limit-read/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/team-launcher/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/attachment-score/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/attachment-score/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/deep-read-full/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/deep-read-full/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/save-min/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/lare/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/slack-listen/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/tool-picker/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/tmonkey-web/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/git-tmonkey-search/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/diamond-pick/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/diamond-pick/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/chatgpt-force-read/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/ping-pong/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/lg13-save/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/rt/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/rt/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/budget-watchdog/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/budget-watchdog/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/lg13-init/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "command_injection", "file_path": "/repo/plugins/lg13-skills/skills/lg13-init/SKILL.md.bak_20260502_2330", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -s http://localhost:8790/pl | python -c \"import json,sys; items=json.load(sys.stdin)['items']; [print(i['pl_id'], i['title']) for i in items if i.get('category')=='coordination' and i.get('action_status') not in ('IGNORED','APPROVED')]\"`. This is a remote code execution pattern.", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/restart/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/rtg/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/rtg/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/rts/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/rts/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/compact-check/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/super-start/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/chatgpt-search/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/locks-workflow/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/team-speak/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/strat-end/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/sr/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/zero-tokens/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/vlastnak/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/prtsc/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/ocr-git/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/tmonkey/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/legal-daily-brief/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/legal-daily-brief/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/avengers/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/avengers/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/dnd/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/budget-manager/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/edge-check/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/email-read/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/consistency-check/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/consistency-check/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/comm-legal/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/chatgpt-ask/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/listen-to-the-music/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/listen-to-the-music/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/skill-creator/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/skill-creator/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/tmonkey-diag/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/diamond-to-matrix/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/issue-sync/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/web-up/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/web-up/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/skills-manual/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/strat-save/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/tmonkey-bot/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/tmonkey-bot/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/lg13-end/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/diamond-sentry/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/legal-total-analysis/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/legal-total-analysis/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/tom-notify/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/github-actions-if-yaml/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/github-actions-if-yaml/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/load-from-store/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/attachment-pipeline/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/attachment-pipeline/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/isds-ship-with-capsule/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/cti-cele/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/tmonkey-arm/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/skill-picker/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/filing-pipeline/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/save-to-store/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/file-catalog-search/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/terminator/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/terminator/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/action-telemetry/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/isds/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/chatgpt-send/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/work-mode/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/tmonkey-monitor/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/cockpit/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/skills-list/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/session-bootstrap-vnext/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/thread-harvest/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/atom-search/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/tmonkey-listen/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/avengers-meeting/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/deferred-plans/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/chatgpt-find/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/plan-to-git/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/plan-to-git/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/.", "line_number": null, "rule_identifier": "EXCESSIVE_FILE_COUNT", "title": "Skill package contains many files", "description": "Skill package contains 131 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.", "remediation": "Review file inventory and remove unnecessary files." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/TEMPLATES/basic.md", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'basic.md' extension (.md) suggests one format but Magika detected a different text format: Handlebars source (handlebars). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "command_injection", "file_path": "/repo/plugins/lg13-skills/skills/lg13-init/SKILL.md.bak_20260502_2330", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -s http://localhost:8790/pl | python -c \"import json,sys; items=json.load(sys.stdin)['items']; [print(i['pl_id'], i['title']) for i in items if i.get('category')=='coordination' and i.get('action_status') not in ('IGNORED','APPROVED')]\"`. This is a remote code execution pattern.", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "command_injection", "file_path": "/repo/plugins/lg13-skills/skills/strat-init/SKILL.md.bak_20260502_2330", "line_number": 1, "rule_identifier": "PIPELINE_TAINT_FLOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -s http://localhost:8790/pl | python -c \"import json,sys; items=json.load(sys.stdin)['items']; [print(i['pl_id'], i['title']) for i in items if i.get('category')=='coordination' and i.get('action_status') not in ('IGNORED','APPROVED')]\"`. This is a remote code execution pattern.", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/.github/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/.github/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_INVALID_NAME", "title": "Skill name does not follow agent skills naming rules", "description": "Skill name '.github' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.", "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/.github/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/TEMPLATES/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/TEMPLATES/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_INVALID_NAME", "title": "Skill name does not follow agent skills naming rules", "description": "Skill name 'TEMPLATES' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.", "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/TEMPLATES/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "obfuscation", "file_path": "/repo/TEMPLATES/basic.md", "line_number": null, "rule_identifier": "FILE_MAGIC_MISMATCH", "title": "File extension does not match actual content type", "description": "File 'basic.md' extension (.md) suggests one format but Magika detected a different text format: Handlebars source (handlebars). This may indicate content obfuscation or a misnamed file.", "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/deep-read/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/deep-read/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/mysql/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/mysql/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/ftp/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/ftp/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/diamond-pick/prompts/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/diamond-pick/prompts/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/locks-workflow/references/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/locks-workflow/references/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/plugins/lg13-skills/skills/listen-to-the-music/references/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/plugins/lg13-skills/skills/listen-to-the-music/references/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/.github/ISSUE_TEMPLATE/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/.github/ISSUE_TEMPLATE/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_INVALID_NAME", "title": "Skill name does not follow agent skills naming rules", "description": "Skill name 'Skill bug' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.", "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/.github/ISSUE_TEMPLATE/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 32.70221400799346, "status": "complete", "examined": null, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "uklid-coder", "doc-polish", "strat-init", "rag-search", "heartbeat", "rain", "i-can-hear-u", "autosave", "rr", "token-limit-read", "team-launcher", "attachment-score", "deep-read-full", "save-min", "lare", "slack-listen", "tool-picker", "tmonkey-web", "git-tmonkey-search", "diamond-pick", "chatgpt-force-read", "ping-pong", "session-save", "rt", "budget-watchdog", "lg13-init", "restart", "rtg", "rts", "compact-check", "super-start", "chatgpt-search", "locks-workflow", "team-speak", "strat-end", "sr", "zero-tokens", "vlastnak", "prtsc", "ocr-git", "tmonkey", "legal-daily-brief", "avengers", "dnd", "budget-manager", "edge-check", "email-read", "consistency-check", "comm-legal", "chatgpt-ask", "listen-to-the-music", "skill-creator", "tmonkey-diag", "diamond-to-matrix", "issue-sync", "web-up", "skills-manual", "strat-save", "tmonkey-bot", "session-end", "diamond-sentry", "legal-total-analysis", "tom-notify", "github-actions-if-yaml", "load-from-store", "attachment-pipeline", "isds-ship-with-capsule", "cti-cele", "tmonkey-arm", "skill-picker", "filing-pipeline", "save-to-store", "file-catalog-search", "terminator", "action-telemetry", "isds", "chatgpt-send", "work-mode", "tmonkey-monitor", "cockpit", "skills-list", "session-bootstrap-vnext", "thread-harvest", "atom-search", "tmonkey-listen", "avengers-meeting", "deferred-plans", "chatgpt-find", "plan-to-git", "repo", ".github", "TEMPLATES", "deep-read", "mysql", "ftp", "prompts", "references", "references", "Skill bug" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 33, "high": 4, "medium": 2, "critical": 0, "informational": 102 }, "artifact_type_policy": "claude_skill" }, "display_score": 0.0, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 5.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": ".claude-plugin/marketplace.json", "line_number": 10, "rule_identifier": "AAK-MARKETPLACE-001", "title": "Unsigned marketplace.json manifest", "description": ".claude-plugin/marketplace.json lacks a signature or integrity hash field. An attacker with write access to the marketplace can replace the plugin bundle with no detection.", "remediation": "Add a Sigstore signature or subresource-integrity hash to each plugin entry. Verify on install." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "legal-compliance", "file_path": "plugins/lg13-skills/skills/rain/SKILL.md", "line_number": null, "rule_identifier": "AAK-HEALTHCARE-AI-004", "title": "Healthcare context without explicit AI-disclosure to user", "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.", "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/lg13-skills/skills/slack-listen/SKILL.md", "line_number": 74, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/lg13-skills/skills/ping-pong/SKILL.md", "line_number": 203, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/lg13-skills/skills/budget-watchdog/SKILL.md", "line_number": 234, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "legal-compliance", "file_path": "plugins/lg13-skills/skills/compact-check/SKILL.md", "line_number": 24, "rule_identifier": "AAK-HEALTHCARE-AI-005", "title": "Crisis keywords handled without escalation path", "description": "A healthcare AI surface mentions suicide / self-harm / crisis but never references 988 / 911 / 112 / 999 / a crisis line. Tennessee HB 1951 (2026) creates criminal liability for encouraging suicide; lacking an escalation path materially worsens the exposure.", "remediation": "Add explicit crisis-line escalation instructions in the prompt / system message; test for the most common suicide / self-harm phrases and escalate before generating any other reply." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "taint-analysis", "file_path": "plugins/lg13-skills/skills/mysql/skill.md", "line_number": 3, "rule_identifier": "AAK-IPI-WILD-CORPUS-001", "title": "Indirect-prompt-injection wild payload checked into repo", "description": "A source / config file (`.md`, `.txt`, `.yml`, `.yaml`, `.json`, `.py`) embeds a known wild IPI payload from the 2026-04-24 Help Net Security + Infosec Magazine catalogue. Common shapes: ignore-prior + exfil, system-role override, reveal-system-prompt, credential exfil via cURL, tool-call rerouting, delete-repository, admin role escalation, obfuscated prompt break, image-attached IPI, RAG-poisoned document. Refresh the corpus with `aak corpus update --ipi`.", "remediation": "Remove the payload from the file. If the file is intentionally an attack-corpus fixture, exclude it via `--ignore-paths`. The real risk is checked-in poisoned templates / system-prompt files / RAG seed corpora \u2014 those need to be sanitized at ingestion time, not at scan time." } ], "execution_duration_seconds": 13.828853849001462, "status": "complete", "examined": null, "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 123, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 0, "high": 6, "medium": 1, "critical": 0, "informational": 0 } }, "display_score": 5.0, "display_badge": "Unsafe" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 43.34662140799628, "status": "complete", "examined": null, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 8, "ruleset_paths": [ "/opt/nerlo-rules/exfiltration.yaml", "/opt/nerlo-rules/clipboard_exfiltration.yaml", "/opt/nerlo-rules/rce_endpoint.yaml", "/opt/nerlo-rules/taint_egress.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "merged_invocation": true }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 59.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/plugins/lg13-skills/skills/lg13-init/SKILL.md.bak_20260502_2330", "line_number": 66, "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/plugins/lg13-skills/skills/locks-workflow/scripts/lock.py", "line_number": 289, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "medium", "category": "install-instruction-run", "file_path": "/repo/plugins/lg13-skills/skills/rain/SKILL.md", "line_number": 112, "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact", "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.", "remediation": null }, { "tool_name": "nerlo-install-instruction", "severity": "high", "category": "install-instruction-exec", "file_path": "/repo/plugins/lg13-skills/skills/strat-init/SKILL.md.bak_20260502_2330", "line_number": 30, "rule_identifier": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "title": "opt.nerlo-rules.nerlo-install-pipe-to-shell", "description": "Documentation instructs piping a downloaded artifact directly into a shell (curl/wget/iwr ... | bash/sh/iex). This is the curl-pipe-bash install shape used by the ClawHub skill droppers and countless malware loaders \u2014 the fetched payload is executed with zero inspection. Confirm this is expected; it is a strong weaponized-documentation signal.", "remediation": null } ], "execution_duration_seconds": 43.35172351798974, "status": "complete", "examined": null, "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 127, "ruleset_paths": [ "/opt/nerlo-rules/install_instructions.yaml", "/opt/nerlo-rules/cursor_rules.yaml" ], "install_command": "pip install 'semgrep==1.97.0'", "severity_counts": { "low": 0, "high": 2, "medium": 2, "critical": 0, "informational": 0 }, "merged_invocation": true }, "display_score": 59.0, "display_badge": "Unsafe" }, { "scanner_name": "nerlo-multi-source", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 11.649882882004022, "status": "not_applicable", "examined": null, "metadata": { "source": "nerlo-original", "per_source": [], "report_type": "nerlo-multi-source", "diverged_sources": [], "published_surfaces_scanned": 0 }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 1.046577528002672, "status": "not_applicable", "examined": null, "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "manifests_scanned": [] }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 0.5811118179990444, "status": "not_applicable", "examined": null, "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "manifests_scanned": [], "finding_id_aliases": {}, "cross_scanner_correlation": { "only_osv": [], "only_trivy": [], "intersection_ids": [] } }, "display_score": null, "display_badge": "unavailable" }, { "scanner_name": "trivy_image", "scanner_version": "0.71.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 1.1159994755871594e-05, "status": "not_applicable", "examined": null, "metadata": { "reason": "no OCI image acquired for this artifact" }, "display_score": null, "display_badge": "unavailable" } ] ```