csh/playbook
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
47ce7f78dcc76174930ef5c049fd86b39d9a35d2
playbook/antigravity-awesome-skills/tools/metadata-sources/aas-v1/security-agent.fields.json
T
ci[bot] 47ce7f78dc 📦 deps(thirdparty): update snapshots
2026-07-18 00:02:59 +00:00

6256 lines
237 KiB
JSON
Raw Blame History

{
"schemaVersion": 1,
"auditId": "aas-v1-security-agent-field-audit-2026-07-17",
"auditDate": "2026-07-17",
"rubric": {
"provenance": "known only with canonical URL/repository or repository-mapped declared package origin",
"setup": "activation/use prerequisite in Codex or Claude; implementation dependencies alone are not setup",
"dependenciesAndConflicts": "known-empty only after every file in the canonical skill subtree was read; related/recommended skills are not dependencies",
"risk": "safe only after focused command/network/credential/destructive-behavior review; critical never downgraded; otherwise unknown",
"prohibitedInputs": [
"tuning gold files",
"held-out cases",
"held-out gold files"
]
},
"scope": {
"sourceCandidateAudit": "/tmp/aas-v1-audit-security-agent.json",
"candidateCount": 41,
"tuningGoldFilesRead": false,
"heldOutCasesRead": false,
"heldOutGoldFilesRead": false,
"repositoryFilesModified": false
},
"summary": {
"total": 41,
"provenance": {
"known": 14,
"unknown": 27
},
"setup": {
"none": 24,
"manual": 13,
"incomplete": 4
},
"dependencies": {
"known": 40,
"incomplete": 1
},
"conflicts": {
"known": 41
},
"risk": {
"unknown": 19,
"critical": 3,
"safe": 19
}
},
"skills": {
"mcp-tool-developer": {
"provenance": {
"status": "known",
"value": {
"kind": "canonical-repository",
"canonicalUrl": "https://github.com/demo112/yunqu-ai-skills"
},
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/mcp-tool-developer/SKILL.md",
"lineStart": 7,
"lineEnd": 7,
"excerpt": "source_repo: demo112/yunqu-ai-skills"
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "efd6e38b0baae84a8a99d17077b15f7a43a90ff255f181ce1e6395cc9e34e58e",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "efd6e38b0baae84a8a99d17077b15f7a43a90ff255f181ce1e6395cc9e34e58e",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/mcp-tool-developer/SKILL.md",
"lineStart": 129,
"lineEnd": 129,
"excerpt": "## Related Skills"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "efd6e38b0baae84a8a99d17077b15f7a43a90ff255f181ce1e6395cc9e34e58e",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "safe",
"rationale": "Guidance covers deployment/registry publication and explicitly designs tools that may access files, networks, or execute code.",
"evidence": [
{
"type": "line",
"path": "skills/mcp-tool-developer/SKILL.md",
"lineStart": 119,
"lineEnd": 119,
"excerpt": "- Review tool permissions carefully - tools can access files, networks, and execute code"
},
{
"type": "focused-static-scan",
"treeSha256": "efd6e38b0baae84a8a99d17077b15f7a43a90ff255f181ce1e6395cc9e34e58e",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 0,
"credentials": 5,
"destructiveOrMutating": 2
},
"representativeSamples": {
"commandExecution": [],
"network": [],
"credentials": [
{
"path": "skills/mcp-tool-developer/SKILL.md",
"lineStart": 91,
"lineEnd": 91,
"excerpt": "Wrap an external API as an MCP tool with auth, rate limiting, and error handling:"
},
{
"path": "skills/mcp-tool-developer/SKILL.md",
"lineStart": 93,
"lineEnd": 93,
"excerpt": "- Handle auth via environment variables"
},
{
"path": "skills/mcp-tool-developer/SKILL.md",
"lineStart": 105,
"lineEnd": 105,
"excerpt": "- Use environment variables for secrets, never hardcode credentials"
}
],
"destructiveOrMutating": [
{
"path": "skills/mcp-tool-developer/SKILL.md",
"lineStart": 65,
"lineEnd": 65,
"excerpt": "### Step 4: Test and Deploy"
},
{
"path": "skills/mcp-tool-developer/SKILL.md",
"lineStart": 67,
"lineEnd": 67,
"excerpt": "Test with the MCP Inspector, validate tool schemas, handle edge cases, then deploy locally or remotely."
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "efd6e38b0baae84a8a99d17077b15f7a43a90ff255f181ce1e6395cc9e34e58e",
"files": [
{
"path": "skills/mcp-tool-developer/SKILL.md",
"bytes": 4867,
"sha256": "9bd2b02ff5027c3853737cc4dca505f20caa62834ec594f8c049d83d25c63f68"
}
],
"allFilesRead": true
}
},
"delegating-to-agents": {
"provenance": {
"status": "known",
"value": {
"kind": "canonical-repository",
"canonicalUrl": "https://github.com/davidondrej/skills"
},
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/delegating-to-agents/SKILL.md",
"lineStart": 7,
"lineEnd": 7,
"excerpt": "source_repo: davidondrej/skills"
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"cmux and at least one configured CLI agent; remote access credentials when using VPS workflows"
],
"evidence": [
{
"type": "line",
"path": "skills/delegating-to-agents/SKILL.md",
"lineStart": 27,
"lineEnd": 27,
"excerpt": "- **Most other tasks → Pi Agent** (`pi` in a cmux terminal). All Pi agents run opus-4.8-fast via OpenRouter at xhigh reasoning effort."
},
{
"type": "line",
"path": "skills/delegating-to-agents/SKILL.md",
"lineStart": 45,
"lineEnd": 45,
"excerpt": "SSH in first and launch the agent ON the VPS (e.g. `codex --yolo`), then drive that on-box agent. Don't run an agent locally and have it SSH for every step."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "85a3834c700f0af6fef74c651c8476c2a872b6eb4cea5440a018958c82d96054",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "85a3834c700f0af6fef74c651c8476c2a872b6eb4cea5440a018958c82d96054",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "critical",
"previousCatalogValue": "critical",
"rationale": "Preserved critical: directs external agent execution, remote SSH, and examples using bypass/yolo permission modes.",
"evidence": [
{
"type": "line",
"path": "skills/delegating-to-agents/SKILL.md",
"lineStart": 45,
"lineEnd": 45,
"excerpt": "SSH in first and launch the agent ON the VPS (e.g. `codex --yolo`), then drive that on-box agent. Don't run an agent locally and have it SSH for every step."
},
{
"type": "focused-static-scan",
"treeSha256": "85a3834c700f0af6fef74c651c8476c2a872b6eb4cea5440a018958c82d96054",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 1,
"credentials": 1,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/delegating-to-agents/SKILL.md",
"lineStart": 14,
"lineEnd": 14,
"excerpt": "license_source: \"https://github.com/davidondrej/skills/blob/main/LICENSE\""
}
],
"credentials": [
{
"path": "skills/delegating-to-agents/SKILL.md",
"lineStart": 63,
"lineEnd": 63,
"excerpt": "- Adapted from `davidondrej/skills`; verify local paths, tools, credentials, and agent features before acting."
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "85a3834c700f0af6fef74c651c8476c2a872b6eb4cea5440a018958c82d96054",
"files": [
{
"path": "skills/delegating-to-agents/SKILL.md",
"bytes": 4015,
"sha256": "dd23c465c91c35fe1185c1bd9cecfc4846c7fcfe522b082bb6b9503643df3fac"
}
],
"allFilesRead": true
}
},
"multi-agent-architect": {
"provenance": {
"status": "known",
"value": {
"kind": "canonical-repository",
"canonicalUrl": "https://github.com/pravin-python/antigravity-awesome-skills"
},
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/multi-agent-architect/SKILL.md",
"lineStart": 8,
"lineEnd": 8,
"excerpt": "source_repo: pravin-python/antigravity-awesome-skills"
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "f4599046512ba1cbd566cfc3d94d0c1633642ee4a2ba81abfea96429f5365346",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "f4599046512ba1cbd566cfc3d94d0c1633642ee4a2ba81abfea96429f5365346",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/multi-agent-architect/SKILL.md",
"lineStart": 357,
"lineEnd": 357,
"excerpt": "## Related Skills"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "f4599046512ba1cbd566cfc3d94d0c1633642ee4a2ba81abfea96429f5365346",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "safe",
"rationale": "Static architecture/code-generation guidance; no install or shell command is prescribed, and it explicitly requires permission layers for shell/filesystem access.",
"evidence": [
{
"type": "line",
"path": "skills/multi-agent-architect/SKILL.md",
"lineStart": 327,
"lineEnd": 327,
"excerpt": "- Add a permission layer before allowing agents to execute shell commands or write to filesystems."
},
{
"type": "focused-static-scan",
"treeSha256": "f4599046512ba1cbd566cfc3d94d0c1633642ee4a2ba81abfea96429f5365346",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 1,
"credentials": 6,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/multi-agent-architect/SKILL.md",
"lineStart": 15,
"lineEnd": 15,
"excerpt": "license_source: \"https://github.com/pravin-python/antigravity-awesome-skills/blob/main/LICENSE\""
}
],
"credentials": [
{
"path": "skills/multi-agent-architect/SKILL.md",
"lineStart": 194,
"lineEnd": 194,
"excerpt": "[Latency / token / memory delta]"
},
{
"path": "skills/multi-agent-architect/SKILL.md",
"lineStart": 212,
"lineEnd": 212,
"excerpt": "├── configs/ # Config loader — no secrets in code"
},
{
"path": "skills/multi-agent-architect/SKILL.md",
"lineStart": 299,
"lineEnd": 299,
"excerpt": "- ✅ Store all secrets in environment variables loaded via `os.getenv()`"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "f4599046512ba1cbd566cfc3d94d0c1633642ee4a2ba81abfea96429f5365346",
"files": [
{
"path": "skills/multi-agent-architect/SKILL.md",
"bytes": 12294,
"sha256": "46c9287a5d9b81ab08ca39a5059f391e874e50d06cff7823ea6d70901c221ff8"
}
],
"allFilesRead": true
}
},
"agent-orchestration-multi-agent-optimize": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/agent-orchestration-multi-agent-optimize/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "6097f5e85dc87f32b296a5722b6e0d0ae9b4e5631df71a5c3f66bb7394285d3b",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "6097f5e85dc87f32b296a5722b6e0d0ae9b4e5631df71a5c3f66bb7394285d3b",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "6097f5e85dc87f32b296a5722b6e0d0ae9b4e5631df71a5c3f66bb7394285d3b",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "unknown",
"rationale": "Conceptual optimization guidance and pseudocode only; no executable command, credential acquisition, or destructive operation found.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "6097f5e85dc87f32b296a5722b6e0d0ae9b4e5631df71a5c3f66bb7394285d3b",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 0,
"credentials": 2,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [],
"credentials": [
{
"path": "skills/agent-orchestration-multi-agent-optimize/SKILL.md",
"lineStart": 109,
"lineEnd": 109,
"excerpt": "- Token budget management"
},
{
"path": "skills/agent-orchestration-multi-agent-optimize/SKILL.md",
"lineStart": 169,
"lineEnd": 169,
"excerpt": "- Token usage tracking"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "6097f5e85dc87f32b296a5722b6e0d0ae9b4e5631df71a5c3f66bb7394285d3b",
"files": [
{
"path": "skills/agent-orchestration-multi-agent-optimize/SKILL.md",
"bytes": 7158,
"sha256": "848a24a5949f23abe0fb80659bfbf9b5c84f238805cd638c0136fb8c54ed5049"
}
],
"allFilesRead": true
}
},
"ai-agents-architect": {
"provenance": {
"status": "known",
"value": {
"kind": "repository-mapping-from-declared-pack-origin",
"canonicalUrl": "https://github.com/vibeforge1111/vibeship-spawner-skills"
},
"declaredSource": "vibeship-spawner-skills (Apache 2.0)",
"evidence": [
{
"type": "line",
"path": "skills/ai-agents-architect/SKILL.md",
"lineStart": 6,
"lineEnd": 6,
"excerpt": "source: vibeship-spawner-skills (Apache 2.0)"
},
{
"type": "line",
"path": "README.md",
"lineStart": 475,
"lineEnd": 475,
"excerpt": "- **[vibeforge1111/vibeship-spawner-skills](https://github.com/vibeforge1111/vibeship-spawner-skills)**: AI agents, integrations, maker tools, and other production-grade skill packs."
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "c85f62e2e4d1a13786bc95c705514d7b56aab6c0379a1821bcaec7e0071cec40",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "c85f62e2e4d1a13786bc95c705514d7b56aab6c0379a1821bcaec7e0071cec40",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [
{
"path": "skills/ai-agents-architect/SKILL.md",
"lineStart": 52,
"lineEnd": 52,
"excerpt": "- Required skills: LLM API usage, Understanding of function calling, Basic prompt engineering"
}
],
"relatedOrRecommendedMatches": [
{
"path": "skills/ai-agents-architect/SKILL.md",
"lineStart": 319,
"lineEnd": 319,
"excerpt": "## Related Skills"
},
{
"path": "skills/ai-agents-architect/SKILL.md",
"lineStart": 321,
"lineEnd": 321,
"excerpt": "Works well with: `rag-engineer`, `prompt-engineer`, `backend`, `mcp-builder`"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "c85f62e2e4d1a13786bc95c705514d7b56aab6c0379a1821bcaec7e0071cec40",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "unknown",
"rationale": "Conceptual architecture patterns only; no executable commands, credential handling, or destructive operations found.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "c85f62e2e4d1a13786bc95c705514d7b56aab6c0379a1821bcaec7e0071cec40",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 0,
"credentials": 2,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [],
"credentials": [
{
"path": "skills/ai-agents-architect/SKILL.md",
"lineStart": 208,
"lineEnd": 208,
"excerpt": "- High token costs"
},
{
"path": "skills/ai-agents-architect/SKILL.md",
"lineStart": 292,
"lineEnd": 292,
"excerpt": "- Trace token usage and latency"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "c85f62e2e4d1a13786bc95c705514d7b56aab6c0379a1821bcaec7e0071cec40",
"files": [
{
"path": "skills/ai-agents-architect/SKILL.md",
"bytes": 9115,
"sha256": "bbe6a0a8e93c0723760140a69d0fdf426d1fe84834d47e20e372711e7b6628f1"
}
],
"allFilesRead": true
}
},
"agent-evaluation": {
"provenance": {
"status": "known",
"value": {
"kind": "repository-mapping-from-declared-pack-origin",
"canonicalUrl": "https://github.com/vibeforge1111/vibeship-spawner-skills"
},
"declaredSource": "vibeship-spawner-skills (Apache 2.0)",
"evidence": [
{
"type": "line",
"path": "skills/agent-evaluation/SKILL.md",
"lineStart": 7,
"lineEnd": 7,
"excerpt": "source: vibeship-spawner-skills (Apache 2.0)"
},
{
"type": "line",
"path": "README.md",
"lineStart": 475,
"lineEnd": 475,
"excerpt": "- **[vibeforge1111/vibeship-spawner-skills](https://github.com/vibeforge1111/vibeship-spawner-skills)**: AI agents, integrations, maker tools, and other production-grade skill packs."
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "incomplete",
"value": "incomplete",
"requirements": [
"declared required skill references testing-fundamentals and llm-fundamentals are not present in the AAS catalog"
],
"evidence": [
{
"type": "line",
"path": "skills/agent-evaluation/SKILL.md",
"lineStart": 27,
"lineEnd": 27,
"excerpt": "- Required skills: testing-fundamentals, llm-fundamentals"
}
]
},
"dependencies": {
"status": "incomplete",
"value": [],
"unresolvedRequiredReferences": [
"testing-fundamentals",
"llm-fundamentals"
],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "16bc5acc9fc874a517db0ba810d890bffe3b1953c4038f5f8dae150311b6b64e",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [
{
"path": "skills/agent-evaluation/SKILL.md",
"lineStart": 27,
"lineEnd": 27,
"excerpt": "- Required skills: testing-fundamentals, llm-fundamentals"
}
],
"relatedOrRecommendedMatches": [
{
"path": "skills/agent-evaluation/SKILL.md",
"lineStart": 26,
"lineEnd": 26,
"excerpt": "- Skills_recommended: autonomous-agents, multi-agent-orchestration"
},
{
"path": "skills/agent-evaluation/SKILL.md",
"lineStart": 1121,
"lineEnd": 1121,
"excerpt": "## Related Skills"
},
{
"path": "skills/agent-evaluation/SKILL.md",
"lineStart": 1123,
"lineEnd": 1123,
"excerpt": "Works well with: `multi-agent-orchestration`, `agent-communication`, `autonomous-agents`"
}
],
"finding": "No resolvable required inter-AAS skill ID found; declared required references are absent from the catalog."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "16bc5acc9fc874a517db0ba810d890bffe3b1953c4038f5f8dae150311b6b64e",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "safe",
"rationale": "Evaluation design and pseudocode only; no operational command, network call, credential access, or destructive action found.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "16bc5acc9fc874a517db0ba810d890bffe3b1953c4038f5f8dae150311b6b64e",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 0,
"credentials": 0,
"destructiveOrMutating": 3
},
"representativeSamples": {
"commandExecution": [],
"network": [],
"credentials": [],
"destructiveOrMutating": [
{
"path": "skills/agent-evaluation/SKILL.md",
"lineStart": 564,
"lineEnd": 564,
"excerpt": "? 'DO NOT DEPLOY: Regressions detected'"
},
{
"path": "skills/agent-evaluation/SKILL.md",
"lineStart": 565,
"lineEnd": 565,
"excerpt": ": 'OK to deploy'"
},
{
"path": "skills/agent-evaluation/SKILL.md",
"lineStart": 1103,
"lineEnd": 1103,
"excerpt": "2. Deploy with monitoring"
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "16bc5acc9fc874a517db0ba810d890bffe3b1953c4038f5f8dae150311b6b64e",
"files": [
{
"path": "skills/agent-evaluation/SKILL.md",
"bytes": 36957,
"sha256": "c7a2bca261edc021d0d3a264b3ab1cba7b567f9084f6ddea5af448077afc3843"
}
],
"allFilesRead": true
}
},
"agent-memory-systems": {
"provenance": {
"status": "known",
"value": {
"kind": "repository-mapping-from-declared-pack-origin",
"canonicalUrl": "https://github.com/vibeforge1111/vibeship-spawner-skills"
},
"declaredSource": "vibeship-spawner-skills (Apache 2.0)",
"evidence": [
{
"type": "line",
"path": "skills/agent-memory-systems/SKILL.md",
"lineStart": 8,
"lineEnd": 8,
"excerpt": "source: vibeship-spawner-skills (Apache 2.0)"
},
{
"type": "line",
"path": "README.md",
"lineStart": 475,
"lineEnd": 475,
"excerpt": "- **[vibeforge1111/vibeship-spawner-skills](https://github.com/vibeforge1111/vibeship-spawner-skills)**: AI agents, integrations, maker tools, and other production-grade skill packs."
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "d6146928fa9aaf9e20e8909901350181ce82c50236a118512abae85f18f998a6",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "d6146928fa9aaf9e20e8909901350181ce82c50236a118512abae85f18f998a6",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/agent-memory-systems/SKILL.md",
"lineStart": 1067,
"lineEnd": 1067,
"excerpt": "## Related Skills"
},
{
"path": "skills/agent-memory-systems/SKILL.md",
"lineStart": 1069,
"lineEnd": 1069,
"excerpt": "Works well with: `autonomous-agents`, `multi-agent-orchestration`, `llm-architect`, `agent-tool-builder`"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "d6146928fa9aaf9e20e8909901350181ce82c50236a118512abae85f18f998a6",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "safe",
"rationale": "Examples access external vector services/API keys and include memory deletion operations.",
"evidence": [
{
"type": "line",
"path": "skills/agent-memory-systems/SKILL.md",
"lineStart": 470,
"lineEnd": 470,
"excerpt": "await memory.semantic.delete(old.id)"
},
{
"type": "focused-static-scan",
"treeSha256": "d6146928fa9aaf9e20e8909901350181ce82c50236a118512abae85f18f998a6",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 1,
"credentials": 13,
"destructiveOrMutating": 6
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/agent-memory-systems/SKILL.md",
"lineStart": 243,
"lineEnd": 243,
"excerpt": "client = QdrantClient(url=\"http://localhost:6333\")"
}
],
"credentials": [
{
"path": "skills/agent-memory-systems/SKILL.md",
"lineStart": 75,
"lineEnd": 75,
"excerpt": "- OpenAI text-embedding-3-large - When: Best quality, 3072 dimensions Note: $0.13/1M tokens"
},
{
"path": "skills/agent-memory-systems/SKILL.md",
"lineStart": 76,
"lineEnd": 76,
"excerpt": "- OpenAI text-embedding-3-small - When: Good balance, 1536 dimensions Note: $0.02/1M tokens, 5x cheaper"
},
{
"path": "skills/agent-memory-systems/SKILL.md",
"lineStart": 135,
"lineEnd": 135,
"excerpt": "\"summary\": \"Helped debug authentication issue\","
}
],
"destructiveOrMutating": [
{
"path": "skills/agent-memory-systems/SKILL.md",
"lineStart": 468,
"lineEnd": 468,
"excerpt": "# Delete originals"
},
{
"path": "skills/agent-memory-systems/SKILL.md",
"lineStart": 470,
"lineEnd": 470,
"excerpt": "await memory.semantic.delete(old.id)"
},
{
"path": "skills/agent-memory-systems/SKILL.md",
"lineStart": 506,
"lineEnd": 506,
"excerpt": "# Soft delete (mark as archived)"
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "d6146928fa9aaf9e20e8909901350181ce82c50236a118512abae85f18f998a6",
"files": [
{
"path": "skills/agent-memory-systems/SKILL.md",
"bytes": 31187,
"sha256": "2003324855b6937675d21ad41925d38538d3a1076b8f734149b5d27ecb2152c9"
}
],
"allFilesRead": true
}
},
"multi-agent-patterns": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/multi-agent-patterns/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "437dfd91520ebeeb20c047be0b3ed78594282a39b5360396688a7ed788d20488",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "437dfd91520ebeeb20c047be0b3ed78594282a39b5360396688a7ed788d20488",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/multi-agent-patterns/SKILL.md",
"lineStart": 238,
"lineEnd": 238,
"excerpt": "Related skills in this collection:"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "437dfd91520ebeeb20c047be0b3ed78594282a39b5360396688a7ed788d20488",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "unknown",
"rationale": "Architecture guidance only; filesystem persistence is discussed as a pattern but no command or autonomous mutation is prescribed.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "437dfd91520ebeeb20c047be0b3ed78594282a39b5360396688a7ed788d20488",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 4,
"credentials": 6,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/multi-agent-patterns/SKILL.md",
"lineStart": 244,
"lineEnd": 244,
"excerpt": "- [LangGraph Documentation](https://langchain-ai.github.io/langgraph/) - Multi-agent patterns and state management"
},
{
"path": "skills/multi-agent-patterns/SKILL.md",
"lineStart": 245,
"lineEnd": 245,
"excerpt": "- [AutoGen Framework](https://microsoft.github.io/autogen/) - GroupChat and conversational patterns"
},
{
"path": "skills/multi-agent-patterns/SKILL.md",
"lineStart": 246,
"lineEnd": 246,
"excerpt": "- [CrewAI Documentation](https://docs.crewai.com/) - Hierarchical agent processes"
}
],
"credentials": [
{
"path": "skills/multi-agent-patterns/SKILL.md",
"lineStart": 36,
"lineEnd": 36,
"excerpt": "**The Token Economics Reality**"
},
{
"path": "skills/multi-agent-patterns/SKILL.md",
"lineStart": 37,
"lineEnd": 37,
"excerpt": "Multi-agent systems consume significantly more tokens than single-agent approaches. Production data shows:"
},
{
"path": "skills/multi-agent-patterns/SKILL.md",
"lineStart": 39,
"lineEnd": 39,
"excerpt": "| Architecture | Token Multiplier | Use Case |"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "437dfd91520ebeeb20c047be0b3ed78594282a39b5360396688a7ed788d20488",
"files": [
{
"path": "skills/multi-agent-patterns/SKILL.md",
"bytes": 14965,
"sha256": "8e1d659fe32c68fb4580697ee4110eb895e4a72a43bfde6d4db2cc29bd7d2733"
}
],
"allFilesRead": true
}
},
"agentic-actions-auditor": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 13,
"lineEnd": 13,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"gh CLI and GitHub authentication for remote repository audits"
],
"evidence": [
{
"type": "line",
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 100,
"lineEnd": 100,
"excerpt": "- **401/auth error:** Report: \"GitHub authentication required. Run `gh auth login` to authenticate.\""
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "2c76dabaecb9ae5595d5ac2925694a5000e11b7b1b70497c9e05b9db6f35ce75",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "2c76dabaecb9ae5595d5ac2925694a5000e11b7b1b70497c9e05b9db6f35ce75",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "safe",
"rationale": "Remote audit path uses read-only gh api calls and explicitly forbids cloning, writing, or executing fetched content.",
"evidence": [
{
"type": "line",
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 112,
"lineEnd": 112,
"excerpt": "**NEVER use Bash to:**"
},
{
"type": "line",
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 81,
"lineEnd": 81,
"excerpt": "gh api repos/{owner}/{repo}/contents/.github/workflows --paginate --jq '.[].name'"
},
{
"type": "focused-static-scan",
"treeSha256": "2c76dabaecb9ae5595d5ac2925694a5000e11b7b1b70497c9e05b9db6f35ce75",
"filesReviewed": 1,
"categories": {
"commandExecution": 8,
"network": 9,
"credentials": 9,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 77,
"lineEnd": 77,
"excerpt": "Use a two-step approach with `gh api`:"
},
{
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 81,
"lineEnd": 81,
"excerpt": "gh api repos/{owner}/{repo}/contents/.github/workflows --paginate --jq '.[].name'"
},
{
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 89,
"lineEnd": 89,
"excerpt": "gh api repos/{owner}/{repo}/contents/.github/workflows/{filename} --jq '.content | @base64d'"
}
],
"network": [
{
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 69,
"lineEnd": 69,
"excerpt": "| `https://github.com/owner/repo` | owner, repo; ref = default branch |"
},
{
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 70,
"lineEnd": 70,
"excerpt": "| `https://github.com/owner/repo/tree/main/...` | owner, repo; strip extra path segments |"
},
{
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 73,
"lineEnd": 73,
"excerpt": "Strip trailing slashes, `.git` suffix, and `www.` prefix. Handle both `http://` and `https://`."
}
],
"credentials": [
{
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 51,
"lineEnd": 51,
"excerpt": "Wrong because sandbox misconfigurations (`danger-full-access`, `Bash(*)`, `--yolo`) disable protections entirely. Even properly configured sandboxes leak secrets if the AI agent can read environment variables or mounted files. The sandbox boundary is only as strong as its configuration."
},
{
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 98,
"lineEnd": 98,
"excerpt": "Do NOT pre-check `gh auth status` before API calls. Attempt the API call and handle failures:"
},
{
"path": "skills/agentic-actions-auditor/SKILL.md",
"lineStart": 100,
"lineEnd": 100,
"excerpt": "- **401/auth error:** Report: \"GitHub authentication required. Run `gh auth login` to authenticate.\""
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "2c76dabaecb9ae5595d5ac2925694a5000e11b7b1b70497c9e05b9db6f35ce75",
"files": [
{
"path": "skills/agentic-actions-auditor/SKILL.md",
"bytes": 20807,
"sha256": "5c20a6b301fd88b98b4c68918bd9726878ffbf3cf9b3f91be52b0f60a1851c26"
}
],
"allFilesRead": true
}
},
"agent-tool-builder": {
"provenance": {
"status": "known",
"value": {
"kind": "repository-mapping-from-declared-pack-origin",
"canonicalUrl": "https://github.com/vibeforge1111/vibeship-spawner-skills"
},
"declaredSource": "vibeship-spawner-skills (Apache 2.0)",
"evidence": [
{
"type": "line",
"path": "skills/agent-tool-builder/SKILL.md",
"lineStart": 8,
"lineEnd": 8,
"excerpt": "source: vibeship-spawner-skills (Apache 2.0)"
},
{
"type": "line",
"path": "README.md",
"lineStart": 475,
"lineEnd": 475,
"excerpt": "- **[vibeforge1111/vibeship-spawner-skills](https://github.com/vibeforge1111/vibeship-spawner-skills)**: AI agents, integrations, maker tools, and other production-grade skill packs."
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "b31ee9914466c62c5c4f0682971d18d2475e49bf745639fd0c476d87e7cebac2",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "b31ee9914466c62c5c4f0682971d18d2475e49bf745639fd0c476d87e7cebac2",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/agent-tool-builder/SKILL.md",
"lineStart": 693,
"lineEnd": 693,
"excerpt": "## Related Skills"
},
{
"path": "skills/agent-tool-builder/SKILL.md",
"lineStart": 695,
"lineEnd": 695,
"excerpt": "Works well with: `multi-agent-orchestration`, `api-designer`, `llm-architect`, `backend`"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "b31ee9914466c62c5c4f0682971d18d2475e49bf745639fd0c476d87e7cebac2",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "unknown",
"rationale": "Tool-design pseudocode with validation guidance; no concrete network credential, installation, or destructive command is prescribed.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "b31ee9914466c62c5c4f0682971d18d2475e49bf745639fd0c476d87e7cebac2",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 1,
"credentials": 2,
"destructiveOrMutating": 1
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/agent-tool-builder/SKILL.md",
"lineStart": 314,
"lineEnd": 314,
"excerpt": "data = weather_api.fetch(location)"
}
],
"credentials": [
{
"path": "skills/agent-tool-builder/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "fails silently, or costs 10x more tokens than necessary. This skill covers"
},
{
"path": "skills/agent-tool-builder/SKILL.md",
"lineStart": 16,
"lineEnd": 16,
"excerpt": "silently, or costs 10x more tokens than necessary."
}
],
"destructiveOrMutating": [
{
"path": "skills/agent-tool-builder/SKILL.md",
"lineStart": 146,
"lineEnd": 146,
"excerpt": "\"enum\": [\"create\", \"read\", \"update\", \"delete\"],"
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "b31ee9914466c62c5c4f0682971d18d2475e49bf745639fd0c476d87e7cebac2",
"files": [
{
"path": "skills/agent-tool-builder/SKILL.md",
"bytes": 19088,
"sha256": "d32f031ee373cb91618e2cb489e486258b1efa098621f403771b42013f733b03"
}
],
"allFilesRead": true
}
},
"mcp-builder": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/mcp-builder/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"Node/npx for MCP Inspector; Python dependencies for bundled evaluation scripts"
],
"evidence": [
{
"type": "line",
"path": "skills/mcp-builder/SKILL.md",
"lineStart": 143,
"lineEnd": 143,
"excerpt": "- Test with MCP Inspector: `npx @modelcontextprotocol/inspector`"
},
{
"type": "line",
"path": "skills/mcp-builder/reference/evaluation.md",
"lineStart": 387,
"lineEnd": 387,
"excerpt": "pip install -r scripts/requirements.txt"
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "13d694a7f21d3848dd62cbf5da976a73615dea74ac807c09dd820b6b2b9c3099",
"filesReviewed": 10,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "13d694a7f21d3848dd62cbf5da976a73615dea74ac807c09dd820b6b2b9c3099",
"filesReviewed": 10,
"lexicalMatchesReviewedAsNonInterAAS": [
{
"path": "skills/mcp-builder/reference/mcp_best_practices.md",
"lineStart": 54,
"lineEnd": 54,
"excerpt": "4. **Be specific**: Avoid generic names that could conflict with other servers"
}
],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "unknown",
"rationale": "Bundled executable Python scripts write reports and references include network clients, subprocess operation, npx, and dependency installation.",
"evidence": [
{
"type": "line",
"path": "skills/mcp-builder/scripts/evaluation.py",
"lineStart": 370,
"lineEnd": 370,
"excerpt": "args.output.write_text(report)"
},
{
"type": "line",
"path": "skills/mcp-builder/reference/python_mcp_server.md",
"lineStart": 235,
"lineEnd": 235,
"excerpt": "async with httpx.AsyncClient() as client:"
},
{
"type": "focused-static-scan",
"treeSha256": "13d694a7f21d3848dd62cbf5da976a73615dea74ac807c09dd820b6b2b9c3099",
"filesReviewed": 10,
"categories": {
"commandExecution": 4,
"network": 29,
"credentials": 24,
"destructiveOrMutating": 4
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/mcp-builder/reference/evaluation.md",
"lineStart": 387,
"lineEnd": 387,
"excerpt": "pip install -r scripts/requirements.txt"
},
{
"path": "skills/mcp-builder/reference/evaluation.md",
"lineStart": 392,
"lineEnd": 392,
"excerpt": "pip install anthropic mcp"
},
{
"path": "skills/mcp-builder/reference/evaluation.md",
"lineStart": 556,
"lineEnd": 556,
"excerpt": "pip install -r scripts/requirements.txt"
}
],
"network": [
{
"path": "skills/mcp-builder/LICENSE.txt",
"lineStart": 4,
"lineEnd": 4,
"excerpt": "http://www.apache.org/licenses/"
},
{
"path": "skills/mcp-builder/LICENSE.txt",
"lineStart": 196,
"lineEnd": 196,
"excerpt": "http://www.apache.org/licenses/LICENSE-2.0"
},
{
"path": "skills/mcp-builder/reference/evaluation.md",
"lineStart": 387,
"lineEnd": 387,
"excerpt": "pip install -r scripts/requirements.txt"
}
],
"credentials": [
{
"path": "skills/mcp-builder/reference/evaluation.md",
"lineStart": 330,
"lineEnd": 330,
"excerpt": "<question>Find the pull request with title \"Add authentication feature\" and tell me who created it.</question>"
},
{
"path": "skills/mcp-builder/reference/evaluation.md",
"lineStart": 395,
"lineEnd": 395,
"excerpt": "2. **Set API Key**"
},
{
"path": "skills/mcp-builder/reference/evaluation.md",
"lineStart": 444,
"lineEnd": 444,
"excerpt": "-e API_KEY=abc123 \\"
}
],
"destructiveOrMutating": [
{
"path": "skills/mcp-builder/reference/node_mcp_server.md",
"lineStart": 444,
"lineEnd": 444,
"excerpt": "method: \"GET\" | \"POST\" | \"PUT\" | \"DELETE\" = \"GET\","
},
{
"path": "skills/mcp-builder/reference/node_mcp_server.md",
"lineStart": 541,
"lineEnd": 541,
"excerpt": "\"clean\": \"rm -rf dist\""
},
{
"path": "skills/mcp-builder/reference/node_mcp_server.md",
"lineStart": 637,
"lineEnd": 637,
"excerpt": "method: \"GET\" | \"POST\" | \"PUT\" | \"DELETE\" = \"GET\","
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "13d694a7f21d3848dd62cbf5da976a73615dea74ac807c09dd820b6b2b9c3099",
"files": [
{
"path": "skills/mcp-builder/LICENSE.txt",
"bytes": 11357,
"sha256": "58d1e17ffe5109a7ae296caafcadfdbe6a7d176f0bc4ab01e12a689b0499d8bd"
},
{
"path": "skills/mcp-builder/reference/evaluation.md",
"bytes": 21663,
"sha256": "8c99479f8a2d22a636c38e274537aac3610879e26f34e0709825077c4576f427"
},
{
"path": "skills/mcp-builder/reference/mcp_best_practices.md",
"bytes": 7330,
"sha256": "80fb4369a349447cf18ecdd7494fe7938b6065377e9f08c077cec411093a3007"
},
{
"path": "skills/mcp-builder/reference/node_mcp_server.md",
"bytes": 28550,
"sha256": "c3ba35a4f599dd53be9c6555ae72c19a7bf412cd5426576c2c08d42755482c66"
},
{
"path": "skills/mcp-builder/reference/python_mcp_server.md",
"bytes": 25099,
"sha256": "2da52f77e675191014ca2e146a4b95aa04d0ca7dd7e2b100322df15ade685e80"
},
{
"path": "skills/mcp-builder/scripts/connections.py",
"bytes": 4875,
"sha256": "9403668a2041568772082a8b334122c1f88daf0541fb393af4522d0094a47a6e"
},
{
"path": "skills/mcp-builder/scripts/evaluation.py",
"bytes": 12671,
"sha256": "d3677c9d3b156d6205617728af41153098787b1fe03488053cfacb22f065158f"
},
{
"path": "skills/mcp-builder/scripts/example_evaluation.xml",
"bytes": 1194,
"sha256": "9272b348ddcc4b06ba562367ccd0770e018158c0068ac5116d5e34aaeff8777a"
},
{
"path": "skills/mcp-builder/scripts/requirements.txt",
"bytes": 29,
"sha256": "d5d7558b2368ecea9dfeed7d1fbc71ee9e0750bebd1282faa527d528a344c3c7"
},
{
"path": "skills/mcp-builder/SKILL.md",
"bytes": 9482,
"sha256": "e2d89c7a913b74c4ced2f122603f61ca7cfdd6185d8c82d80ab0fd257909f9af"
}
],
"allFilesRead": true
}
},
"mcp-builder-ms": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/mcp-builder-ms/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "90c6b462408b0f8d191a80b6419bfd2fa9c012d9feb813fb7dc1a40a94b11305",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "90c6b462408b0f8d191a80b6419bfd2fa9c012d9feb813fb7dc1a40a94b11305",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "90c6b462408b0f8d191a80b6419bfd2fa9c012d9feb813fb7dc1a40a94b11305",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "unknown",
"rationale": "Development guide includes remote MCP/Azure deployment surface; no bounded read-only operational contract applies to the generated server.",
"evidence": [
{
"type": "line",
"path": "skills/mcp-builder-ms/SKILL.md",
"lineStart": 300,
"lineEnd": 300,
"excerpt": "- Azure Functions remote MCP deployment"
},
{
"type": "focused-static-scan",
"treeSha256": "90c6b462408b0f8d191a80b6419bfd2fa9c012d9feb813fb7dc1a40a94b11305",
"filesReviewed": 1,
"categories": {
"commandExecution": 2,
"network": 10,
"credentials": 4,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/mcp-builder-ms/SKILL.md",
"lineStart": 28,
"lineEnd": 28,
"excerpt": "| **Local** | stdio | Desktop apps, single-user, local dev | Azure MCP Server via NPM/Docker |"
},
{
"path": "skills/mcp-builder-ms/SKILL.md",
"lineStart": 198,
"lineEnd": 198,
"excerpt": "- Test with MCP Inspector: `npx @modelcontextprotocol/inspector`"
}
],
"network": [
{
"path": "skills/mcp-builder-ms/SKILL.md",
"lineStart": 29,
"lineEnd": 29,
"excerpt": "| **Remote** | Streamable HTTP | Cloud services, multi-tenant, Agent Service | `https://mcp.ai.azure.com` (Foundry) |"
},
{
"path": "skills/mcp-builder-ms/SKILL.md",
"lineStart": 38,
"lineEnd": 38,
"excerpt": "| **Foundry MCP** | Remote | `https://mcp.ai.azure.com` - Models, deployments, evals, agents |"
},
{
"path": "skills/mcp-builder-ms/SKILL.md",
"lineStart": 41,
"lineEnd": 41,
"excerpt": "| **GitHub MCP** | Remote | `https://api.githubcopilot.com/mcp` |"
}
],
"credentials": [
{
"path": "skills/mcp-builder-ms/SKILL.md",
"lineStart": 106,
"lineEnd": 106,
"excerpt": "| **Streamable HTTP** | Remote servers, multi-tenant, Agent Service | Stateless, scalable, requires auth |"
},
{
"path": "skills/mcp-builder-ms/SKILL.md",
"lineStart": 127,
"lineEnd": 127,
"excerpt": "Review the service's API documentation to identify key endpoints, authentication requirements, and data models. Use web search and WebFetch as needed."
},
{
"path": "skills/mcp-builder-ms/SKILL.md",
"lineStart": 146,
"lineEnd": 146,
"excerpt": "- API client with authentication"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "90c6b462408b0f8d191a80b6419bfd2fa9c012d9feb813fb7dc1a40a94b11305",
"files": [
{
"path": "skills/mcp-builder-ms/SKILL.md",
"bytes": 11876,
"sha256": "32fd41110dbde6aac8a614a0f20db8c9aa84b28fb7a0fecfda357623853d4c84"
}
],
"allFilesRead": true
}
},
"memory-systems": {
"provenance": {
"status": "known",
"value": {
"kind": "canonical-skill-url",
"canonicalUrl": "https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/memory-systems"
},
"declaredSource": "https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/memory-systems",
"evidence": [
{
"type": "line",
"path": "skills/memory-systems/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: \"https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/memory-systems\""
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "d5a31ca307e6cdb1af63cfccea50c0d5fef0884974397d90ce1b84cd4cbab513",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "d5a31ca307e6cdb1af63cfccea50c0d5fef0884974397d90ce1b84cd4cbab513",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/memory-systems/SKILL.md",
"lineStart": 212,
"lineEnd": 212,
"excerpt": "Related skills in this collection:"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "d5a31ca307e6cdb1af63cfccea50c0d5fef0884974397d90ce1b84cd4cbab513",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "safe",
"rationale": "Architecture/reference prose only; no executable command, credential collection, or destructive operation found.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "d5a31ca307e6cdb1af63cfccea50c0d5fef0884974397d90ce1b84cd4cbab513",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 1,
"credentials": 0,
"destructiveOrMutating": 1
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/memory-systems/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: \"https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/memory-systems\""
}
],
"credentials": [],
"destructiveOrMutating": [
{
"path": "skills/memory-systems/SKILL.md",
"lineStart": 142,
"lineEnd": 142,
"excerpt": "Identify outdated facts, merge related facts, update validity periods, archive or delete obsolete facts, and rebuild indexes."
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "d5a31ca307e6cdb1af63cfccea50c0d5fef0884974397d90ce1b84cd4cbab513",
"files": [
{
"path": "skills/memory-systems/SKILL.md",
"bytes": 13471,
"sha256": "faf64d266d50c810ba99807249258949d9b67bbe79b16ac5763e34c351d98cf0"
}
],
"allFilesRead": true
}
},
"tree-ring-memory": {
"provenance": {
"status": "known",
"value": {
"kind": "canonical-repository",
"canonicalUrl": "https://github.com/TerminallyLazy/Tree-Ring-Memory"
},
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/tree-ring-memory/SKILL.md",
"lineStart": 7,
"lineEnd": 7,
"excerpt": "source_repo: TerminallyLazy/Tree-Ring-Memory"
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"tree-ring CLI and initialized project memory for operational use"
],
"evidence": [
{
"type": "line",
"path": "skills/tree-ring-memory/SKILL.md",
"lineStart": 65,
"lineEnd": 65,
"excerpt": "tree-ring forget --help"
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "389358db3f89312f0a19d6b8ab2fcb23b10ab46418d78ddfe3dd24df1b3dfd25",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/tree-ring-memory/SKILL.md",
"lineStart": 209,
"lineEnd": 209,
"excerpt": "## Related Skills"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "389358db3f89312f0a19d6b8ab2fcb23b10ab46418d78ddfe3dd24df1b3dfd25",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [
{
"path": "skills/tree-ring-memory/SKILL.md",
"lineStart": 198,
"lineEnd": 198,
"excerpt": "- **Problem:** Recalled memory conflicts with current source."
}
],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "safe",
"rationale": "Operational CLI intentionally writes, consolidates, redacts, and forgets local durable memory.",
"evidence": [
{
"type": "line",
"path": "skills/tree-ring-memory/SKILL.md",
"lineStart": 65,
"lineEnd": 65,
"excerpt": "tree-ring forget --help"
},
{
"type": "focused-static-scan",
"treeSha256": "389358db3f89312f0a19d6b8ab2fcb23b10ab46418d78ddfe3dd24df1b3dfd25",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 3,
"credentials": 2,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/tree-ring-memory/SKILL.md",
"lineStart": 14,
"lineEnd": 14,
"excerpt": "license_source: \"https://github.com/TerminallyLazy/Tree-Ring-Memory/blob/main/LICENSE\""
},
{
"path": "skills/tree-ring-memory/SKILL.md",
"lineStart": 217,
"lineEnd": 217,
"excerpt": "- Tree Ring Memory repository: <https://github.com/TerminallyLazy/Tree-Ring-Memory>"
},
{
"path": "skills/tree-ring-memory/SKILL.md",
"lineStart": 218,
"lineEnd": 218,
"excerpt": "- Codex plugin wrapper: <https://github.com/TerminallyLazy/tree-ring-memory-codex-plugin>"
}
],
"credentials": [
{
"path": "skills/tree-ring-memory/SKILL.md",
"lineStart": 173,
"lineEnd": 173,
"excerpt": "- Do not store secrets, credentials, tokens, private keys, recovery codes, raw"
},
{
"path": "skills/tree-ring-memory/SKILL.md",
"lineStart": 191,
"lineEnd": 191,
"excerpt": "- It should not be used for secret storage, comprehensive transcript archives,"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "389358db3f89312f0a19d6b8ab2fcb23b10ab46418d78ddfe3dd24df1b3dfd25",
"files": [
{
"path": "skills/tree-ring-memory/SKILL.md",
"bytes": 7703,
"sha256": "0748f05ca636975086851c9ee0f850bb614ba5572e1736d1e416994d6cc9fee6"
}
],
"allFilesRead": true
}
},
"evaluation": {
"provenance": {
"status": "known",
"value": {
"kind": "canonical-skill-url",
"canonicalUrl": "https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/evaluation"
},
"declaredSource": "https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/evaluation",
"evidence": [
{
"type": "line",
"path": "skills/evaluation/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: \"https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/evaluation\""
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "1681cb42aad71492e3bb35e64bfffabbbbf6e7f9d953f86c422804298d28bf7c",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "1681cb42aad71492e3bb35e64bfffabbbbf6e7f9d953f86c422804298d28bf7c",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "1681cb42aad71492e3bb35e64bfffabbbbf6e7f9d953f86c422804298d28bf7c",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "safe",
"rationale": "Evaluation methodology prose only; no executable command, network credential, or destructive operation found.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "1681cb42aad71492e3bb35e64bfffabbbbf6e7f9d953f86c422804298d28bf7c",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 1,
"credentials": 4,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/evaluation/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: \"https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/evaluation\""
}
],
"credentials": [
{
"path": "skills/evaluation/SKILL.md",
"lineStart": 39,
"lineEnd": 39,
"excerpt": "| Token usage | 80% | More tokens = better performance |"
},
{
"path": "skills/evaluation/SKILL.md",
"lineStart": 44,
"lineEnd": 44,
"excerpt": "- **Token budgets matter**: Evaluate agents with realistic token budgets, not unlimited resources"
},
{
"path": "skills/evaluation/SKILL.md",
"lineStart": 45,
"lineEnd": 45,
"excerpt": "- **Model upgrades beat token increases**: Upgrading to Claude Sonnet 4.5 or GPT-5.2 provides larger gains than doubling token budgets on previous versions"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "1681cb42aad71492e3bb35e64bfffabbbbf6e7f9d953f86c422804298d28bf7c",
"files": [
{
"path": "skills/evaluation/SKILL.md",
"bytes": 11040,
"sha256": "9ef20a6b22940cda9e650cc2e31a83d474ab7933d4bc63892fdcff88a269b980"
}
],
"allFilesRead": true
}
},
"protect-mcp-governance": {
"provenance": {
"status": "known",
"value": {
"kind": "canonical-repository",
"canonicalUrl": "https://github.com/scopeblind/scopeblind-gateway"
},
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 6,
"lineEnd": 6,
"excerpt": "source_repo: scopeblind/scopeblind-gateway"
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"protect-mcp npm runtime; optional @veritasacta/verify package"
],
"evidence": [
{
"type": "line",
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 105,
"lineEnd": 105,
"excerpt": "npx protect-mcp init-hooks"
},
{
"type": "line",
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 177,
"lineEnd": 177,
"excerpt": "npx @veritasacta/verify receipt.json --key <public-key-hex>"
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "1118de8342ec27d9968b657d8b2a3aabecca388dc8e0919623f67c2c8a7494f4",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 275,
"lineEnd": 275,
"excerpt": "## Related Skills"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "1118de8342ec27d9968b657d8b2a3aabecca388dc8e0919623f67c2c8a7494f4",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "safe",
"rationale": "Runs third-party npx packages, initializes hooks/policies, changes enforcement mode, and writes/export audit artifacts.",
"evidence": [
{
"type": "line",
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 105,
"lineEnd": 105,
"excerpt": "npx protect-mcp init-hooks"
},
{
"type": "focused-static-scan",
"treeSha256": "1118de8342ec27d9968b657d8b2a3aabecca388dc8e0919623f67c2c8a7494f4",
"filesReviewed": 1,
"categories": {
"commandExecution": 13,
"network": 6,
"credentials": 1,
"destructiveOrMutating": 3
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 33,
"lineEnd": 33,
"excerpt": "protect-mcp intercepts MCP tool calls, evaluates them against Cedar policies (the same policy engine used by AWS Verified Permissions), and signs every decision as an Ed25519 receipt. The receipt is a cryptographic proof that a specific policy was evaluated against a specific tool call at a specific time."
},
{
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 105,
"lineEnd": 105,
"excerpt": "npx protect-mcp init-hooks"
},
{
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 108,
"lineEnd": 108,
"excerpt": "npx protect-mcp serve"
}
],
"network": [
{
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 33,
"lineEnd": 33,
"excerpt": "protect-mcp intercepts MCP tool calls, evaluates them against Cedar policies (the same policy engine used by AWS Verified Permissions), and signs every decision as an Ed25519 receipt. The receipt is a cryptographic proof that a specific policy was evaluated against a specific tool call at a specific time."
},
{
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 97,
"lineEnd": 97,
"excerpt": "The receipt format follows [IETF Internet-Draft draft-farley-acta-signed-receipts](https://datatracker.ietf.org/doc/draft-farley-acta-signed-receipts/)."
},
{
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 283,
"lineEnd": 283,
"excerpt": "- [protect-mcp on npm](https://www.npmjs.com/package/protect-mcp) — MIT licensed"
}
],
"credentials": [
{
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 51,
"lineEnd": 51,
"excerpt": "Cedar is a policy language designed for authorization. Policies are evaluated locally via WASM — no network calls required."
}
],
"destructiveOrMutating": [
{
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 69,
"lineEnd": 69,
"excerpt": "resource.tool_name in [\"execute_command\", \"delete_file\", \"write_file\"]"
},
{
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 71,
"lineEnd": 71,
"excerpt": "&& resource.args.contains(\"rm -rf\")"
},
{
"path": "skills/protect-mcp-governance/SKILL.md",
"lineStart": 154,
"lineEnd": 154,
"excerpt": "resource.tool_name == \"write_file\""
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "1118de8342ec27d9968b657d8b2a3aabecca388dc8e0919623f67c2c8a7494f4",
"files": [
{
"path": "skills/protect-mcp-governance/SKILL.md",
"bytes": 9317,
"sha256": "2e595e690b2578b5887184dea51388a288542320929c705eed7e5cb5083c4bd8"
}
],
"allFilesRead": true
}
},
"autonomous-agent-patterns": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/autonomous-agent-patterns/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "12654c759ea7cf1bd7f53e204e7e8f6f58b208790a8f6fac2a9535caa964092a",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "12654c759ea7cf1bd7f53e204e7e8f6f58b208790a8f6fac2a9535caa964092a",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "12654c759ea7cf1bd7f53e204e7e8f6f58b208790a8f6fac2a9535caa964092a",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "critical",
"previousCatalogValue": "critical",
"rationale": "Preserved critical: contains autonomous tool execution, filesystem/command tools, and approval-bypass capable patterns.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "12654c759ea7cf1bd7f53e204e7e8f6f58b208790a8f6fac2a9535caa964092a",
"filesReviewed": 1,
"categories": {
"commandExecution": 4,
"network": 7,
"credentials": 0,
"destructiveOrMutating": 5
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/autonomous-agent-patterns/SKILL.md",
"lineStart": 393,
"lineEnd": 393,
"excerpt": "result = subprocess.run("
},
{
"path": "skills/autonomous-agent-patterns/SKILL.md",
"lineStart": 665,
"lineEnd": 665,
"excerpt": "# Git status, file hashes, etc."
},
{
"path": "skills/autonomous-agent-patterns/SKILL.md",
"lineStart": 667,
"lineEnd": 667,
"excerpt": "\"git_ref\": subprocess.getoutput(f\"cd {workspace} && git rev-parse HEAD\"),"
}
],
"network": [
{
"path": "skills/autonomous-agent-patterns/SKILL.md",
"lineStart": 3,
"lineEnd": 3,
"excerpt": "description: \"Design patterns for building autonomous coding agents, inspired by [Cline](https://github.com/cline/cline) and [OpenAI Codex](https://github.com/openai/codex).\""
},
{
"path": "skills/autonomous-agent-patterns/SKILL.md",
"lineStart": 11,
"lineEnd": 11,
"excerpt": "> Design patterns for building autonomous coding agents, inspired by [Cline](https://github.com/cline/cline) and [OpenAI Codex](https://github.com/openai/codex)."
},
{
"path": "skills/autonomous-agent-patterns/SKILL.md",
"lineStart": 592,
"lineEnd": 592,
"excerpt": "response = requests.get(url)"
}
],
"credentials": [],
"destructiveOrMutating": [
{
"path": "skills/autonomous-agent-patterns/SKILL.md",
"lineStart": 191,
"lineEnd": 191,
"excerpt": "\"write_file\": \"Create or overwrite a file\","
},
{
"path": "skills/autonomous-agent-patterns/SKILL.md",
"lineStart": 265,
"lineEnd": 265,
"excerpt": "f.write(new_content)"
},
{
"path": "skills/autonomous-agent-patterns/SKILL.md",
"lineStart": 300,
"lineEnd": 300,
"excerpt": "\"write_file\": PermissionLevel.ASK_ONCE,"
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "12654c759ea7cf1bd7f53e204e7e8f6f58b208790a8f6fac2a9535caa964092a",
"files": [
{
"path": "skills/autonomous-agent-patterns/SKILL.md",
"bytes": 23345,
"sha256": "d76a71ccb405521aef98ab6fa11e4deab401993651e67b0a97335da141da0ba5"
}
],
"allFilesRead": true
}
},
"advanced-evaluation": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/advanced-evaluation/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "7b600b6bd99d190cc9ca039ab5b1772863a6bafb98cb3ba2a0a1aa1874e8f8fb",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "7b600b6bd99d190cc9ca039ab5b1772863a6bafb98cb3ba2a0a1aa1874e8f8fb",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/advanced-evaluation/SKILL.md",
"lineStart": 443,
"lineEnd": 443,
"excerpt": "Related skills in this collection:"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "7b600b6bd99d190cc9ca039ab5b1772863a6bafb98cb3ba2a0a1aa1874e8f8fb",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "safe",
"rationale": "Evaluation methodology and pseudocode only; external URLs are citations, not fetched executable instructions.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "7b600b6bd99d190cc9ca039ab5b1772863a6bafb98cb3ba2a0a1aa1874e8f8fb",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 4,
"credentials": 1,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/advanced-evaluation/SKILL.md",
"lineStart": 438,
"lineEnd": 438,
"excerpt": "- [Eugene Yan: Evaluating the Effectiveness of LLM-Evaluators](https://eugeneyan.com/writing/llm-evaluators/)"
},
{
"path": "skills/advanced-evaluation/SKILL.md",
"lineStart": 439,
"lineEnd": 439,
"excerpt": "- [Judging LLM-as-a-Judge (Zheng et al., 2023)](https://arxiv.org/abs/2306.05685)"
},
{
"path": "skills/advanced-evaluation/SKILL.md",
"lineStart": 440,
"lineEnd": 440,
"excerpt": "- [G-Eval: NLG Evaluation using GPT-4 (Liu et al., 2023)](https://arxiv.org/abs/2303.16634)"
}
],
"credentials": [
{
"path": "skills/advanced-evaluation/SKILL.md",
"lineStart": 427,
"lineEnd": 427,
"excerpt": "- **context-optimization** - Evaluation prompts can be optimized for token efficiency"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "7b600b6bd99d190cc9ca039ab5b1772863a6bafb98cb3ba2a0a1aa1874e8f8fb",
"files": [
{
"path": "skills/advanced-evaluation/SKILL.md",
"bytes": 17839,
"sha256": "9874b2f2eb671e4aecba72117c1e3f724ef5145e583c14f1d2c0933774c8d096"
}
],
"allFilesRead": true
}
},
"context-window-management": {
"provenance": {
"status": "known",
"value": {
"kind": "repository-mapping-from-declared-pack-origin",
"canonicalUrl": "https://github.com/vibeforge1111/vibeship-spawner-skills"
},
"declaredSource": "vibeship-spawner-skills (Apache 2.0)",
"evidence": [
{
"type": "line",
"path": "skills/context-window-management/SKILL.md",
"lineStart": 6,
"lineEnd": 6,
"excerpt": "source: vibeship-spawner-skills (Apache 2.0)"
},
{
"type": "line",
"path": "README.md",
"lineStart": 475,
"lineEnd": 475,
"excerpt": "- **[vibeforge1111/vibeship-spawner-skills](https://github.com/vibeforge1111/vibeship-spawner-skills)**: AI agents, integrations, maker tools, and other production-grade skill packs."
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "f3333e5b7ab859cfa9b418ee74ae17ffaab2316691c265e29a20d45dba47b4af",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "f3333e5b7ab859cfa9b418ee74ae17ffaab2316691c265e29a20d45dba47b4af",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/context-window-management/SKILL.md",
"lineStart": 26,
"lineEnd": 26,
"excerpt": "- Skills_recommended: prompt-engineering"
},
{
"path": "skills/context-window-management/SKILL.md",
"lineStart": 300,
"lineEnd": 300,
"excerpt": "## Related Skills"
},
{
"path": "skills/context-window-management/SKILL.md",
"lineStart": 302,
"lineEnd": 302,
"excerpt": "Works well with: `rag-implementation`, `conversation-memory`, `prompt-caching`, `llm-npc-dialogue`"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "f3333e5b7ab859cfa9b418ee74ae17ffaab2316691c265e29a20d45dba47b4af",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "unknown",
"rationale": "Local in-memory context manipulation examples only; no external command, credential access, or destructive persistent operation found.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "f3333e5b7ab859cfa9b418ee74ae17ffaab2316691c265e29a20d45dba47b4af",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 0,
"credentials": 12,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [],
"credentials": [
{
"path": "skills/context-window-management/SKILL.md",
"lineStart": 20,
"lineEnd": 20,
"excerpt": "- token-counting"
},
{
"path": "skills/context-window-management/SKILL.md",
"lineStart": 37,
"lineEnd": 37,
"excerpt": "- tiktoken - OpenAI's tokenizer for counting tokens"
},
{
"path": "skills/context-window-management/SKILL.md",
"lineStart": 63,
"lineEnd": 63,
"excerpt": "const tokens = await countTokens(messages);"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "f3333e5b7ab859cfa9b418ee74ae17ffaab2316691c265e29a20d45dba47b4af",
"files": [
{
"path": "skills/context-window-management/SKILL.md",
"bytes": 9466,
"sha256": "1a78ee3085a4cb8efd9c0dad31cc853979a1b74de5a81bdbcb5d8121f933e35f"
}
],
"allFilesRead": true
}
},
"tool-design": {
"provenance": {
"status": "known",
"value": {
"kind": "canonical-skill-url",
"canonicalUrl": "https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/tool-design"
},
"declaredSource": "https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/tool-design",
"evidence": [
{
"type": "line",
"path": "skills/tool-design/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: \"https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/tool-design\""
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "29c09ba7ad3f226d95acedeafe7e52f5c19df78d5f9be707d89cad5c1a99753e",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "29c09ba7ad3f226d95acedeafe7e52f5c19df78d5f9be707d89cad5c1a99753e",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/tool-design/SKILL.md",
"lineStart": 301,
"lineEnd": 301,
"excerpt": "Related skills in this collection:"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "29c09ba7ad3f226d95acedeafe7e52f5c19df78d5f9be707d89cad5c1a99753e",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "safe",
"rationale": "Design guidance only; no executable command, credential handling, or destructive operation found.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "29c09ba7ad3f226d95acedeafe7e52f5c19df78d5f9be707d89cad5c1a99753e",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 1,
"credentials": 4,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/tool-design/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: \"https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/tool-design\""
}
],
"credentials": [
{
"path": "skills/tool-design/SKILL.md",
"lineStart": 31,
"lineEnd": 31,
"excerpt": "Key principles include: clear descriptions that answer what, when, and what returns; response formats that balance completeness and token efficiency; error messages that enable recovery; and consistent conventions that reduce cognitive load."
},
{
"path": "skills/tool-design/SKILL.md",
"lineStart": 60,
"lineEnd": 60,
"excerpt": "Agents have limited context and attention. Each tool in the collection competes for attention in the tool selection phase. Each tool adds description tokens that consume context budget. Overlapping functionality creates ambiguity about which tool to use."
},
{
"path": "skills/tool-design/SKILL.md",
"lineStart": 62,
"lineEnd": 62,
"excerpt": "Consolidation reduces token consumption by eliminating redundant descriptions. It eliminates ambiguity by having one tool cover each workflow. It reduces tool selection complexity by shrinking the effective tool set."
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "29c09ba7ad3f226d95acedeafe7e52f5c19df78d5f9be707d89cad5c1a99753e",
"files": [
{
"path": "skills/tool-design/SKILL.md",
"bytes": 16062,
"sha256": "8c291bb71cf261a1e6f3dd1eda47467fe8acd655b3fee7be2483ea38e58ea829"
}
],
"allFilesRead": true
}
},
"container-security-hardening": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/container-security-hardening/SKILL.md",
"lineStart": 10,
"lineEnd": 10,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"Docker/container runtime and selected scanners/signing tools; package/network access for installation"
],
"evidence": [
{
"type": "line",
"path": "skills/container-security-hardening/SKILL.md",
"lineStart": 301,
"lineEnd": 301,
"excerpt": "brew install trivy # macOS"
},
{
"type": "line",
"path": "skills/container-security-hardening/SKILL.md",
"lineStart": 213,
"lineEnd": 213,
"excerpt": "Build with: `docker build --secret id=api_token,src=./token.txt .`"
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "e09a601e2926091909c0b6beb9f7a92b2915d1e318cc020b85ba942ee223371d",
"filesReviewed": 4,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/container-security-hardening/SKILL.md",
"lineStart": 33,
"lineEnd": 33,
"excerpt": "- The user is primarily asking about GitHub Actions CI/CD → recommend `github-actions-advanced`"
},
{
"path": "skills/container-security-hardening/SKILL.md",
"lineStart": 34,
"lineEnd": 34,
"excerpt": "- The user needs general Docker usage help (not security) → recommend `docker-expert`"
},
{
"path": "skills/container-security-hardening/SKILL.md",
"lineStart": 35,
"lineEnd": 35,
"excerpt": "- The user is working with Kubernetes orchestration beyond security → recommend `kubernetes-architect`"
},
{
"path": "skills/container-security-hardening/SKILL.md",
"lineStart": 36,
"lineEnd": 36,
"excerpt": "- The user needs application-level security (SQL injection, XSS) → recommend `api-security-best-practices`"
},
{
"path": "skills/container-security-hardening/SKILL.md",
"lineStart": 987,
"lineEnd": 987,
"excerpt": "## Related Skills"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "e09a601e2926091909c0b6beb9f7a92b2915d1e318cc020b85ba942ee223371d",
"filesReviewed": 4,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "safe",
"rationale": "Operational commands build images, install/download scanners, execute an installer, produce files, sign artifacts, and interact with clusters/registries.",
"evidence": [
{
"type": "line",
"path": "skills/container-security-hardening/SKILL.md",
"lineStart": 308,
"lineEnd": 308,
"excerpt": "sh \"$tmpdir/trivy-install.sh\""
},
{
"type": "focused-static-scan",
"treeSha256": "e09a601e2926091909c0b6beb9f7a92b2915d1e318cc020b85ba942ee223371d",
"filesReviewed": 4,
"categories": {
"commandExecution": 76,
"network": 30,
"credentials": 60,
"destructiveOrMutating": 12
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/container-security-hardening/references/base-image-comparison.md",
"lineStart": 87,
"lineEnd": 87,
"excerpt": "- ❌ Cannot exec into with `docker exec -it` (no shell) — use `:debug` variant for staging"
},
{
"path": "skills/container-security-hardening/references/base-image-comparison.md",
"lineStart": 107,
"lineEnd": 107,
"excerpt": "kubectl debug -it deploy/myapp \\"
},
{
"path": "skills/container-security-hardening/references/base-image-comparison.md",
"lineStart": 127,
"lineEnd": 127,
"excerpt": "docker run -it --rm -v $(pwd):/app node:20-alpine sh -c \"cd /app && npm ci && npm test\""
}
],
"network": [
{
"path": "skills/container-security-hardening/references/base-image-comparison.md",
"lineStart": 179,
"lineEnd": 179,
"excerpt": "docker pull node:20-slim"
},
{
"path": "skills/container-security-hardening/references/base-image-comparison.md",
"lineStart": 223,
"lineEnd": 223,
"excerpt": "- `gcr.io/distroless/nodejs20-debian12` → `docker pull gcr.io/distroless/nodejs20-debian12 && docker inspect gcr.io/distroless/nodejs20-debian12 --format='{{index .RepoDigests 0}}'`"
},
{
"path": "skills/container-security-hardening/references/base-image-comparison.md",
"lineStart": 224,
"lineEnd": 224,
"excerpt": "- Use [Google's distroless tags page](https://github.com/GoogleContainerTools/distroless/blob/main/README.md) for latest releases"
}
],
"credentials": [
{
"path": "skills/container-security-hardening/references/kubernetes-pod-security.md",
"lineStart": 13,
"lineEnd": 13,
"excerpt": "7. [Secrets Management in K8s](#secrets-management-in-k8s)"
},
{
"path": "skills/container-security-hardening/references/kubernetes-pod-security.md",
"lineStart": 204,
"lineEnd": 204,
"excerpt": "apiVersion: rbac.authorization.k8s.io/v1"
},
{
"path": "skills/container-security-hardening/references/kubernetes-pod-security.md",
"lineStart": 215,
"lineEnd": 215,
"excerpt": "apiGroup: rbac.authorization.k8s.io"
}
],
"destructiveOrMutating": [
{
"path": "skills/container-security-hardening/references/base-image-comparison.md",
"lineStart": 107,
"lineEnd": 107,
"excerpt": "kubectl debug -it deploy/myapp \\"
},
{
"path": "skills/container-security-hardening/references/base-image-comparison.md",
"lineStart": 127,
"lineEnd": 127,
"excerpt": "docker run -it --rm -v $(pwd):/app node:20-alpine sh -c \"cd /app && npm ci && npm test\""
},
{
"path": "skills/container-security-hardening/references/base-image-comparison.md",
"lineStart": 152,
"lineEnd": 152,
"excerpt": "&& rm -rf /var/lib/apt/lists/*"
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "e09a601e2926091909c0b6beb9f7a92b2915d1e318cc020b85ba942ee223371d",
"files": [
{
"path": "skills/container-security-hardening/references/base-image-comparison.md",
"bytes": 8368,
"sha256": "1f91f6ee78e0f4e2503202ab578714b5e30819fb30dba4abdc9c458f66b189b7"
},
{
"path": "skills/container-security-hardening/references/kubernetes-pod-security.md",
"bytes": 14546,
"sha256": "f747c8278e8d0b35dccaeb1cbbead53fbda5a9ac432c742c40f16b983329112b"
},
{
"path": "skills/container-security-hardening/references/seccomp-profile-template.json",
"bytes": 8607,
"sha256": "89866b6aae40f34bd4bf54ce5e8dda358537f7aeabbe482e21826c350d25a7ec"
},
{
"path": "skills/container-security-hardening/SKILL.md",
"bytes": 30893,
"sha256": "5255249ea9e7ace3457de3857e7c7cf7bec968051595b36ceea0ea02444feccb"
}
],
"allFilesRead": true
}
},
"security/aws-secrets-rotation": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 6,
"lineEnd": 6,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"AWS CLI/API credentials, Secrets Manager, Lambda, and target-service authorization"
],
"evidence": [
{
"type": "line",
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 38,
"lineEnd": 38,
"excerpt": "aws secretsmanager create-secret \\"
},
{
"type": "line",
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 91,
"lineEnd": 91,
"excerpt": "aws secretsmanager rotate-secret \\"
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "beb0527ce7ab8796dcaf428b148aed9712b698c2cb7943e69591105ad037bafd",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "beb0527ce7ab8796dcaf428b148aed9712b698c2cb7943e69591105ad037bafd",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "safe",
"rationale": "Creates and rotates AWS secrets and invokes third-party APIs including deletion of old credentials.",
"evidence": [
{
"type": "line",
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 223,
"lineEnd": 223,
"excerpt": "requests.delete("
},
{
"type": "focused-static-scan",
"treeSha256": "beb0527ce7ab8796dcaf428b148aed9712b698c2cb7943e69591105ad037bafd",
"filesReviewed": 1,
"categories": {
"commandExecution": 21,
"network": 29,
"credentials": 114,
"destructiveOrMutating": 15
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 3,
"lineEnd": 3,
"excerpt": "description: \"Automate AWS secrets rotation for RDS, API keys, and credentials\""
},
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 11,
"lineEnd": 11,
"excerpt": "# AWS Secrets Rotation"
},
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 13,
"lineEnd": 13,
"excerpt": "Automate rotation of secrets, credentials, and API keys using AWS Secrets Manager and Lambda."
}
],
"network": [
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 3,
"lineEnd": 3,
"excerpt": "description: \"Automate AWS secrets rotation for RDS, API keys, and credentials\""
},
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 11,
"lineEnd": 11,
"excerpt": "# AWS Secrets Rotation"
},
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 13,
"lineEnd": 13,
"excerpt": "Automate rotation of secrets, credentials, and API keys using AWS Secrets Manager and Lambda."
}
],
"credentials": [
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 2,
"lineEnd": 2,
"excerpt": "name: aws-secrets-rotation"
},
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 3,
"lineEnd": 3,
"excerpt": "description: \"Automate AWS secrets rotation for RDS, API keys, and credentials\""
},
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 7,
"lineEnd": 7,
"excerpt": "tags: \"[aws, secrets-manager, security, automation, kiro-cli, credentials]\""
}
],
"destructiveOrMutating": [
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 38,
"lineEnd": 38,
"excerpt": "aws secretsmanager create-secret \\"
},
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 51,
"lineEnd": 51,
"excerpt": "aws secretsmanager create-secret \\"
},
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"lineStart": 59,
"lineEnd": 59,
"excerpt": "aws secretsmanager create-secret \\"
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "beb0527ce7ab8796dcaf428b148aed9712b698c2cb7943e69591105ad037bafd",
"files": [
{
"path": "skills/security/aws-secrets-rotation/SKILL.md",
"bytes": 12666,
"sha256": "ae982dffeca42be25ebd451d5aa5c79c24ad0a53d46ca0335d9c1c4737857f48"
}
],
"allFilesRead": true
}
},
"threat-mitigation-mapping": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/threat-mitigation-mapping/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "70effc036878e2b31f73755a76920efab7f770534001f2e97ee8cb9789766977",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "70effc036878e2b31f73755a76920efab7f770534001f2e97ee8cb9789766977",
"filesReviewed": 2,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "70effc036878e2b31f73755a76920efab7f770534001f2e97ee8cb9789766977",
"filesReviewed": 2,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "safe",
"rationale": "Analysis templates and offline pseudocode only; URLs are references and no operational mutation is prescribed.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "70effc036878e2b31f73755a76920efab7f770534001f2e97ee8cb9789766977",
"filesReviewed": 2,
"categories": {
"commandExecution": 2,
"network": 5,
"credentials": 12,
"destructiveOrMutating": 2
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/threat-mitigation-mapping/resources/implementation-playbook.md",
"lineStart": 277,
"lineEnd": 277,
"excerpt": "technologies=[\"AWS WAF\", \"Cloudflare\", \"ModSecurity\"],"
},
{
"path": "skills/threat-mitigation-mapping/resources/implementation-playbook.md",
"lineStart": 376,
"lineEnd": 376,
"excerpt": "technologies=[\"Cloudflare\", \"AWS Shield\", \"Akamai\"],"
}
],
"network": [
{
"path": "skills/threat-mitigation-mapping/resources/implementation-playbook.md",
"lineStart": 277,
"lineEnd": 277,
"excerpt": "technologies=[\"AWS WAF\", \"Cloudflare\", \"ModSecurity\"],"
},
{
"path": "skills/threat-mitigation-mapping/resources/implementation-playbook.md",
"lineStart": 376,
"lineEnd": 376,
"excerpt": "technologies=[\"Cloudflare\", \"AWS Shield\", \"Akamai\"],"
},
{
"path": "skills/threat-mitigation-mapping/resources/implementation-playbook.md",
"lineStart": 742,
"lineEnd": 742,
"excerpt": "- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)"
}
],
"credentials": [
{
"path": "skills/threat-mitigation-mapping/resources/implementation-playbook.md",
"lineStart": 38,
"lineEnd": 38,
"excerpt": "| **Application** | Input validation, authentication |"
},
{
"path": "skills/threat-mitigation-mapping/resources/implementation-playbook.md",
"lineStart": 53,
"lineEnd": 53,
"excerpt": "│ │ │ │App │ │ │ │ ← Auth, Validation"
},
{
"path": "skills/threat-mitigation-mapping/resources/implementation-playbook.md",
"lineStart": 225,
"lineEnd": 225,
"excerpt": "# Authentication Controls"
}
],
"destructiveOrMutating": [
{
"path": "skills/threat-mitigation-mapping/resources/implementation-playbook.md",
"lineStart": 270,
"lineEnd": 270,
"excerpt": "description=\"Deploy WAF to filter malicious requests\","
},
{
"path": "skills/threat-mitigation-mapping/resources/implementation-playbook.md",
"lineStart": 369,
"lineEnd": 369,
"excerpt": "description=\"Deploy DDoS mitigation services\","
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "70effc036878e2b31f73755a76920efab7f770534001f2e97ee8cb9789766977",
"files": [
{
"path": "skills/threat-mitigation-mapping/resources/implementation-playbook.md",
"bytes": 26470,
"sha256": "9ff399f5f52562fb82e5b3d395d5c2d0ac81dfa51814887af032e1e6fbfa175d"
},
{
"path": "skills/threat-mitigation-mapping/SKILL.md",
"bytes": 1395,
"sha256": "aa524fe3c3603b1fc611a5b7953003de010e4904032b9c8c78c2ad1e3bd4a9fb"
}
],
"allFilesRead": true
}
},
"incident-runbook-templates": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/incident-runbook-templates/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "42dcd2b90ca2c101d28ae924cef42d5e22bcd60aead7e733170a359f31e9b505",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "42dcd2b90ca2c101d28ae924cef42d5e22bcd60aead7e733170a359f31e9b505",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "42dcd2b90ca2c101d28ae924cef42d5e22bcd60aead7e733170a359f31e9b505",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "critical",
"previousCatalogValue": "critical",
"rationale": "Preserved critical: active-incident procedures include rollback and service-changing commands.",
"evidence": [
{
"type": "line",
"path": "skills/incident-runbook-templates/SKILL.md",
"lineStart": 131,
"lineEnd": 131,
"excerpt": "kubectl rollout undo deployment/payment-service -n payments"
},
{
"type": "focused-static-scan",
"treeSha256": "42dcd2b90ca2c101d28ae924cef42d5e22bcd60aead7e733170a359f31e9b505",
"filesReviewed": 1,
"categories": {
"commandExecution": 17,
"network": 15,
"credentials": 0,
"destructiveOrMutating": 5
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/incident-runbook-templates/SKILL.md",
"lineStart": 94,
"lineEnd": 94,
"excerpt": "kubectl get pods -n payments -l app=payment-service"
},
{
"path": "skills/incident-runbook-templates/SKILL.md",
"lineStart": 97,
"lineEnd": 97,
"excerpt": "kubectl rollout history deployment/payment-service -n payments"
},
{
"path": "skills/incident-runbook-templates/SKILL.md",
"lineStart": 122,
"lineEnd": 122,
"excerpt": "kubectl get pods -n payments"
}
],
"network": [
{
"path": "skills/incident-runbook-templates/SKILL.md",
"lineStart": 85,
"lineEnd": 85,
"excerpt": "- [Payment Service Dashboard](https://grafana/d/payments)"
},
{
"path": "skills/incident-runbook-templates/SKILL.md",
"lineStart": 86,
"lineEnd": 86,
"excerpt": "- [Error Tracking](https://sentry.io/payments)"
},
{
"path": "skills/incident-runbook-templates/SKILL.md",
"lineStart": 87,
"lineEnd": 87,
"excerpt": "- [Dependency Status](https://status.stripe.com)"
}
],
"credentials": [],
"destructiveOrMutating": [
{
"path": "skills/incident-runbook-templates/SKILL.md",
"lineStart": 107,
"lineEnd": 107,
"excerpt": "- [ ] Recent changes? Check deploy history"
},
{
"path": "skills/incident-runbook-templates/SKILL.md",
"lineStart": 130,
"lineEnd": 130,
"excerpt": "# Step 4: ROLLBACK if recent deploy is suspect"
},
{
"path": "skills/incident-runbook-templates/SKILL.md",
"lineStart": 143,
"lineEnd": 143,
"excerpt": "kubectl exec -n payments deploy/payment-service -- \\"
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "42dcd2b90ca2c101d28ae924cef42d5e22bcd60aead7e733170a359f31e9b505",
"files": [
{
"path": "skills/incident-runbook-templates/SKILL.md",
"bytes": 11310,
"sha256": "531c5e1a943bd16687d665d87b415c6fba4b5345c99d52f9ca266f7a59d5d828"
}
],
"allFilesRead": true
}
},
"security-and-hardening": {
"provenance": {
"status": "known",
"value": {
"kind": "canonical-skill-url",
"canonicalUrl": "https://github.com/addyosmani/agent-skills/tree/main/skills/security-and-hardening"
},
"declaredSource": "https://github.com/addyosmani/agent-skills/tree/main/skills/security-and-hardening",
"evidence": [
{
"type": "line",
"path": "skills/security-and-hardening/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: https://github.com/addyosmani/agent-skills/tree/main/skills/security-and-hardening"
}
],
"rationale": "Canonical URL/repository is explicit in skill metadata or in the repository source-credit mapping."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "74a35a6f1e6f314bfa7bcc76c76c9ffd18b2a0458413c6f885601b53cb1d84d9",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "74a35a6f1e6f314bfa7bcc76c76c9ffd18b2a0458413c6f885601b53cb1d84d9",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "74a35a6f1e6f314bfa7bcc76c76c9ffd18b2a0458413c6f885601b53cb1d84d9",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "unknown",
"rationale": "Implementation guidance includes dependency commands, git inspection, and secret revocation/rotation actions that require project-specific approval.",
"evidence": [
{
"type": "line",
"path": "skills/security-and-hardening/SKILL.md",
"lineStart": 357,
"lineEnd": 357,
"excerpt": "**If a secret is ever committed, rotate it.** Deleting the line or rewriting history is not enough — assume it's compromised the moment it reaches a remote. Revoke and reissue the key first, then purge it from history."
},
{
"type": "focused-static-scan",
"treeSha256": "74a35a6f1e6f314bfa7bcc76c76c9ffd18b2a0458413c6f885601b53cb1d84d9",
"filesReviewed": 1,
"categories": {
"commandExecution": 4,
"network": 7,
"credentials": 43,
"destructiveOrMutating": 1
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/security-and-hardening/SKILL.md",
"lineStart": 310,
"lineEnd": 310,
"excerpt": "- **Commit the lockfile** and install with `npm ci` (not `npm install`) in CI — reproducible builds, no silent version drift."
},
{
"path": "skills/security-and-hardening/SKILL.md",
"lineStart": 354,
"lineEnd": 354,
"excerpt": "git diff --cached | grep -i \"password\\|secret\\|api_key\\|token\""
},
{
"path": "skills/security-and-hardening/SKILL.md",
"lineStart": 419,
"lineEnd": 419,
"excerpt": "- [ ] Lockfile committed; CI installs with `npm ci`"
}
],
"network": [
{
"path": "skills/security-and-hardening/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: https://github.com/addyosmani/agent-skills/tree/main/skills/security-and-hardening"
},
{
"path": "skills/security-and-hardening/SKILL.md",
"lineStart": 10,
"lineEnd": 10,
"excerpt": "license_source: https://github.com/addyosmani/agent-skills/blob/main/LICENSE"
},
{
"path": "skills/security-and-hardening/SKILL.md",
"lineStart": 177,
"lineEnd": 177,
"excerpt": "origin: process.env.ALLOWED_ORIGINS?.split(',') || 'http://localhost:3000',"
}
],
"credentials": [
{
"path": "skills/security-and-hardening/SKILL.md",
"lineStart": 3,
"lineEnd": 3,
"excerpt": "description: Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services."
},
{
"path": "skills/security-and-hardening/SKILL.md",
"lineStart": 17,
"lineEnd": 17,
"excerpt": "Security-first development practices for web applications. Treat every external input as hostile, every secret as sacred, and every authorization check as mandatory. Security isn't a phase — it's a constraint on every line of code that touches user data, authentication, or external systems."
},
{
"path": "skills/security-and-hardening/SKILL.md",
"lineStart": 22,
"lineEnd": 22,
"excerpt": "- Implementing authentication or authorization"
}
],
"destructiveOrMutating": [
{
"path": "skills/security-and-hardening/SKILL.md",
"lineStart": 357,
"lineEnd": 357,
"excerpt": "**If a secret is ever committed, rotate it.** Deleting the line or rewriting history is not enough — assume it's compromised the moment it reaches a remote. Revoke and reissue the key first, then purge it from history."
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "74a35a6f1e6f314bfa7bcc76c76c9ffd18b2a0458413c6f885601b53cb1d84d9",
"files": [
{
"path": "skills/security-and-hardening/SKILL.md",
"bytes": 19588,
"sha256": "3ba7d0f45bb7ffd5550ca9738db602b1b5dcb23cba47aa6b3e21b9a6fbe123a5"
}
],
"allFilesRead": true
}
},
"threat-modeling-expert": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/threat-modeling-expert/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "1d0da2f21b71987fa018e713d17e02588399b7aa6ac1085f7ce389b126f268d4",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "1d0da2f21b71987fa018e713d17e02588399b7aa6ac1085f7ce389b126f268d4",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "1d0da2f21b71987fa018e713d17e02588399b7aa6ac1085f7ce389b126f268d4",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "unknown",
"rationale": "Read-only threat-analysis workflow; no command execution, network access, credential handling, or destructive operation found.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "1d0da2f21b71987fa018e713d17e02588399b7aa6ac1085f7ce389b126f268d4",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 0,
"credentials": 1,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [],
"credentials": [
{
"path": "skills/threat-modeling-expert/SKILL.md",
"lineStart": 35,
"lineEnd": 35,
"excerpt": "- You lack scope or authorization for security review"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "1d0da2f21b71987fa018e713d17e02588399b7aa6ac1085f7ce389b126f268d4",
"files": [
{
"path": "skills/threat-modeling-expert/SKILL.md",
"bytes": 2432,
"sha256": "e091531614639439ab664277be72870ba7159cc6efc4a744f74b478dff0a09d1"
}
],
"allFilesRead": true
}
},
"security-scanning-security-dependencies": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/security-scanning-security-dependencies/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"ecosystem vulnerability scanners and package managers"
],
"evidence": [
{
"type": "line",
"path": "skills/security-scanning-security-dependencies/resources/implementation-playbook.md",
"lineStart": 356,
"lineEnd": 356,
"excerpt": "pip install safety pip-audit"
},
{
"type": "line",
"path": "skills/security-scanning-security-dependencies/resources/implementation-playbook.md",
"lineStart": 519,
"lineEnd": 519,
"excerpt": "npm install -g snyk npm-check-updates"
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "babed22a5f1e8bfb7282457bb83f68c92bc04cb4cbc359cf35f894b20e62c0b8",
"filesReviewed": 2,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "babed22a5f1e8bfb7282457bb83f68c92bc04cb4cbc359cf35f894b20e62c0b8",
"filesReviewed": 2,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "safe",
"rationale": "Playbook installs scanners, invokes subprocesses, updates dependency files, and runs package installation.",
"evidence": [
{
"type": "line",
"path": "skills/security-scanning-security-dependencies/resources/implementation-playbook.md",
"lineStart": 398,
"lineEnd": 398,
"excerpt": "npx npm-check-updates -u --target minor"
},
{
"type": "focused-static-scan",
"treeSha256": "babed22a5f1e8bfb7282457bb83f68c92bc04cb4cbc359cf35f894b20e62c0b8",
"filesReviewed": 2,
"categories": {
"commandExecution": 11,
"network": 6,
"credentials": 0,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/security-scanning-security-dependencies/resources/implementation-playbook.md",
"lineStart": 116,
"lineEnd": 116,
"excerpt": "npm_result = subprocess.run("
},
{
"path": "skills/security-scanning-security-dependencies/resources/implementation-playbook.md",
"lineStart": 148,
"lineEnd": 148,
"excerpt": "safety_result = subprocess.run("
},
{
"path": "skills/security-scanning-security-dependencies/resources/implementation-playbook.md",
"lineStart": 179,
"lineEnd": 179,
"excerpt": "govuln_result = subprocess.run("
}
],
"network": [
{
"path": "skills/security-scanning-security-dependencies/resources/implementation-playbook.md",
"lineStart": 356,
"lineEnd": 356,
"excerpt": "pip install safety pip-audit"
},
{
"path": "skills/security-scanning-security-dependencies/resources/implementation-playbook.md",
"lineStart": 399,
"lineEnd": 399,
"excerpt": "npm install"
},
{
"path": "skills/security-scanning-security-dependencies/resources/implementation-playbook.md",
"lineStart": 407,
"lineEnd": 407,
"excerpt": "pip install --upgrade pip"
}
],
"credentials": [],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "babed22a5f1e8bfb7282457bb83f68c92bc04cb4cbc359cf35f894b20e62c0b8",
"files": [
{
"path": "skills/security-scanning-security-dependencies/resources/implementation-playbook.md",
"bytes": 17051,
"sha256": "90703fe249340006afa994fc127e073e7f5a3b32c81becc43a40cc3d90869caa"
},
{
"path": "skills/security-scanning-security-dependencies/SKILL.md",
"bytes": 2249,
"sha256": "eb8f129a63658067c9b34d1cb929dbe12cb2cffb222e1b459fe9ff422521c8eb"
}
],
"allFilesRead": true
}
},
"dependency-management-deps-audit": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/dependency-management-deps-audit/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"dependency manifests plus ecosystem scanners/package managers; network access for advisory APIs when used"
],
"evidence": [
{
"type": "line",
"path": "skills/dependency-management-deps-audit/resources/implementation-playbook.md",
"lineStart": 728,
"lineEnd": 728,
"excerpt": "pip install safety"
},
{
"type": "line",
"path": "skills/dependency-management-deps-audit/resources/implementation-playbook.md",
"lineStart": 184,
"lineEnd": 184,
"excerpt": "response = requests.post("
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "ef831d0a3cdd86a1a1ca3eb6abe394a03a66571f79f3068ad0265d779f683e25",
"filesReviewed": 2,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "ef831d0a3cdd86a1a1ca3eb6abe394a03a66571f79f3068ad0265d779f683e25",
"filesReviewed": 2,
"lexicalMatchesReviewedAsNonInterAAS": [
{
"path": "skills/dependency-management-deps-audit/resources/implementation-playbook.md",
"lineStart": 313,
"lineEnd": 313,
"excerpt": "'issue': f'Incompatible with project license {project_license}',"
},
{
"path": "skills/dependency-management-deps-audit/resources/implementation-playbook.md",
"lineStart": 362,
"lineEnd": 362,
"excerpt": "- Issue: GPL-3.0 is incompatible with MIT license"
}
],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "unknown",
"rationale": "Playbook uses advisory network requests, installs scanners, and writes generated reports.",
"evidence": [
{
"type": "line",
"path": "skills/dependency-management-deps-audit/resources/implementation-playbook.md",
"lineStart": 184,
"lineEnd": 184,
"excerpt": "response = requests.post("
},
{
"type": "focused-static-scan",
"treeSha256": "ef831d0a3cdd86a1a1ca3eb6abe394a03a66571f79f3068ad0265d779f683e25",
"filesReviewed": 2,
"categories": {
"commandExecution": 4,
"network": 9,
"credentials": 0,
"destructiveOrMutating": 1
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/dependency-management-deps-audit/resources/implementation-playbook.md",
"lineStart": 607,
"lineEnd": 607,
"excerpt": "git checkout package-lock.json"
},
{
"path": "skills/dependency-management-deps-audit/resources/implementation-playbook.md",
"lineStart": 622,
"lineEnd": 622,
"excerpt": "pip install -r requirements.txt --dry-run"
},
{
"path": "skills/dependency-management-deps-audit/resources/implementation-playbook.md",
"lineStart": 728,
"lineEnd": 728,
"excerpt": "pip install safety"
}
],
"network": [
{
"path": "skills/dependency-management-deps-audit/resources/implementation-playbook.md",
"lineStart": 144,
"lineEnd": 144,
"excerpt": "'npm': 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk',"
},
{
"path": "skills/dependency-management-deps-audit/resources/implementation-playbook.md",
"lineStart": 145,
"lineEnd": 145,
"excerpt": "'pypi': 'https://pypi.org/pypi/{package}/json',"
},
{
"path": "skills/dependency-management-deps-audit/resources/implementation-playbook.md",
"lineStart": 146,
"lineEnd": 146,
"excerpt": "'rubygems': 'https://rubygems.org/api/v1/gems/{package}.json',"
}
],
"credentials": [],
"destructiveOrMutating": [
{
"path": "skills/dependency-management-deps-audit/SKILL.md",
"lineStart": 42,
"lineEnd": 42,
"excerpt": "- Do not publish sensitive vulnerability details to public channels."
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "ef831d0a3cdd86a1a1ca3eb6abe394a03a66571f79f3068ad0265d779f683e25",
"files": [
{
"path": "skills/dependency-management-deps-audit/resources/implementation-playbook.md",
"bytes": 24265,
"sha256": "9004719a46fa89ae15a387b9c84ffd000b4ae314fff6bce1701596e620ef94c0"
},
{
"path": "skills/dependency-management-deps-audit/SKILL.md",
"bytes": 2170,
"sha256": "cf186c03c95cc163d6791d52f1305e20e08ff56ff09048e64a027b3b1e64d5b1"
}
],
"allFilesRead": true
}
},
"security-requirement-extraction": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/security-requirement-extraction/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "dd70fa52a9b0bac88e71a593528b33a0b3fe8ac0a45802430bdf7e07f1d562c2",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "dd70fa52a9b0bac88e71a593528b33a0b3fe8ac0a45802430bdf7e07f1d562c2",
"filesReviewed": 2,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "dd70fa52a9b0bac88e71a593528b33a0b3fe8ac0a45802430bdf7e07f1d562c2",
"filesReviewed": 2,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "safe",
"rationale": "Offline analysis/templates only; no executable command or state mutation found.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "dd70fa52a9b0bac88e71a593528b33a0b3fe8ac0a45802430bdf7e07f1d562c2",
"filesReviewed": 2,
"categories": {
"commandExecution": 0,
"network": 3,
"credentials": 22,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/security-requirement-extraction/resources/implementation-playbook.md",
"lineStart": 674,
"lineEnd": 674,
"excerpt": "- [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/)"
},
{
"path": "skills/security-requirement-extraction/resources/implementation-playbook.md",
"lineStart": 675,
"lineEnd": 675,
"excerpt": "- [NIST SP 800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)"
},
{
"path": "skills/security-requirement-extraction/resources/implementation-playbook.md",
"lineStart": 676,
"lineEnd": 676,
"excerpt": "- [Security User Stories](https://www.oreilly.com/library/view/agile-application-security/9781491938836/)"
}
],
"credentials": [
{
"path": "skills/security-requirement-extraction/resources/implementation-playbook.md",
"lineStart": 34,
"lineEnd": 34,
"excerpt": "| **Non-functional** | How system must perform | \"Authentication must complete in <2s\" |"
},
{
"path": "skills/security-requirement-extraction/resources/implementation-playbook.md",
"lineStart": 70,
"lineEnd": 70,
"excerpt": "AUTHENTICATION = \"authentication\""
},
{
"path": "skills/security-requirement-extraction/resources/implementation-playbook.md",
"lineStart": 71,
"lineEnd": 71,
"excerpt": "AUTHORIZATION = \"authorization\""
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "dd70fa52a9b0bac88e71a593528b33a0b3fe8ac0a45802430bdf7e07f1d562c2",
"files": [
{
"path": "skills/security-requirement-extraction/resources/implementation-playbook.md",
"bytes": 24156,
"sha256": "b0ee767d873fee65da35ada53b2984d191ec105315c3576bd44582f5054320a6"
},
{
"path": "skills/security-requirement-extraction/SKILL.md",
"bytes": 1462,
"sha256": "bdcb50621b8b36f698969c5605fa5a815d65b8d1dc6471f4e63a870b48ebcc61"
}
],
"allFilesRead": true
}
},
"secrets-management": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/secrets-management/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "incomplete",
"value": "incomplete",
"requirements": [
"Vault or cloud secret-manager CLI/authentication; two referenced local guides are absent from the skill subtree"
],
"evidence": [
{
"type": "line",
"path": "skills/secrets-management/SKILL.md",
"lineStart": 82,
"lineEnd": 82,
"excerpt": "vault secrets enable -path=secret kv-v2"
},
{
"type": "line",
"path": "skills/secrets-management/SKILL.md",
"lineStart": 134,
"lineEnd": 134,
"excerpt": "**Reference:** See `references/vault-setup.md`"
},
{
"type": "line",
"path": "skills/secrets-management/SKILL.md",
"lineStart": 210,
"lineEnd": 210,
"excerpt": "**Reference:** See `references/github-secrets.md`"
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "be59995a7def8d41677d9128c6af64976bc163c308e319a731c3f4c444a4fb4d",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 363,
"lineEnd": 363,
"excerpt": "## Related Skills"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "be59995a7def8d41677d9128c6af64976bc163c308e319a731c3f4c444a4fb4d",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "unknown",
"rationale": "Creates/stores/reads live secrets through Vault and cloud CLIs and includes credential-bearing deployment examples.",
"evidence": [
{
"type": "line",
"path": "skills/secrets-management/SKILL.md",
"lineStart": 141,
"lineEnd": 141,
"excerpt": "aws secretsmanager create-secret \\"
},
{
"type": "focused-static-scan",
"treeSha256": "be59995a7def8d41677d9128c6af64976bc163c308e319a731c3f4c444a4fb4d",
"filesReviewed": 1,
"categories": {
"commandExecution": 10,
"network": 12,
"credentials": 99,
"destructiveOrMutating": 12
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 3,
"lineEnd": 3,
"excerpt": "description: \"Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.\""
},
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 11,
"lineEnd": 11,
"excerpt": "Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools."
},
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 52,
"lineEnd": 52,
"excerpt": "### AWS Secrets Manager"
}
],
"network": [
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 3,
"lineEnd": 3,
"excerpt": "description: \"Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.\""
},
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 11,
"lineEnd": 11,
"excerpt": "Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools."
},
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 52,
"lineEnd": 52,
"excerpt": "### AWS Secrets Manager"
}
],
"credentials": [
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 2,
"lineEnd": 2,
"excerpt": "name: secrets-management"
},
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 3,
"lineEnd": 3,
"excerpt": "description: \"Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.\""
},
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 9,
"lineEnd": 9,
"excerpt": "# Secrets Management"
}
],
"destructiveOrMutating": [
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 22,
"lineEnd": 22,
"excerpt": "- Rotate secrets automatically"
},
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 91,
"lineEnd": 91,
"excerpt": "name: Deploy with Vault Secrets"
},
{
"path": "skills/secrets-management/SKILL.md",
"lineStart": 96,
"lineEnd": 96,
"excerpt": "deploy:"
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "be59995a7def8d41677d9128c6af64976bc163c308e319a731c3f4c444a4fb4d",
"files": [
{
"path": "skills/secrets-management/SKILL.md",
"bytes": 8374,
"sha256": "37518ec421cf00ffa306ccc719bf320b1f5595b5ac76295593f35712476d6f90"
}
],
"allFilesRead": true
}
},
"security-auditor": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/security-auditor/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "a5a9e2a4f096ee7c610bf7ede1961a8788feb3c227db1256fc788164f1c3a7dc",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "a5a9e2a4f096ee7c610bf7ede1961a8788feb3c227db1256fc788164f1c3a7dc",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "a5a9e2a4f096ee7c610bf7ede1961a8788feb3c227db1256fc788164f1c3a7dc",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "unknown",
"rationale": "Broad scope includes penetration testing, network testing, scanners, and automated security actions without a single bounded operational contract.",
"evidence": [
{
"type": "line",
"path": "skills/security-auditor/SKILL.md",
"lineStart": 64,
"lineEnd": 64,
"excerpt": "- **Vulnerability assessment**: Automated scanning, manual testing, penetration testing"
},
{
"type": "focused-static-scan",
"treeSha256": "a5a9e2a4f096ee7c610bf7ede1961a8788feb3c227db1256fc788164f1c3a7dc",
"filesReviewed": 1,
"categories": {
"commandExecution": 1,
"network": 1,
"credentials": 14,
"destructiveOrMutating": 1
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/security-auditor/SKILL.md",
"lineStart": 77,
"lineEnd": 77,
"excerpt": "- **Cloud security posture**: AWS Security Hub, Azure Security Center, GCP Security Command Center"
}
],
"network": [
{
"path": "skills/security-auditor/SKILL.md",
"lineStart": 77,
"lineEnd": 77,
"excerpt": "- **Cloud security posture**: AWS Security Hub, Azure Security Center, GCP Security Command Center"
}
],
"credentials": [
{
"path": "skills/security-auditor/SKILL.md",
"lineStart": 15,
"lineEnd": 15,
"excerpt": "- Validating authentication, authorization, and data protection controls"
},
{
"path": "skills/security-auditor/SKILL.md",
"lineStart": 19,
"lineEnd": 19,
"excerpt": "- You lack authorization or scope approval for security testing"
},
{
"path": "skills/security-auditor/SKILL.md",
"lineStart": 36,
"lineEnd": 36,
"excerpt": "- Protect sensitive data and avoid exposing secrets in reports."
}
],
"destructiveOrMutating": [
{
"path": "skills/security-auditor/SKILL.md",
"lineStart": 94,
"lineEnd": 94,
"excerpt": "- **IDOR prevention**: Ensuring every update/delete operation verifies ownership, even when using privileged service accounts."
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "a5a9e2a4f096ee7c610bf7ede1961a8788feb3c227db1256fc788164f1c3a7dc",
"files": [
{
"path": "skills/security-auditor/SKILL.md",
"bytes": 11489,
"sha256": "f57c553e805fed8babb2f1803186bcb1939875b9fdbaf15ba0bd58c15adb45d2"
}
],
"allFilesRead": true
}
},
"security-bluebook-builder": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/security-bluebook-builder/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "529707b2fec1decda7bfe087952061c85834953e343aebec52c03f4e3575632a",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "529707b2fec1decda7bfe087952061c85834953e343aebec52c03f4e3575632a",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "529707b2fec1decda7bfe087952061c85834953e343aebec52c03f4e3575632a",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "unknown",
"rationale": "Document-authoring workflow only and explicitly excludes secret values; no command/network/destructive action found.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "529707b2fec1decda7bfe087952061c85834953e343aebec52c03f4e3575632a",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 0,
"credentials": 5,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [],
"credentials": [
{
"path": "skills/security-bluebook-builder/SKILL.md",
"lineStart": 22,
"lineEnd": 22,
"excerpt": "- What data classes are handled (PII, PHI, financial, tokens, content)?"
},
{
"path": "skills/security-bluebook-builder/SKILL.md",
"lineStart": 24,
"lineEnd": 24,
"excerpt": "- How do users authenticate (OAuth, email/password, SSO, device sessions)?"
},
{
"path": "skills/security-bluebook-builder/SKILL.md",
"lineStart": 35,
"lineEnd": 35,
"excerpt": "- Do not include secrets, tokens, or internal credentials."
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "529707b2fec1decda7bfe087952061c85834953e343aebec52c03f4e3575632a",
"files": [
{
"path": "skills/security-bluebook-builder/SKILL.md",
"bytes": 2655,
"sha256": "d4f053069cb503b3756fa6937003052d783c814fcccff25ae23dc1865b014085"
}
],
"allFilesRead": true
}
},
"security/aws-iam-best-practices": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 6,
"lineEnd": 6,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"AWS CLI credentials with IAM read/write permissions"
],
"evidence": [
{
"type": "line",
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 91,
"lineEnd": 91,
"excerpt": "aws iam create-virtual-mfa-device \\"
},
{
"type": "line",
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 124,
"lineEnd": 124,
"excerpt": "aws iam update-access-key \\"
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "d28d980932c848fc46dfc887759fe5c5c03891bc3ac321b6595c14c99996d410",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "d28d980932c848fc46dfc887759fe5c5c03891bc3ac321b6595c14c99996d410",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "safe",
"rationale": "Contains IAM create/update/key-rotation operations and handles credential material.",
"evidence": [
{
"type": "line",
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 124,
"lineEnd": 124,
"excerpt": "aws iam update-access-key \\"
},
{
"type": "focused-static-scan",
"treeSha256": "d28d980932c848fc46dfc887759fe5c5c03891bc3ac321b6595c14c99996d410",
"filesReviewed": 1,
"categories": {
"commandExecution": 24,
"network": 27,
"credentials": 3,
"destructiveOrMutating": 5
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 11,
"lineEnd": 11,
"excerpt": "# AWS IAM Best Practices"
},
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 13,
"lineEnd": 13,
"excerpt": "Review and harden IAM policies following AWS security best practices and least privilege principles."
},
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 44,
"lineEnd": 44,
"excerpt": "aws iam list-policies --scope Local \\"
}
],
"network": [
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 11,
"lineEnd": 11,
"excerpt": "# AWS IAM Best Practices"
},
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 13,
"lineEnd": 13,
"excerpt": "Review and harden IAM policies following AWS security best practices and least privilege principles."
},
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 44,
"lineEnd": 44,
"excerpt": "aws iam list-policies --scope Local \\"
}
],
"credentials": [
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 75,
"lineEnd": 75,
"excerpt": "aws iam get-credential-report --output text | \\"
},
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 261,
"lineEnd": 261,
"excerpt": "- [ ] Use IAM roles instead of long-term credentials"
},
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 262,
"lineEnd": 262,
"excerpt": "- [ ] Implement password policy (length, complexity, rotation)"
}
],
"destructiveOrMutating": [
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 114,
"lineEnd": 114,
"excerpt": "# Rotate access key"
},
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 119,
"lineEnd": 119,
"excerpt": "NEW_KEY=$(aws iam create-access-key --user-name \"$USER\")"
},
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"lineStart": 121,
"lineEnd": 121,
"excerpt": "echo \"aws iam delete-access-key --user-name $USER --access-key-id $OLD_KEY\""
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "d28d980932c848fc46dfc887759fe5c5c03891bc3ac321b6595c14c99996d410",
"files": [
{
"path": "skills/security/aws-iam-best-practices/SKILL.md",
"bytes": 10467,
"sha256": "dd21f2fcfeaa0b28394807a04a79036004726ba2f79fc29fd9ba3d650120e9d8"
}
],
"allFilesRead": true
}
},
"security/aws-security-audit": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/security/aws-security-audit/SKILL.md",
"lineStart": 6,
"lineEnd": 6,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"AWS CLI/SDK credentials with read access"
],
"evidence": [
{
"type": "line",
"path": "skills/security/aws-security-audit/SKILL.md",
"lineStart": 54,
"lineEnd": 54,
"excerpt": "aws iam get-credential-report --output text | \\"
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "59b1a0cda6a1b5c71608a283eacd6a960798ea00138ce34dd7d4d70bda2c9e2b",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "59b1a0cda6a1b5c71608a283eacd6a960798ea00138ce34dd7d4d70bda2c9e2b",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "safe",
"rationale": "Focused review found AWS list/get/describe calls only; no mutating AWS command is present. Credentials are required for use but not printed or collected by the skill.",
"evidence": [
{
"type": "line",
"path": "skills/security/aws-security-audit/SKILL.md",
"lineStart": 54,
"lineEnd": 54,
"excerpt": "aws iam get-credential-report --output text | \\"
},
{
"type": "focused-static-scan",
"treeSha256": "59b1a0cda6a1b5c71608a283eacd6a960798ea00138ce34dd7d4d70bda2c9e2b",
"filesReviewed": 1,
"categories": {
"commandExecution": 43,
"network": 43,
"credentials": 2,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/security/aws-security-audit/SKILL.md",
"lineStart": 3,
"lineEnd": 3,
"excerpt": "description: \"Comprehensive AWS security posture assessment using AWS CLI and security best practices\""
},
{
"path": "skills/security/aws-security-audit/SKILL.md",
"lineStart": 11,
"lineEnd": 11,
"excerpt": "# AWS Security Audit"
},
{
"path": "skills/security/aws-security-audit/SKILL.md",
"lineStart": 13,
"lineEnd": 13,
"excerpt": "Perform comprehensive security assessments of AWS environments to identify vulnerabilities and misconfigurations."
}
],
"network": [
{
"path": "skills/security/aws-security-audit/SKILL.md",
"lineStart": 3,
"lineEnd": 3,
"excerpt": "description: \"Comprehensive AWS security posture assessment using AWS CLI and security best practices\""
},
{
"path": "skills/security/aws-security-audit/SKILL.md",
"lineStart": 11,
"lineEnd": 11,
"excerpt": "# AWS Security Audit"
},
{
"path": "skills/security/aws-security-audit/SKILL.md",
"lineStart": 13,
"lineEnd": 13,
"excerpt": "Perform comprehensive security assessments of AWS environments to identify vulnerabilities and misconfigurations."
}
],
"credentials": [
{
"path": "skills/security/aws-security-audit/SKILL.md",
"lineStart": 54,
"lineEnd": 54,
"excerpt": "aws iam get-credential-report --output text | \\"
},
{
"path": "skills/security/aws-security-audit/SKILL.md",
"lineStart": 198,
"lineEnd": 198,
"excerpt": "aws iam get-credential-report --output text | \\"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "59b1a0cda6a1b5c71608a283eacd6a960798ea00138ce34dd7d4d70bda2c9e2b",
"files": [
{
"path": "skills/security/aws-security-audit/SKILL.md",
"bytes": 10227,
"sha256": "f26a9648c27a2c796983e716ec4b7d78c1ac6584190cbf451b8e614a06cb606d"
}
],
"allFilesRead": true
}
},
"gha-security-review": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/gha-security-review/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "incomplete",
"value": "incomplete",
"requirements": [
"nine referenced local security guides are absent from the skill subtree"
],
"evidence": [
{
"type": "line",
"path": "skills/gha-security-review/SKILL.md",
"lineStart": 81,
"lineEnd": 81,
"excerpt": "| `${{ }}` in `run:` blocks | `references/expression-injection.md` |"
},
{
"type": "line",
"path": "skills/gha-security-review/SKILL.md",
"lineStart": 85,
"lineEnd": 85,
"excerpt": "| `permissions:` block or secrets usage | `references/permissions-and-secrets.md` |"
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "9a5062aeec38804db4fd13d6bd7d0150300b95c14ff9b8748f65f8d28f115e36",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "9a5062aeec38804db4fd13d6bd7d0150300b95c14ff9b8748f65f8d28f115e36",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "safe",
"rationale": "Static review methodology only; no command execution, credential access, network call, or write operation prescribed.",
"evidence": [
{
"type": "line",
"path": "skills/gha-security-review/SKILL.md",
"lineStart": 3,
"lineEnd": 3,
"excerpt": "description: \"Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.\""
},
{
"type": "focused-static-scan",
"treeSha256": "9a5062aeec38804db4fd13d6bd7d0150300b95c14ff9b8748f65f8d28f115e36",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 1,
"credentials": 14,
"destructiveOrMutating": 2
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/gha-security-review/SKILL.md",
"lineStart": 11,
"lineEnd": 11,
"excerpt": "by StepSecurity (2025): https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation"
}
],
"credentials": [
{
"path": "skills/gha-security-review/SKILL.md",
"lineStart": 22,
"lineEnd": 22,
"excerpt": "- The task requires tracing a concrete attack path from an external attacker to workflow execution or secret exposure."
},
{
"path": "skills/gha-security-review/SKILL.md",
"lineStart": 49,
"lineEnd": 49,
"excerpt": "- Secrets in `workflow_dispatch`/`schedule`-only workflows"
},
{
"path": "skills/gha-security-review/SKILL.md",
"lineStart": 66,
"lineEnd": 66,
"excerpt": "4. **Impact** — What does the attacker gain? (token theft, code execution, repo write access)"
}
],
"destructiveOrMutating": [
{
"path": "skills/gha-security-review/SKILL.md",
"lineStart": 82,
"lineEnd": 82,
"excerpt": "| PATs / deploy keys / elevated credentials | `references/credential-escalation.md` |"
},
{
"path": "skills/gha-security-review/SKILL.md",
"lineStart": 116,
"lineEnd": 116,
"excerpt": "Are elevated credentials (PATs, deploy keys) accessible to untrusted code?"
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "9a5062aeec38804db4fd13d6bd7d0150300b95c14ff9b8748f65f8d28f115e36",
"files": [
{
"path": "skills/gha-security-review/SKILL.md",
"bytes": 8827,
"sha256": "13dcdd011a1e6cbb2414187ec7c54baaf9196f345ff8cec3698f1131f11ec727"
}
],
"allFilesRead": true
}
},
"k8s-security-policies": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/k8s-security-policies/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"kubectl and cluster access for live RBAC/NetworkPolicy checks"
],
"evidence": [
{
"type": "line",
"path": "skills/k8s-security-policies/references/rbac-patterns.md",
"lineStart": 144,
"lineEnd": 144,
"excerpt": "kubectl auth can-i list pods --as john@example.com"
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "17f7c9aa5db00ca9c7b2655dadf342c3685d6fffd4a8f8fb1eb376b7d2451fe3",
"filesReviewed": 3,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [
{
"path": "skills/k8s-security-policies/SKILL.md",
"lineStart": 346,
"lineEnd": 346,
"excerpt": "## Related Skills"
}
],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "17f7c9aa5db00ca9c7b2655dadf342c3685d6fffd4a8f8fb1eb376b7d2451fe3",
"filesReviewed": 3,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "unknown",
"rationale": "Produces deployable RBAC/NetworkPolicy policy and performs live cluster authorization checks; incorrect application can change workload access.",
"evidence": [
{
"type": "line",
"path": "skills/k8s-security-policies/references/rbac-patterns.md",
"lineStart": 144,
"lineEnd": 144,
"excerpt": "kubectl auth can-i list pods --as john@example.com"
},
{
"type": "focused-static-scan",
"treeSha256": "17f7c9aa5db00ca9c7b2655dadf342c3685d6fffd4a8f8fb1eb376b7d2451fe3",
"filesReviewed": 3,
"categories": {
"commandExecution": 9,
"network": 0,
"credentials": 30,
"destructiveOrMutating": 3
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/k8s-security-policies/references/rbac-patterns.md",
"lineStart": 144,
"lineEnd": 144,
"excerpt": "kubectl auth can-i list pods --as john@example.com"
},
{
"path": "skills/k8s-security-policies/references/rbac-patterns.md",
"lineStart": 145,
"lineEnd": 145,
"excerpt": "kubectl auth can-i '*' '*' --as system:serviceaccount:default:my-app"
},
{
"path": "skills/k8s-security-policies/references/rbac-patterns.md",
"lineStart": 150,
"lineEnd": 150,
"excerpt": "kubectl describe clusterrole cluster-admin"
}
],
"network": [],
"credentials": [
{
"path": "skills/k8s-security-policies/references/rbac-patterns.md",
"lineStart": 7,
"lineEnd": 7,
"excerpt": "apiVersion: rbac.authorization.k8s.io/v1"
},
{
"path": "skills/k8s-security-policies/references/rbac-patterns.md",
"lineStart": 19,
"lineEnd": 19,
"excerpt": "apiVersion: rbac.authorization.k8s.io/v1"
},
{
"path": "skills/k8s-security-policies/references/rbac-patterns.md",
"lineStart": 32,
"lineEnd": 32,
"excerpt": "apiVersion: rbac.authorization.k8s.io/v1"
}
],
"destructiveOrMutating": [
{
"path": "skills/k8s-security-policies/references/rbac-patterns.md",
"lineStart": 40,
"lineEnd": 40,
"excerpt": "verbs: [\"get\", \"list\", \"watch\", \"create\", \"update\", \"patch\", \"delete\"]"
},
{
"path": "skills/k8s-security-policies/references/rbac-patterns.md",
"lineStart": 167,
"lineEnd": 167,
"excerpt": "- `delete` - Delete resources"
},
{
"path": "skills/k8s-security-policies/references/rbac-patterns.md",
"lineStart": 168,
"lineEnd": 168,
"excerpt": "- `deletecollection` - Delete multiple resources"
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "17f7c9aa5db00ca9c7b2655dadf342c3685d6fffd4a8f8fb1eb376b7d2451fe3",
"files": [
{
"path": "skills/k8s-security-policies/assets/network-policy-template.yaml",
"bytes": 3157,
"sha256": "719734ad1a92abad28556c3c421c3f848923854f3228f0424b7f409182c9df6f"
},
{
"path": "skills/k8s-security-policies/references/rbac-patterns.md",
"bytes": 4076,
"sha256": "561e52062276dd7d94c160556ca8570be10679fde1d983a8ad0f5b4485a038e5"
},
{
"path": "skills/k8s-security-policies/SKILL.md",
"bytes": 7935,
"sha256": "db47d1214878a5e5bbb636c94b7926c28057737e3af0dcda60822f96d0a9614d"
}
],
"allFilesRead": true
}
},
"incident-responder": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/incident-responder/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "108644d4d602ab035f057a60c06b13d4a2cb69332769b335c9a43cdc52a26d0a",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "108644d4d602ab035f057a60c06b13d4a2cb69332769b335c9a43cdc52a26d0a",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "108644d4d602ab035f057a60c06b13d4a2cb69332769b335c9a43cdc52a26d0a",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "unknown",
"rationale": "Active-incident workflow recommends staged fix deployment and rollback assessment; actual mutations depend on the environment.",
"evidence": [
{
"type": "line",
"path": "skills/incident-responder/SKILL.md",
"lineStart": 99,
"lineEnd": 99,
"excerpt": "3. **Staged rollout**: Gradual fix deployment with monitoring"
},
{
"type": "focused-static-scan",
"treeSha256": "108644d4d602ab035f057a60c06b13d4a2cb69332769b335c9a43cdc52a26d0a",
"filesReviewed": 1,
"categories": {
"commandExecution": 0,
"network": 0,
"credentials": 1,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [],
"network": [],
"credentials": [
{
"path": "skills/incident-responder/SKILL.md",
"lineStart": 72,
"lineEnd": 72,
"excerpt": "- **Security correlation**: DDoS attacks, authentication issues, certificate problems"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "108644d4d602ab035f057a60c06b13d4a2cb69332769b335c9a43cdc52a26d0a",
"files": [
{
"path": "skills/incident-responder/SKILL.md",
"bytes": 10554,
"sha256": "f65d143254144bcfeedce6c87c261a28d188bfe97bb0f18a97dd62621e7a6ca4"
}
],
"allFilesRead": true
}
},
"supply-chain-risk-auditor": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/supply-chain-risk-auditor/SKILL.md",
"lineStart": 11,
"lineEnd": 11,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "manual",
"requirements": [
"gh CLI, GitHub access, and permission to write the audit report directory"
],
"evidence": [
{
"type": "line",
"path": "skills/supply-chain-risk-auditor/SKILL.md",
"lineStart": 47,
"lineEnd": 47,
"excerpt": "Ensure that the `gh` tool is available before continuing. Ask the user to install if it is not found."
},
{
"type": "line",
"path": "skills/supply-chain-risk-auditor/SKILL.md",
"lineStart": 53,
"lineEnd": 53,
"excerpt": "1. Creating a `.supply-chain-risk-auditor` directory for your workspace"
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "ec86d4d596480d96610d2806226d98dda9ad8f6f31df0cf72e2e4a11c577233d",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "ec86d4d596480d96610d2806226d98dda9ad8f6f31df0cf72e2e4a11c577233d",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "unknown",
"rationale": "Explicit Bash/Write access, GitHub queries, and report-directory writes are required.",
"evidence": [
{
"type": "line",
"path": "skills/supply-chain-risk-auditor/SKILL.md",
"lineStart": 6,
"lineEnd": 6,
"excerpt": "- Write"
},
{
"type": "focused-static-scan",
"treeSha256": "ec86d4d596480d96610d2806226d98dda9ad8f6f31df0cf72e2e4a11c577233d",
"filesReviewed": 1,
"categories": {
"commandExecution": 2,
"network": 0,
"credentials": 0,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/supply-chain-risk-auditor/SKILL.md",
"lineStart": 55,
"lineEnd": 55,
"excerpt": "2. Finding all git repositories for direct dependencies."
},
{
"path": "skills/supply-chain-risk-auditor/SKILL.md",
"lineStart": 56,
"lineEnd": 56,
"excerpt": "3. Normalizing the git repository entries to URLs, i.e., if they are just in name/project format, make sure to prepend the github URL."
}
],
"network": [],
"credentials": [],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "ec86d4d596480d96610d2806226d98dda9ad8f6f31df0cf72e2e4a11c577233d",
"files": [
{
"path": "skills/supply-chain-risk-auditor/SKILL.md",
"bytes": 6140,
"sha256": "799e965b7e6d91dfc147907ef59900aeaa1a3712c1b21c8459504584c7eaa2d7"
}
],
"allFilesRead": true
}
},
"auth-implementation-patterns": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/auth-implementation-patterns/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "a13f93ef89436a092d5ce699e1a35e8b8ec6685edad8121da71f0f65f0c7d42b",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "a13f93ef89436a092d5ce699e1a35e8b8ec6685edad8121da71f0f65f0c7d42b",
"filesReviewed": 2,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "a13f93ef89436a092d5ce699e1a35e8b8ec6685edad8121da71f0f65f0c7d42b",
"filesReviewed": 2,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "unknown",
"rationale": "Implementation playbook handles live credentials/tokens and includes revoke/delete user and token operations.",
"evidence": [
{
"type": "line",
"path": "skills/auth-implementation-patterns/resources/implementation-playbook.md",
"lineStart": 376,
"lineEnd": 376,
"excerpt": "await db.users.delete(req.params.id);"
},
{
"type": "focused-static-scan",
"treeSha256": "a13f93ef89436a092d5ce699e1a35e8b8ec6685edad8121da71f0f65f0c7d42b",
"filesReviewed": 2,
"categories": {
"commandExecution": 0,
"network": 0,
"credentials": 99,
"destructiveOrMutating": 8
},
"representativeSamples": {
"commandExecution": [],
"network": [],
"credentials": [
{
"path": "skills/auth-implementation-patterns/resources/implementation-playbook.md",
"lineStart": 1,
"lineEnd": 1,
"excerpt": "# Authentication and Authorization Implementation Patterns Implementation Playbook"
},
{
"path": "skills/auth-implementation-patterns/resources/implementation-playbook.md",
"lineStart": 7,
"lineEnd": 7,
"excerpt": "### 1. Authentication vs Authorization"
},
{
"path": "skills/auth-implementation-patterns/resources/implementation-playbook.md",
"lineStart": 9,
"lineEnd": 9,
"excerpt": "**Authentication (AuthN)**: Who are you?"
}
],
"destructiveOrMutating": [
{
"path": "skills/auth-implementation-patterns/resources/implementation-playbook.md",
"lineStart": 172,
"lineEnd": 172,
"excerpt": "// Revoke refresh token (logout)"
},
{
"path": "skills/auth-implementation-patterns/resources/implementation-playbook.md",
"lineStart": 179,
"lineEnd": 179,
"excerpt": "// Revoke all user tokens (logout all devices)"
},
{
"path": "skills/auth-implementation-patterns/resources/implementation-playbook.md",
"lineStart": 266,
"lineEnd": 266,
"excerpt": "req.session.destroy((err) => {"
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "a13f93ef89436a092d5ce699e1a35e8b8ec6685edad8121da71f0f65f0c7d42b",
"files": [
{
"path": "skills/auth-implementation-patterns/resources/implementation-playbook.md",
"bytes": 17070,
"sha256": "b6b65fb008fe8cc2b1ccba2063928b9080079ba16e44647d19b054da7f8dfcd9"
},
{
"path": "skills/auth-implementation-patterns/SKILL.md",
"bytes": 1719,
"sha256": "ac7abc9e3e8928323153ecc00619359cbdb56272831ed399c4b552b193132c96"
}
],
"allFilesRead": true
}
},
"stride-analysis-patterns": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/stride-analysis-patterns/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "known",
"value": "none",
"requirements": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "a9cb40c60d7b6db22ee83ad20429ae2320936327fa3447ca921874e3b3eba85c",
"finding": "No activation-time install, authentication, host configuration, or mandatory external runtime prerequisite was declared."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "a9cb40c60d7b6db22ee83ad20429ae2320936327fa3447ca921874e3b3eba85c",
"filesReviewed": 2,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "a9cb40c60d7b6db22ee83ad20429ae2320936327fa3447ca921874e3b3eba85c",
"filesReviewed": 2,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "safe",
"previousCatalogValue": "safe",
"rationale": "Offline threat-analysis templates/pseudocode only; no operational command or state mutation found.",
"evidence": [
{
"type": "focused-static-scan",
"treeSha256": "a9cb40c60d7b6db22ee83ad20429ae2320936327fa3447ca921874e3b3eba85c",
"filesReviewed": 2,
"categories": {
"commandExecution": 0,
"network": 3,
"credentials": 19,
"destructiveOrMutating": 2
},
"representativeSamples": {
"commandExecution": [],
"network": [
{
"path": "skills/stride-analysis-patterns/resources/implementation-playbook.md",
"lineStart": 653,
"lineEnd": 653,
"excerpt": "- [Microsoft STRIDE Documentation](https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats)"
},
{
"path": "skills/stride-analysis-patterns/resources/implementation-playbook.md",
"lineStart": 654,
"lineEnd": 654,
"excerpt": "- [OWASP Threat Modeling](https://owasp.org/www-community/Threat_Modeling)"
},
{
"path": "skills/stride-analysis-patterns/resources/implementation-playbook.md",
"lineStart": 655,
"lineEnd": 655,
"excerpt": "- [Threat Modeling: Designing for Security](https://www.wiley.com/en-us/Threat+Modeling%3A+Designing+for+Security-p-9781118809990)"
}
],
"credentials": [
{
"path": "skills/stride-analysis-patterns/resources/implementation-playbook.md",
"lineStart": 23,
"lineEnd": 23,
"excerpt": "S - Spoofing → Authentication threats"
},
{
"path": "skills/stride-analysis-patterns/resources/implementation-playbook.md",
"lineStart": 30,
"lineEnd": 30,
"excerpt": "E - Elevation of → Authorization threats"
},
{
"path": "skills/stride-analysis-patterns/resources/implementation-playbook.md",
"lineStart": 38,
"lineEnd": 38,
"excerpt": "| **Spoofing** | Can attacker pretend to be someone else? | Authentication |"
}
],
"destructiveOrMutating": [
{
"path": "skills/stride-analysis-patterns/resources/implementation-playbook.md",
"lineStart": 190,
"lineEnd": 190,
"excerpt": "1. Deploy WAF with OWASP ruleset"
},
{
"path": "skills/stride-analysis-patterns/resources/implementation-playbook.md",
"lineStart": 409,
"lineEnd": 409,
"excerpt": "\"Deploy DDoS protection\","
}
]
}
}
]
},
"contentAudit": {
"treeSha256": "a9cb40c60d7b6db22ee83ad20429ae2320936327fa3447ca921874e3b3eba85c",
"files": [
{
"path": "skills/stride-analysis-patterns/resources/implementation-playbook.md",
"bytes": 20936,
"sha256": "d2501aa970d5bd466f8a9b9507ce04475a2265a76801b5b52bed0dfa2acac9dc"
},
{
"path": "skills/stride-analysis-patterns/SKILL.md",
"bytes": 1426,
"sha256": "0cd0d8f0ab8775503fb1e9fe66005802c78b6f7717a7dd7a67be25b504a6cffd"
}
],
"allFilesRead": true
}
},
"skill-scanner": {
"provenance": {
"status": "unknown",
"value": null,
"declaredSource": "community",
"evidence": [
{
"type": "line",
"path": "skills/skill-scanner/SKILL.md",
"lineStart": 5,
"lineEnd": 5,
"excerpt": "source: community"
}
],
"rationale": "The declared source is generic or descriptive and no canonical URL/repository or package attestation was found."
},
"setup": {
"status": "incomplete",
"value": "incomplete",
"requirements": [
"uv/Python runner; referenced bundled scanner and three reference files are absent from the skill subtree"
],
"evidence": [
{
"type": "line",
"path": "skills/skill-scanner/SKILL.md",
"lineStart": 26,
"lineEnd": 26,
"excerpt": "uv run ${CLAUDE_SKILL_ROOT}/scripts/scan_skill.py <skill-directory>"
},
{
"type": "line",
"path": "skills/skill-scanner/SKILL.md",
"lineStart": 136,
"lineEnd": 136,
"excerpt": "Load `${CLAUDE_SKILL_ROOT}/references/permission-analysis.md` for the tool risk matrix."
}
]
},
"dependencies": {
"status": "known",
"value": [],
"unresolvedRequiredReferences": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "5cff0aa92c45ef6f31cb1f38dc5971e210b4d7358c9b4fe242a4d2c00bde392e",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"relatedOrRecommendedMatches": [],
"finding": "No explicit required inter-AAS dependency declared. Related/recommended skills were not reclassified as dependencies."
}
]
},
"conflicts": {
"status": "known",
"value": [],
"evidence": [
{
"type": "full-content-audit",
"treeSha256": "5cff0aa92c45ef6f31cb1f38dc5971e210b4d7358c9b4fe242a4d2c00bde392e",
"filesReviewed": 1,
"lexicalMatchesReviewedAsNonInterAAS": [],
"finding": "No explicit inter-AAS stack conflict or mutually exclusive skill declaration found. Scope exclusions were not reclassified as conflicts."
}
]
},
"risk": {
"status": "reviewed",
"value": "unknown",
"previousCatalogValue": "unknown",
"rationale": "Intended scanner execution depends on an absent bundled script and examines untrusted content with Bash-oriented review guidance; executable behavior cannot be verified.",
"evidence": [
{
"type": "line",
"path": "skills/skill-scanner/SKILL.md",
"lineStart": 26,
"lineEnd": 26,
"excerpt": "uv run ${CLAUDE_SKILL_ROOT}/scripts/scan_skill.py <skill-directory>"
},
{
"type": "focused-static-scan",
"treeSha256": "5cff0aa92c45ef6f31cb1f38dc5971e210b4d7358c9b4fe242a4d2c00bde392e",
"filesReviewed": 1,
"categories": {
"commandExecution": 4,
"network": 0,
"credentials": 7,
"destructiveOrMutating": 0
},
"representativeSamples": {
"commandExecution": [
{
"path": "skills/skill-scanner/SKILL.md",
"lineStart": 26,
"lineEnd": 26,
"excerpt": "uv run ${CLAUDE_SKILL_ROOT}/scripts/scan_skill.py <skill-directory>"
},
{
"path": "skills/skill-scanner/SKILL.md",
"lineStart": 54,
"lineEnd": 54,
"excerpt": "uv run ${CLAUDE_SKILL_ROOT}/scripts/scan_skill.py <skill-directory>"
},
{
"path": "skills/skill-scanner/SKILL.md",
"lineStart": 104,
"lineEnd": 104,
"excerpt": "- Accessing git history, credentials, or user data unnecessarily"
}
],
"network": [],
"credentials": [
{
"path": "skills/skill-scanner/SKILL.md",
"lineStart": 3,
"lineEnd": 3,
"excerpt": "description: \"Scan agent skills for security issues before adoption. Detects prompt injection, malicious code, excessive permissions, secret exposure, and supply chain risks.\""
},
{
"path": "skills/skill-scanner/SKILL.md",
"lineStart": 10,
"lineEnd": 10,
"excerpt": "Scan agent skills for security issues before adoption. Detects prompt injection, malicious code, excessive permissions, secret exposure, and supply chain risks."
},
{
"path": "skills/skill-scanner/SKILL.md",
"lineStart": 104,
"lineEnd": 104,
"excerpt": "- Accessing git history, credentials, or user data unnecessarily"
}
],
"destructiveOrMutating": []
}
}
]
},
"contentAudit": {
"treeSha256": "5cff0aa92c45ef6f31cb1f38dc5971e210b4d7358c9b4fe242a4d2c00bde392e",
"files": [
{
"path": "skills/skill-scanner/SKILL.md",
"bytes": 9052,
"sha256": "9b6ecdd8f13ffcff6dd95dfaeea9b8d21cf87500eab7dc5d61b48d1f1cedcacc"
}
],
"allFilesRead": true
}
}
}
}
Reference in New Issue View Git Blame Copy Permalink