{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "CFG006", "name": "[CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.", "shortDescription": {"text": "[CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts."}, "fullDescription": {"text": "Add a .gitignore appropriate for your language/framework."}, "properties": {"scanner": "repobility-threat-engine", "category": "practices", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_CI", "name": "No CI/CD configuration found", "shortDescription": {"text": "No CI/CD configuration found"}, "fullDescription": {"text": "Add a CI/CD pipeline: create .github/workflows/ci.yml for GitHub Actions with steps to lint, test, and build on every push and pull request."}, "properties": {"scanner": "repobility-core", "category": "practices", "severity": "medium", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_TESTS", "name": "No test files found in a documentation, catalog, or template-heavy repository", "shortDescription": {"text": "No test files found in a documentation, catalog, or template-heavy repository"}, "fullDescription": {"text": "If this repository ships runnable code, add focused tests for those examples or templates. If it is documentation/catalog content only, mark the finding as accepted or add a .repobilityignore note."}, "properties": {"scanner": "repobility-core", "category": "testing", "severity": "info", "confidence": 0.35, "cwe": "", "owasp": ""}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f4ba0ffde6f9ffd", "name": "Agent authority lacks a verifier contract: skills/engineering/grill-with-docs/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/engineering/grill-with-docs/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e6c9e5c21aae1a00", "name": "Agent authority lacks a verifier contract: skills/engineering/tdd/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/engineering/tdd/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-792ceedca28d381d", "name": "Agent authority lacks a verifier contract: skills/engineering/code-review/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/engineering/code-review/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1470c353dcfbb8bc", "name": "Agent authority lacks a verifier contract: skills/engineering/research/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/engineering/research/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-281651d1e9ac8376", "name": "Agent authority lacks a verifier contract: skills/engineering/prototype/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/engineering/prototype/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-707e8a1ec8dbf242", "name": "Agent authority lacks a verifier contract: skills/engineering/diagnosing-bugs/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/engineering/diagnosing-bugs/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8406f197c496699", "name": "Agent authority lacks a verifier contract: skills/engineering/setup-matt-pocock-skills/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/engineering/setup-matt-pocock-skills/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-500c52aef6045905", "name": "Agent authority lacks a verifier contract: skills/in-progress/writing-beats/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/in-progress/writing-beats/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-baa966bf324ed03a", "name": "Agent authority lacks a verifier contract: skills/in-progress/setup-ts-deep-modules/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/in-progress/setup-ts-deep-modules/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ddc21bcacaaf6735", "name": "Agent authority lacks a verifier contract: skills/in-progress/writing-shape/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/in-progress/writing-shape/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f15d4cede869b3bd", "name": "Agent authority lacks a verifier contract: skills/in-progress/writing-fragments/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/in-progress/writing-fragments/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9db68cd199ca8090", "name": "Agent authority lacks a verifier contract: skills/in-progress/claude-handoff/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/in-progress/claude-handoff/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-266452a2a8acf816", "name": "Agent authority lacks a verifier contract: skills/personal/obsidian-vault/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/personal/obsidian-vault/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c8d5414b7476461", "name": "Agent authority lacks a verifier contract: skills/productivity/writing-great-skills/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/productivity/writing-great-skills/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68fac67010c0b510", "name": "Agent authority lacks a verifier contract: skills/productivity/grill-me/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/productivity/grill-me/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bcfd69fe773e953", "name": "Agent authority lacks a verifier contract: skills/misc/setup-pre-commit/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/misc/setup-pre-commit/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5be9a7889e7cded3", "name": "Agent authority lacks a verifier contract: skills/deprecated/qa/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/deprecated/qa/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-954b5a884242c6ab", "name": "SkillSpector EA2 (excessive-agency) in skills/deprecated/qa/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in skills/deprecated/qa/SKILL.md"}, "fullDescription": {"text": "Do NOT ask the user\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: qa\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-1db9c7baf1241e51", "name": "SkillSpector P6 (prompt-injection) in skills/engineering/diagnosing-bugs/scripts/hitl-loop.template.sh", "shortDescription": {"text": "SkillSpector P6 (prompt-injection) in skills/engineering/diagnosing-bugs/scripts/hitl-loop.template.sh"}, "fullDescription": {"text": "show instruction\n\nSkill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.\n\nSkill: diagnosing-bugs\nRule: P6  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-f52e8a561868afd7", "name": "SkillSpector TM2 (tool-misuse) in skills/engineering/to-tickets/SKILL.md", "shortDescription": {"text": "SkillSpector TM2 (tool-misuse) in skills/engineering/to-tickets/SKILL.md"}, "fullDescription": {"text": "First expand: add the new form beside the old so nothing breaks. Then migrate the call sites over in batches sized by blast radius (per package, per directory), each batch its own ticket blocked by th\n\nTool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.\n\nSkill: to-tickets\nRule: TM2  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-e2acda262976927f", "name": "SkillSpector EA2 (excessive-agency) in skills/in-progress/batch-grill-me/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in skills/in-progress/batch-grill-me/SKILL.md"}, "fullDescription": {"text": "don't ask the user\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: batch-grill-me\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-e53ad62331b66b32", "name": "SkillSpector EA2 (excessive-agency) in skills/in-progress/loop-me/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in skills/in-progress/loop-me/SKILL.md"}, "fullDescription": {"text": "without asking\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: loop-me\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan skills/deprecated/design-an-interface -"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 1 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5a5ac8d1c7117fb4", "name": "Commented-code block (7 lines) in skills/in-progress/setup-ts-deep-modules/dependency-cruiser.config.cjs:4", "shortDescription": {"text": "Commented-code block (7 lines) in skills/in-progress/setup-ts-deep-modules/dependency-cruiser.config.cjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-596813c9235bd2e2", "name": "Vulnerable dependency js-yaml 4.2.0: GHSA-52cp-r559-cp3m", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.2.0: GHSA-52cp-r559-cp3m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.2.0` (resolved in `package-lock.json`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\njs-yaml: YAML merge-key chains can force quadratic CPU consumption\n\nAliases: CVE-2026-59869\nAdvisory: https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-8219c25f9b39ce12", "name": "Vulnerable dependency js-yaml 3.14.2: GHSA-52cp-r559-cp3m", "shortDescription": {"text": "Vulnerable dependency js-yaml 3.14.2: GHSA-52cp-r559-cp3m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `3.14.2` (resolved in `package-lock.json`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\njs-yaml: YAML merge-key chains can force quadratic CPU consumption\n\nAliases: CVE-2026-59869\nAdvisory: https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c521a37531a27594", "name": "Vulnerable dependency js-yaml 3.14.2: GHSA-h67p-54hq-rp68", "shortDescription": {"text": "Vulnerable dependency js-yaml 3.14.2: GHSA-h67p-54hq-rp68"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `3.14.2` (resolved in `package-lock.json`) is affected by GHSA-h67p-54hq-rp68 (aka CVE-2026-53550).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nJS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases\n\nAliases: CVE-2026-53550\nAdvisory: https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/339"}, "properties": {"repository": "mattpocock/skills", "repoUrl": "https://github.com/mattpocock/skills", "branch": "main"}, "results": [{"ruleId": "CFG006", "level": "warning", "message": {"text": "[CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts."}, "properties": {"repobilityId": 10688, "scanner": "repobility-threat-engine", "fingerprint": "c65fc71ce58c37a0e07837c0fe294108b731c43ef16027a2f0971c757bbe9a16", "category": "practices", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "No .gitignore file found in repository root", "evidence": {"reason": "No .gitignore file found in repository root", "rule_id": "CFG006", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "repo|practices|cfg006"}}}, {"ruleId": "CORE_NO_CI", "level": "warning", "message": {"text": "No CI/CD configuration found"}, "properties": {"repobilityId": 10687, "scanner": "repobility-core", "fingerprint": "ca5da3551af97272c4f099fc472740148135a15816b81b90bd862e8f91ec66ce", "category": "practices", "severity": "medium", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_CI", "scanner": "repobility-core", "correlation_key": "repo|practices|core_no_ci"}}}, {"ruleId": "CORE_NO_TESTS", "level": "none", "message": {"text": "No test files found in a documentation, catalog, or template-heavy repository"}, "properties": {"repobilityId": 10686, "scanner": "repobility-core", "fingerprint": "69cfb3536a8ccff500ccafcd681fc8d4bc9f4eda6689da02ddec81654bd9fd15", "category": "testing", "severity": "info", "confidence": 0.35, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Repository shape is documentation, catalog, skill, or template-heavy rather than a conventional runnable application.", "evidence": {"reason": "Repository shape is documentation, catalog, skill, or template-heavy rather than a conventional runnable application.", "rule_id": "CORE_NO_TESTS", "scanner": "repobility-core", "confidence": 0.35, "correlation_key": "repo|testing|core_no_tests"}}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f4ba0ffde6f9ffd", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/engineering/grill-with-docs/SKILL.md"}, "properties": {"repobilityId": "a6321ba40219ddb6", "scanner": "scanner-primary", "fingerprint": "0f4ba0ffde6f9ffd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/engineering/grill-with-docs/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e6c9e5c21aae1a00", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/engineering/tdd/SKILL.md"}, "properties": {"repobilityId": "4c5e9f9b90c2fbbe", "scanner": "scanner-primary", "fingerprint": "e6c9e5c21aae1a00", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/engineering/tdd/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-792ceedca28d381d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/engineering/code-review/SKILL.md"}, "properties": {"repobilityId": "786be9c30a466741", "scanner": "scanner-primary", "fingerprint": "792ceedca28d381d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/engineering/code-review/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1470c353dcfbb8bc", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/engineering/research/SKILL.md"}, "properties": {"repobilityId": "fb91c1dab39ea74f", "scanner": "scanner-primary", "fingerprint": "1470c353dcfbb8bc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/engineering/research/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-281651d1e9ac8376", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/engineering/prototype/SKILL.md"}, "properties": {"repobilityId": "013ccb7ca67cc290", "scanner": "scanner-primary", "fingerprint": "281651d1e9ac8376", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/engineering/prototype/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-707e8a1ec8dbf242", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/engineering/diagnosing-bugs/SKILL.md"}, "properties": {"repobilityId": "050bc8fa875f333c", "scanner": "scanner-primary", "fingerprint": "707e8a1ec8dbf242", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/engineering/diagnosing-bugs/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c8406f197c496699", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/engineering/setup-matt-pocock-skills/SKILL.md"}, "properties": {"repobilityId": "64967ba9c222eb45", "scanner": "scanner-primary", "fingerprint": "c8406f197c496699", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/engineering/setup-matt-pocock-skills/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-500c52aef6045905", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/in-progress/writing-beats/SKILL.md"}, "properties": {"repobilityId": "1f563ded36648db0", "scanner": "scanner-primary", "fingerprint": "500c52aef6045905", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/in-progress/writing-beats/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-baa966bf324ed03a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/in-progress/setup-ts-deep-modules/SKILL.md"}, "properties": {"repobilityId": "7fc0ed966b0a7540", "scanner": "scanner-primary", "fingerprint": "baa966bf324ed03a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/in-progress/setup-ts-deep-modules/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ddc21bcacaaf6735", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/in-progress/writing-shape/SKILL.md"}, "properties": {"repobilityId": "0e850f3133f4a3e4", "scanner": "scanner-primary", "fingerprint": "ddc21bcacaaf6735", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/in-progress/writing-shape/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f15d4cede869b3bd", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/in-progress/writing-fragments/SKILL.md"}, "properties": {"repobilityId": "ea6a7a9f8f1fe000", "scanner": "scanner-primary", "fingerprint": "f15d4cede869b3bd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/in-progress/writing-fragments/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9db68cd199ca8090", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/in-progress/claude-handoff/SKILL.md"}, "properties": {"repobilityId": "369b62c0b33a1e8a", "scanner": "scanner-primary", "fingerprint": "9db68cd199ca8090", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/in-progress/claude-handoff/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-266452a2a8acf816", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/personal/obsidian-vault/SKILL.md"}, "properties": {"repobilityId": "94babd3194e778c8", "scanner": "scanner-primary", "fingerprint": "266452a2a8acf816", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/personal/obsidian-vault/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0c8d5414b7476461", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/productivity/writing-great-skills/SKILL.md"}, "properties": {"repobilityId": "5bac778b6241f397", "scanner": "scanner-primary", "fingerprint": "0c8d5414b7476461", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/productivity/writing-great-skills/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68fac67010c0b510", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/productivity/grill-me/SKILL.md"}, "properties": {"repobilityId": "955d6e2c720168ec", "scanner": "scanner-primary", "fingerprint": "68fac67010c0b510", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/productivity/grill-me/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8bcfd69fe773e953", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/misc/setup-pre-commit/SKILL.md"}, "properties": {"repobilityId": "23c1e6d894f81bc4", "scanner": "scanner-primary", "fingerprint": "8bcfd69fe773e953", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/misc/setup-pre-commit/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5be9a7889e7cded3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/deprecated/qa/SKILL.md"}, "properties": {"repobilityId": "2bb7fe30ca38653d", "scanner": "scanner-primary", "fingerprint": "5be9a7889e7cded3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/deprecated/qa/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-954b5a884242c6ab", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in skills/deprecated/qa/SKILL.md"}, "properties": {"repobilityId": "5ed871add4794f7d", "scanner": "scanner-primary", "fingerprint": "954b5a884242c6ab", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/deprecated/qa/SKILL.md"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-1db9c7baf1241e51", "level": "error", "message": {"text": "SkillSpector P6 (prompt-injection) in skills/engineering/diagnosing-bugs/scripts/hitl-loop.template.sh"}, "properties": {"repobilityId": "c6dec942ffaf00b7", "scanner": "scanner-primary", "fingerprint": "1db9c7baf1241e51", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/engineering/diagnosing-bugs/scripts/hitl-loop.template.sh"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-f52e8a561868afd7", "level": "error", "message": {"text": "SkillSpector TM2 (tool-misuse) in skills/engineering/to-tickets/SKILL.md"}, "properties": {"repobilityId": "de5955f9d33e941f", "scanner": "scanner-primary", "fingerprint": "f52e8a561868afd7", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/engineering/to-tickets/SKILL.md"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-e2acda262976927f", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in skills/in-progress/batch-grill-me/SKILL.md"}, "properties": {"repobilityId": "756d5d76a6e06de0", "scanner": "scanner-primary", "fingerprint": "e2acda262976927f", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/in-progress/batch-grill-me/SKILL.md"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-e53ad62331b66b32", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in skills/in-progress/loop-me/SKILL.md"}, "properties": {"repobilityId": "74f5143d7e9d107b", "scanner": "scanner-primary", "fingerprint": "e53ad62331b66b32", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/in-progress/loop-me/SKILL.md"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "20c38bce952a639c", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "81a791102599e38e", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-5a5ac8d1c7117fb4", "level": "none", "message": {"text": "Commented-code block (7 lines) in skills/in-progress/setup-ts-deep-modules/dependency-cruiser.config.cjs:4"}, "properties": {"repobilityId": "e1351b5b4ba2290e", "scanner": "scanner-primary", "fingerprint": "5a5ac8d1c7117fb4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-596813c9235bd2e2", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 4.2.0: GHSA-52cp-r559-cp3m"}, "properties": {"repobilityId": "833c7df9337a4855", "scanner": "scanner-primary", "fingerprint": "596813c9235bd2e2", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-52cp-r559-cp3m", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8219c25f9b39ce12", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 3.14.2: GHSA-52cp-r559-cp3m"}, "properties": {"repobilityId": "55522dc7c85b667a", "scanner": "scanner-primary", "fingerprint": "8219c25f9b39ce12", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-52cp-r559-cp3m", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c521a37531a27594", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 3.14.2: GHSA-h67p-54hq-rp68"}, "properties": {"repobilityId": "7fd8c6f05bbc0277", "scanner": "scanner-primary", "fingerprint": "c521a37531a27594", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-h67p-54hq-rp68", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}]}]}