{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-a9df38c68e32afbf", "name": "Insecure pattern 'eval_used' in .github/workflows/eval.yml:19", "shortDescription": {"text": "Insecure pattern 'eval_used' in .github/workflows/eval.yml:19"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-122306d0275ca17c", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "ludeeus/action-shellcheck@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-12e6c3cd8fc0d228", "name": "Node manifest has dependencies but no lockfile: tests/fixtures/audit-typescript-pure/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: tests/fixtures/audit-typescript-pure/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24aea8374db4f84c", "name": "Node manifest has dependencies but no lockfile: tests/fixtures/audit-react/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: tests/fixtures/audit-react/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dfdc18466328fefb", "name": "Node manifest has dependencies but no lockfile: tests/fixtures/audit-react-ts-overlap/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: tests/fixtures/audit-react-ts-overlap/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a7018cba488eec5c", "name": "Agent authority lacks a verifier contract: tests/fixtures/monorepo-laravel-boost/backend/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: tests/fixtures/monorepo-laravel-boost/backend/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc7a615a87969143", "name": "Agent authority lacks a verifier contract: tests/fixtures/brownfield-claude-mcp/.mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: tests/fixtures/brownfield-claude-mcp/.mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-799b914dac5b7101", "name": "Agent authority lacks a verifier contract: workflow/skills/grill-with-docs/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: workflow/skills/grill-with-docs/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1714c3024909f9b7", "name": "Agent authority lacks a verifier contract: workflow/skills/triage/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: workflow/skills/triage/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4d83e78c15adc35", "name": "Agent authority lacks a verifier contract: workflow/skills/next/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: workflow/skills/next/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-20eb2082037335d8", "name": "Agent instruction/config may expose a secret: workflow/skills/recommend-tools/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: workflow/skills/recommend-tools/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47e98d46d66ae482", "name": "Agent authority lacks a verifier contract: workflow/skills/audit-architecture-laravel/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: workflow/skills/audit-architecture-laravel/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3fa9fb9346717093", "name": "Agent authority lacks a verifier contract: workflow/skills/grill-me/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: workflow/skills/grill-me/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08686662588857d2", "name": "Agent authority lacks a verifier contract: workflow/skills/retro/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: workflow/skills/retro/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-424f2df2817ca336", "name": "Agent instruction contains unpinned remote install: workflow/skills/setup/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: workflow/skills/setup/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36ee62c7afb5cabf", "name": "Agent authority lacks a verifier contract: workflow/skills/zoom-out/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: workflow/skills/zoom-out/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df198d966da19a51", "name": "Agent authority lacks a verifier contract: workflow/skills/feedback/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: workflow/skills/feedback/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3ef5fd7a76f3923", "name": "Agent authority lacks a verifier contract: workflow/skills/setup-gh-workflow/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: workflow/skills/setup-gh-workflow/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8364b1126f3401a", "name": "Agent authority lacks a verifier contract: workflow/skills/phase/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: workflow/skills/phase/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23467"}, "properties": {"repository": "yusufkaracaburun/ai-kit", "repoUrl": "https://github.com/yusufkaracaburun/ai-kit", "branch": "main"}, "results": [{"ruleId": "scanner-a9df38c68e32afbf", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in .github/workflows/eval.yml:19"}, "properties": {"repobilityId": "817ca206e3bf372b", "scanner": "scanner-primary", "fingerprint": "a9df38c68e32afbf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/eval.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-122306d0275ca17c", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "913400b91f0f77e6", "scanner": "scanner-primary", "fingerprint": "122306d0275ca17c", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-12e6c3cd8fc0d228", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: tests/fixtures/audit-typescript-pure/package.json"}, "properties": {"repobilityId": "d0a14f75c8a3b035", "scanner": "scanner-primary", "fingerprint": "12e6c3cd8fc0d228", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fixtures/audit-typescript-pure/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24aea8374db4f84c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: tests/fixtures/audit-react/package.json"}, "properties": {"repobilityId": "ca5d9833e49f8915", "scanner": "scanner-primary", "fingerprint": "24aea8374db4f84c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fixtures/audit-react/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dfdc18466328fefb", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: tests/fixtures/audit-react-ts-overlap/package.json"}, "properties": {"repobilityId": "be7bdff9edeab07c", "scanner": "scanner-primary", "fingerprint": "dfdc18466328fefb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fixtures/audit-react-ts-overlap/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "fe6d1fb34f0dd082", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "1f8ada7b26bedd9b", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "d79ae51ab9e4b5ca", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-a7018cba488eec5c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: tests/fixtures/monorepo-laravel-boost/backend/AGENTS.md"}, "properties": {"repobilityId": "cbf5ba4362f152d7", "scanner": "scanner-primary", "fingerprint": "a7018cba488eec5c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fixtures/monorepo-laravel-boost/backend/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc7a615a87969143", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: tests/fixtures/brownfield-claude-mcp/.mcp.json"}, "properties": {"repobilityId": "5bf7b959c1659539", "scanner": "scanner-primary", "fingerprint": "bc7a615a87969143", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/fixtures/brownfield-claude-mcp/.mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-799b914dac5b7101", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: workflow/skills/grill-with-docs/SKILL.md"}, "properties": {"repobilityId": "cc22c6da782bd214", "scanner": "scanner-primary", "fingerprint": "799b914dac5b7101", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workflow/skills/grill-with-docs/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1714c3024909f9b7", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: workflow/skills/triage/SKILL.md"}, "properties": {"repobilityId": "40e240ad55ac4bb9", "scanner": "scanner-primary", "fingerprint": "1714c3024909f9b7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workflow/skills/triage/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a4d83e78c15adc35", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: workflow/skills/next/SKILL.md"}, "properties": {"repobilityId": "1eac0dd9db9ea917", "scanner": "scanner-primary", "fingerprint": "a4d83e78c15adc35", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workflow/skills/next/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-20eb2082037335d8", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: workflow/skills/recommend-tools/SKILL.md"}, "properties": {"repobilityId": "c31eaa4c05c7c499", "scanner": "scanner-primary", "fingerprint": "20eb2082037335d8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workflow/skills/recommend-tools/SKILL.md"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-47e98d46d66ae482", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: workflow/skills/audit-architecture-laravel/SKILL.md"}, "properties": {"repobilityId": "fd495c85ace1b1bd", "scanner": "scanner-primary", "fingerprint": "47e98d46d66ae482", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workflow/skills/audit-architecture-laravel/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3fa9fb9346717093", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: workflow/skills/grill-me/SKILL.md"}, "properties": {"repobilityId": "8d847077ac0c308f", "scanner": "scanner-primary", "fingerprint": "3fa9fb9346717093", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workflow/skills/grill-me/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08686662588857d2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: workflow/skills/retro/SKILL.md"}, "properties": {"repobilityId": "558f7c4ceed2355b", "scanner": "scanner-primary", "fingerprint": "08686662588857d2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workflow/skills/retro/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-424f2df2817ca336", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: workflow/skills/setup/SKILL.md"}, "properties": {"repobilityId": "487be9b605965d55", "scanner": "scanner-primary", "fingerprint": "424f2df2817ca336", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workflow/skills/setup/SKILL.md"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-36ee62c7afb5cabf", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: workflow/skills/zoom-out/SKILL.md"}, "properties": {"repobilityId": "c0df0dfa8da381b6", "scanner": "scanner-primary", "fingerprint": "36ee62c7afb5cabf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workflow/skills/zoom-out/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df198d966da19a51", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: workflow/skills/feedback/SKILL.md"}, "properties": {"repobilityId": "47b4c2badcc56e43", "scanner": "scanner-primary", "fingerprint": "df198d966da19a51", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workflow/skills/feedback/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c3ef5fd7a76f3923", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: workflow/skills/setup-gh-workflow/SKILL.md"}, "properties": {"repobilityId": "8c18c2671917ec9c", "scanner": "scanner-primary", "fingerprint": "c3ef5fd7a76f3923", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workflow/skills/setup-gh-workflow/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f8364b1126f3401a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: workflow/skills/phase/SKILL.md"}, "properties": {"repobilityId": "f938e628b6c945a5", "scanner": "scanner-primary", "fingerprint": "f8364b1126f3401a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workflow/skills/phase/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}]}]}