iso-standards-readiness
Verdict safe, but 1 finding (1 low), mainly unauthorized tool use. Most recent scan 2026-10-21.
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Prepares and structurally reviews readiness evidence for ISO management-system and laboratory-competence standards - ISO 13485 medical device QMS, ISO 14971 device risk management, ISO/IEC 17025 testing and calibration laboratories, and ISO 15189 medical laboratories. Use when organizing declared scope, controlled documents, risk-management files, scope of accreditation, traceability, CAPA, external-provider controls, or bounded local evidence manifests, and when separating ISO certification from laboratory accreditation, FDA QMSR inspection, CLIA certification, MDSAP, and EU MDR/IVDR…
- Package
- 32 files, 267 KB
- SKILL.md
- 2084 words, 12+ sections
- Code
- Python (10)
- Allowed tools
ReadWriteBashGlob- License
- MIT
- Compatibility
- Python 3.11+; bundled CLIs use only the standard library and bounded local JSON/Markdown files, with no network access or credentials.
SKILL.md covers: ISO Standards Readiness Evidence Preparation · Purpose · Non-negotiable boundary · ISO and IEC copyright · Standards covered · Current baseline (read the ledger before any time-sensitive statement) · Keep the assurance lanes separate · Core workflow · Step 1: Declare the standard, purpose, and authorized owners · Step 2: Freeze source/version evidence · Step 3: Inventory controlled documents and records · Step 4: Review process implementation
Findings
LOW Code uses search/grep patterns but Grep tool not in allowed-tools Unauthorized Tool Usestatic
Skill restricts tools to ['Read', 'Write', 'Bash', 'Glob'] but code uses regex search patterns
SKILL.md
What is in the package
32 files, 267 KB. Show the list.
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 18 KB |
references/assurance-lanes.md | doc | 7.1 KB |
references/evidence-architecture.md | doc | 13 KB |
references/gap-analysis-checklist.md | doc | 19 KB |
references/iso-13485.md | doc | 12 KB |
references/iso-14971.md | doc | 9.3 KB |
references/iso-15189.md | doc | 12 KB |
references/iso-17025.md | doc | 12 KB |
references/quality-manual-guide.md | doc | 11 KB |
references/source-ledger.md | doc | 21 KB |
scripts/_catalog.py | script | 7.6 KB |
scripts/_common.py | script | 16 KB |
scripts/audit_document_records.py | script | 5.4 KB |
scripts/check_capa.py | script | 8.7 KB |
scripts/check_qmsr_transition.py | script | 5.5 KB |
scripts/check_supplier_controls.py | script | 5.6 KB |
scripts/check_traceability.py | script | 5.5 KB |
scripts/gap_analyzer.py | script | 5.5 KB |
scripts/validate_evidence_manifest.py | script | 8.2 KB |
scripts/validate_scope_intake.py | script | 7.1 KB |
assets/templates/capa-record-template.json | config | 2.9 KB |
assets/templates/document-register-template.json | config | 2.1 KB |
assets/templates/evidence-manifest-template.json | config | 2.0 KB |
assets/templates/laboratory-scope-intake-template.json | config | 3.3 KB |
assets/templates/medical-laboratory-scope-intake-template.json | config | 3.5 KB |
assets/templates/qmsr-transition-template.json | config | 9.4 KB |
assets/templates/quality-manual-template.md | doc | 9.2 KB |
assets/templates/scope-intake-template.json | config | 2.9 KB |
assets/templates/supplier-controls-template.json | config | 4.2 KB |
assets/templates/traceability-matrix-template.json | config | 4.3 KB |
assets/templates/procedures/CAPA-procedure-template.md | doc | 6.4 KB |
assets/templates/procedures/document-control-procedure-template.md | doc | 6.8 KB |
External hosts referenced
www.iso.org www.fda.gov www.ecfr.gov eur-lex.europa.eu www.cms.gov health.ec.europa.eu ilac.org www.mdsap.global webgate.ec.europa.eu global-aci.org iaf.nu www.federalregister.gov arxiv.org export.arxiv.org single-market-economy.ec.europa.eu www.bipm.org www.cap.org doi.org info.arxiv.org sys.global-aci.org www.imdrf.org
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit 593377bb0487. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Bytecode analyzer.
- Pipeline analyzer.
- Correlation analyzer.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/K-Dense-AI/scientific-agent-skills
- Raw scan result: skills-iso-standards-readiness-scan.json
- Badge for your README:
- Request a re-scan