implement

ISSUES FOUND max severity HIGHSkillSpector Safe 0 registry mattpocock last scanned 1 scan

2 findings (1 high, 1 info), mainly policy violation, command injection. Most recent scan 2026-10-22.

Findings2
Critical0
High1
Medium0
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictSafe 0
Score0 / 100
Issues0
Version2.12.0 (static)

The two scanners disagree: Cisco rates this HIGH and SkillSpector found nothing. Check the false-positive register; signature matches on documentation are the usual cause. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Implement a piece of work based on a spec or set of tickets.

Package
2 files, 761 B
SKILL.md
83 words
Code
None. Instructions only.

Findings

HIGH Active instruction acquires and executes remote content Command Injectionstatic

SKILL.md contains an operative statement that explicitly coordinates remote content acquisition with execution.

SKILL.md:9

If the user passes a ticket reference, fetch it from the issue tracker and state its title before starting. If the reference is ambiguous, ask.
Remediation: Remove remote execution, or require a locally pinned artifact whose digest or signature is verified before a fixed allowlisted invocation.
INFO Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

What is in the package

FileKindSize
SKILL.mddoc622 B
agents/openai.yamlconfig139 B

Package contents recorded 2026-10-22 at commit 5beb35b040e3. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills