highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -s http://127.0.0.1:<port>/sources" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
mediummarketplaceMARKETPLACE_POLICY_FIELDS_MISSING
plugin[0]: missing policy.authentication
Add policy.installation, policy.authentication, and category for each marketplace entry.
lowsecurityCLAUDE_VERSION_BAD_SEMVER
The version "0.1.0b5" does not match X.Y.Z.
Use semver in .claude-plugin/plugin.json.
lowoperational-securityDEPENDABOT_MISSINGReported 2 times
Automation or dependency surfaces exist, but .github/dependabot.yml is missing.
Add Dependabot updates for GitHub Actions and dependency manifests.
lowmanifest-validationPLUGIN_JSON_BAD_SEMVER
The version "0.1.0b5" does not match the documented semver format.
Use a version like 1.2.3 in plugin.json.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_PRIVACYPOLICYURL
The interface field "privacyPolicyURL" must use HTTPS or point to a safe in-repo asset.
Update "privacyPolicyURL" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_TERMSOFSERVICEURL
The interface field "termsOfServiceURL" must use HTTPS or point to a safe in-repo asset.
Update "termsOfServiceURL" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_COMPOSERICON
The interface field "composerIcon" must use HTTPS or point to a safe in-repo asset.
Update "composerIcon" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_LOGO
The interface field "logo" must use HTTPS or point to a safe in-repo asset.
Update "logo" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_SCREENSHOTS
The interface field "screenshots" must use HTTPS or point to a safe in-repo asset.
Update "screenshots" to use HTTPS or an existing relative asset path.
infobest-practicesCODEXIGNORE_MISSING
A .codexignore file helps prevent accidental inclusion of local artifacts and secrets.
Add a .codexignore file with generated assets, local state, and secret paths.