highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -fsSL https://raw.githubusercontent.com/johnpapa/ai-ready/main/skills/ai-ready/SKILL.md" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl --proto '=https' --tlsv1.2 -fsSL https://ollama.com/install.sh" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -LsSf https://astral.sh/uv/install.sh" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -v https://api.example.com/users/1" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl 'https://{custom_domain_name}/example?QueryString1=queryValue1" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl --proto '=https' --tlsv1.2 -fsSL https://aspire.dev/install.sh" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -sL https://aka.ms/InstallAzureCLIDeb" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
lowoperational-securityDEPENDABOT_MISSING
Automation or dependency surfaces exist, but .github/dependabot.yml is missing.
Add Dependabot updates for GitHub Actions and dependency manifests.
infomanifest-validationPLUGIN_JSON_RECOMMENDED_AUTHOR
The manifest is missing the documented recommended field "author".
Add "author" to strengthen the plugin manifest metadata.
infomanifest-validationPLUGIN_JSON_RECOMMENDED_LICENSE
The manifest is missing the documented recommended field "license".
Add "license" to strengthen the plugin manifest metadata.
infomanifest-validationPLUGIN_JSON_RECOMMENDED_KEYWORDS
The manifest is missing the documented recommended field "keywords".
Add "keywords" to strengthen the plugin manifest metadata.
infomanifest-validationPLUGIN_JSON_INTERFACE_SHORTDESCRIPTION
The interface object is missing a valid "shortDescription" value.
Add a valid "shortDescription" field to the interface metadata.
infomanifest-validationPLUGIN_JSON_INTERFACE_LONGDESCRIPTION
The interface object is missing a valid "longDescription" value.
Add a valid "longDescription" field to the interface metadata.
infomanifest-validationPLUGIN_JSON_INTERFACE_CAPABILITIES
The interface object is missing a valid "capabilities" value.
Add a valid "capabilities" field to the interface metadata.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_WEBSITEURL
The interface field "websiteURL" must use HTTPS or point to a safe in-repo asset.
Update "websiteURL" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_PRIVACYPOLICYURL
The interface field "privacyPolicyURL" must use HTTPS or point to a safe in-repo asset.
Update "privacyPolicyURL" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_TERMSOFSERVICEURL
The interface field "termsOfServiceURL" must use HTTPS or point to a safe in-repo asset.
Update "termsOfServiceURL" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_COMPOSERICON
The interface field "composerIcon" must use HTTPS or point to a safe in-repo asset.
Update "composerIcon" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_LOGO
The interface field "logo" must use HTTPS or point to a safe in-repo asset.
Update "logo" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_SCREENSHOTS
The interface field "screenshots" must use HTTPS or point to a safe in-repo asset.
Update "screenshots" to use HTTPS or an existing relative asset path.
infobest-practicesCODEXIGNORE_MISSING
A .codexignore file helps prevent accidental inclusion of local artifacts and secrets.
Add a .codexignore file with generated assets, local state, and secret paths.