highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -I https://[service]/healthz" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -I https://[service]/healthz" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -I https://[service]/healthz" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -LsSf https://astral.sh/uv/install.sh" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -I https://[service]/healthz" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -LsSf https://astral.sh/uv/install.sh" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -I https://[service]/healthz" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
lowsecuritySECURITY_MD_MISSING
Plugins should publish a SECURITY.md file for responsible disclosure and support guidance.
Add a SECURITY.md file with reporting guidance and supported versions.
lowsecurityLICENSE_MISSING
Plugins should ship a LICENSE file so consumers can review usage rights.
Add a LICENSE file that matches the manifest license metadata.
infomanifest-validationPLUGIN_JSON_RECOMMENDED_HOMEPAGE
The manifest is missing the documented recommended field "homepage".
Add "homepage" to strengthen the plugin manifest metadata.
infomanifest-validationPLUGIN_JSON_INTERFACE_SHORTDESCRIPTION
The interface object is missing a valid "shortDescription" value.
Add a valid "shortDescription" field to the interface metadata.
infomanifest-validationPLUGIN_JSON_INTERFACE_LONGDESCRIPTION
The interface object is missing a valid "longDescription" value.
Add a valid "longDescription" field to the interface metadata.
infomanifest-validationPLUGIN_JSON_INTERFACE_CATEGORY
The interface object is missing a valid "category" value.
Add a valid "category" field to the interface metadata.
infomanifest-validationPLUGIN_JSON_INTERFACE_CAPABILITIES
The interface object is missing a valid "capabilities" value.
Add a valid "capabilities" field to the interface metadata.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_WEBSITEURL
The interface field "websiteURL" must use HTTPS or point to a safe in-repo asset.
Update "websiteURL" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_PRIVACYPOLICYURL
The interface field "privacyPolicyURL" must use HTTPS or point to a safe in-repo asset.
Update "privacyPolicyURL" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_TERMSOFSERVICEURL
The interface field "termsOfServiceURL" must use HTTPS or point to a safe in-repo asset.
Update "termsOfServiceURL" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_COMPOSERICON
The interface field "composerIcon" must use HTTPS or point to a safe in-repo asset.
Update "composerIcon" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_LOGO
The interface field "logo" must use HTTPS or point to a safe in-repo asset.
Update "logo" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_SCREENSHOTS
The interface field "screenshots" must use HTTPS or point to a safe in-repo asset.
Update "screenshots" to use HTTPS or an existing relative asset path.
infobest-practicesCODEXIGNORE_MISSING
A .codexignore file helps prevent accidental inclusion of local artifacts and secrets.
Add a .codexignore file with generated assets, local state, and secret paths.