{"query":"Vulnerability Scanning & Assessment","filters":{"category":null,"platform":null,"track":null,"safety":null,"include_blocked":false,"min_stars":0},"total":10,"skills":[{"rank":1,"match_type":"exact","match_score":99,"raw_match_score":1233.4,"semantic_relevance":100,"ranking_signals":{"retrieval":1209,"semantic":100,"quality":11.4,"projectPopularity":13,"verifiedOutcomes":0,"verifiedSource":0},"slug":"masriyan-vulnerability-scanning-assessment","name":"Vulnerability Scanning & Assessment","description":"Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting","tagline":"Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting","category":"security","tags":["cybersecurity","vulnerability","scanning","cve","cvss","audit","assessment","dependency","agent-skill"],"author":{"name":"Masriyan","verified":false,"url":"https://github.com/Masriyan"},"attribution":{"status":"registry_indexed","statusLabel":"Registry indexed","shortLabel":"REGISTRY INDEXED","sourceLabel":"github candidate review","sourceDetail":"Masriyan/Claude-Code-CyberSecurity-Skill","creatorName":"Masriyan","creatorUrl":"https://github.com/Masriyan","sourceUrl":"https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner","indexedBy":"OpenAgentSkill community index","claimUrl":"https://www.openagentskill.com/skills/masriyan-vulnerability-scanning-assessment#claim-this-skill","claimCta":"Claim this skill","trustNote":"This listing was indexed from public sources and is not marked official until a maintainer claim is approved.","publicNote":"Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals."},"stats":{"stars":397,"forks":75,"verified_installs":0,"install_attempts":0,"successful_runs":0,"total_outcomes":0,"downloads":0,"rating":0,"review_count":0,"quality_score":45.45},"quality":{"score":71,"tier":"strong","label":"Strong","summary":"Solid option that is likely worth shortlisting for production workflows.","signals":[{"label":"GitHub stars","value":"397","tone":"neutral"},{"label":"Freshness","value":"2d ago","tone":"positive"},{"label":"Install ready","value":"Yes","tone":"positive"},{"label":"License","value":"MIT","tone":"neutral"}],"warnings":["The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use."]},"trust":{"version":"trust-score-v4","score":72,"tier":"strong","label":"Strong shortlist","summary":"Good trust signals with a few areas worth checking before rollout.","recommendedAction":"Test in a sandbox workflow and compare its install path with close alternatives.","dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":62,"weight":0.13,"status":"info","detail":"397 GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":62,"weight":0.08,"status":"info","detail":"397 stars, 75 forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":100,"weight":0.14,"status":"pass","detail":"2d since push"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"MIT"},{"id":"documentation","label":"README/SKILL.md completeness","score":60,"weight":0.14,"status":"warn","detail":"Public metadata needs stronger README/SKILL.md context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":90,"weight":0.12,"status":"pass","detail":"no major dependency risk hints in public metadata"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Vulnerability Scanning & Assessment"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":100,"weight":0.07,"status":"pass","detail":"no high-risk permission surface in public metadata"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner"},{"id":"review_status","label":"Review status","score":66,"weight":0.05,"status":"info","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"info","label":"GitHub adoption","detail":"397 GitHub stars"},{"status":"info","label":"Stars/forks activity","detail":"397 stars, 75 forks; issue activity unavailable in current metadata"},{"status":"pass","label":"Recent maintenance","detail":"2d since push"},{"status":"pass","label":"License clarity","detail":"MIT"},{"status":"warn","label":"README/SKILL.md completeness","detail":"Public metadata needs stronger README/SKILL.md context"},{"status":"pass","label":"Dependency/runtime risk","detail":"no major dependency risk hints in public metadata"},{"status":"pass","label":"Install availability","detail":"npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Vulnerability Scanning & Assessment"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"pass","label":"Permission surface","detail":"no high-risk permission surface in public metadata"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner"},{"status":"info","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"warn","label":"Ownership","detail":"No approved owner claim yet"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["AI review approved","Install path is available","Repository evidence is available","Recently maintained repository","Install command has no obvious high-risk pattern"],"warnings":["The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"evidence":{"stars":"397 GitHub stars","repoActivity":"397 stars, 75 forks","lastPushed":"2d since push","license":"MIT","repository":"https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner","install":"npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Vulnerability Scanning & Assessment","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"installReadiness":{"ready":true,"command":"npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Vulnerability Scanning & Assessment","policy":"human_review_before_install","label":"Human review before install","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","2d since push"]},"agentCompatibility":["Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"medium","label":"Review before production","notes":["The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":false,"sandboxRequired":true,"policy":"human_review_before_install","reason":"Human review or sandbox validation is required before automatic installation."},"bestFor":["security","cybersecurity","vulnerability","scanning","cve","cvss"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface","Automatic installation in a production workspace"],"knownRisks":["The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety":{"score":67,"level":"review_before_install","label":"Review before install","safety_tier":{"tier":"reviewed","label":"Reviewed with permission notes","badge":"REVIEWED","summary":"Usable candidate, but the agent should surface permission and audit notes before installation.","recommended_action":"Require human approval before installing into a real workspace.","auto_install_policy":"review","reasons":["Documentation summary is thin","67/100 agent safety score"]},"auto_install_allowed":false,"human_review_required":true,"blocked":false,"audit_risk":"needs_review","permission_hints":[{"id":"network","label":"Network access","reason":"Skill likely fetches remote pages, APIs, repositories, or external services.","severity":"medium"}],"policy_warnings":["Documentation summary is thin"],"constraints_applied":{"max_risk":"medium","needs_install_command":true,"min_stars":0}},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","badge":"REVIEWED","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace.","reasons":["Documentation summary is thin","67/100 agent safety score"]},"supply_profile":{"track":{"slug":"coding","label":"Coding and developer agents","shortLabel":"Coding","description":"Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills."},"scenario":{"label":"Coding agents","description":"I need a coding agent that can understand a repository, edit code, and review pull requests.","useCases":[{"slug":"security-compliance","title":"Security and compliance"},{"slug":"coding-agents","title":"Coding agents"},{"slug":"research-agents","title":"Research agents"}]},"applicableAgents":["Claude Code","CLI","Codex","Cursor"],"install":{"ready":true,"command":"npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Vulnerability Scanning & Assessment","primaryTarget":"CLI","targetCount":4},"githubQuality":{"stars":397,"starsLabel":"397","forks":75,"license":"MIT","qualityScore":71,"trustScore":72,"auditScore":79},"maintenance":{"status":"fresh","label":"2d since push","daysSincePush":2,"lastPushedAt":"2026-09-03T08:31:38+00:00"},"risk":{"level":"needs_review","label":"Needs review","requiresReview":true,"notes":["Documentation summary is thin","The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use.","The SKILL.md excerpt is truncated, but the provided content is comprehensive; however, the full documentation may lack a dedicated 'Limitations' section.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"coverageTags":["Coding","Coding agents","security","cybersecurity","vulnerability","scanning","cve","cvss"]},"audit":{"audit_score":79,"risk_level":"needs_review","risk_label":"Needs review","warnings":["Documentation summary is thin","The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use.","The SKILL.md excerpt is truncated, but the provided content is comprehensive; however, the full documentation may lack a dedicated 'Limitations' section.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"decision":{"readiness_score":70,"readiness_label":"Prototype first","headline":"Fallback candidate for Security and compliance","role":"Fallback candidate","primary_fit":"Security and compliance","best_for":["Security and compliance workflows","Claude Code teams","builders willing to evaluate younger projects"],"risks":["The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use.","No OpenAgentSkill engagement data yet"],"next_steps":["Install it in a sandbox agent and run one Security and compliance task end to end.","Compare output quality, latency, and failure behavior against at least one alternative.","Promote it into production only after reviewing repository permissions, license, and maintenance signals."]},"agent_readable_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"masriyan-vulnerability-scanning-assessment","name":"Vulnerability Scanning & Assessment","description":"Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting","category":"security","url":"https://www.openagentskill.com/skills/masriyan-vulnerability-scanning-assessment","repository":"https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner","github_repo":"Masriyan/Claude-Code-CyberSecurity-Skill"},"suited_tasks":["Security and compliance workflows","Claude Code teams","builders willing to evaluate younger projects","Inspect risky files","Prioritize findings","Explain remediation steps","Inspect source files","Explain architecture"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Vulnerability Scanning & Assessment","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add masriyan-vulnerability-scanning-assessment"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"Vulnerability Scanning & Assessment\" agent skill from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"masriyan-vulnerability-scanning-assessment\",\"task\":\"Install Vulnerability Scanning & Assessment\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"Vulnerability Scanning & Assessment\" as a Claude Code skill from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"masriyan-vulnerability-scanning-assessment\",\"task\":\"Install Vulnerability Scanning & Assessment\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"Vulnerability Scanning & Assessment\" from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"masriyan-vulnerability-scanning-assessment\",\"task\":\"Install Vulnerability Scanning & Assessment\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/masriyan-vulnerability-scanning-assessment/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/masriyan-vulnerability-scanning-assessment"},"trust":{"score":72,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"397 GitHub stars","repoActivity":"397 stars, 75 forks","lastPushed":"2d since push","license":"MIT","repository":"https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner","install":"npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Vulnerability Scanning & Assessment","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","cybersecurity","vulnerability","scanning","cve","cvss"],"known_risks":["The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":79,"risk_level":"needs_review","risk_label":"Needs review","warnings":["Documentation summary is thin","The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use.","The SKILL.md excerpt is truncated, but the provided content is comprehensive; however, the full documentation may lack a dedicated 'Limitations' section.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace."},"quality":{"score":71,"label":"Strong"},"supply":{"track":"Coding and developer agents","scenario":"Coding agents","maintenance":"2d since push","risk":"Needs review"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","production agents without a repository review","The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use.","No OpenAgentSkill engagement data yet","Documentation summary is thin","The SKILL.md excerpt is truncated, but the provided content is comprehensive; however, the full documentation may lack a dedicated 'Limitations' section.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"agent_contract":{"task_input":"Use Vulnerability Scanning & Assessment in an agent workflow","recommended_action":"Require human approval before installing into a real workspace.","install_policy":"review","minimum_review_before_use":["Trust: 72/100 Strong shortlist","Audit: 79/100 Needs review","Safety: 67/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"masriyan-vulnerability-scanning-assessment (Vulnerability Scanning & Assessment)","install_command":"npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Vulnerability Scanning & Assessment","risk_summary":"Needs review; Reviewed with permission notes; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"masriyan-vulnerability-scanning-assessment","task":"Use Vulnerability Scanning & Assessment in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/masriyan-vulnerability-scanning-assessment","api":"https://www.openagentskill.com/api/agent/skills/masriyan-vulnerability-scanning-assessment","audit":"https://www.openagentskill.com/skills/masriyan-vulnerability-scanning-assessment/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=masriyan-vulnerability-scanning-assessment&task=Use%20Vulnerability%20Scanning%20%26%20Assessment%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20Vulnerability%20Scanning%20%26%20Assessment%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20Vulnerability%20Scanning%20%26%20Assessment%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/masriyan-vulnerability-scanning-assessment/install","manifest":"https://www.openagentskill.com/api/registry/manifest/masriyan-vulnerability-scanning-assessment"}},"machine_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"masriyan-vulnerability-scanning-assessment","name":"Vulnerability Scanning & Assessment","description":"Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting","category":"security","url":"https://www.openagentskill.com/skills/masriyan-vulnerability-scanning-assessment","repository":"https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner","github_repo":"Masriyan/Claude-Code-CyberSecurity-Skill"},"suited_tasks":["Security and compliance workflows","Claude Code teams","builders willing to evaluate younger projects","Inspect risky files","Prioritize findings","Explain remediation steps","Inspect source files","Explain architecture"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Vulnerability Scanning & Assessment","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add masriyan-vulnerability-scanning-assessment"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"Vulnerability Scanning & Assessment\" agent skill from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"masriyan-vulnerability-scanning-assessment\",\"task\":\"Install Vulnerability Scanning & Assessment\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"Vulnerability Scanning & Assessment\" as a Claude Code skill from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"masriyan-vulnerability-scanning-assessment\",\"task\":\"Install Vulnerability Scanning & Assessment\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"Vulnerability Scanning & Assessment\" from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"masriyan-vulnerability-scanning-assessment\",\"task\":\"Install Vulnerability Scanning & Assessment\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/masriyan-vulnerability-scanning-assessment/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/masriyan-vulnerability-scanning-assessment"},"trust":{"score":72,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"397 GitHub stars","repoActivity":"397 stars, 75 forks","lastPushed":"2d since push","license":"MIT","repository":"https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner","install":"npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Vulnerability Scanning & Assessment","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","cybersecurity","vulnerability","scanning","cve","cvss"],"known_risks":["The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":79,"risk_level":"needs_review","risk_label":"Needs review","warnings":["Documentation summary is thin","The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use.","The SKILL.md excerpt is truncated, but the provided content is comprehensive; however, the full documentation may lack a dedicated 'Limitations' section.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace."},"quality":{"score":71,"label":"Strong"},"supply":{"track":"Coding and developer agents","scenario":"Coding agents","maintenance":"2d since push","risk":"Needs review"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","production agents without a repository review","The skill does not explicitly state that scanning should only be performed on systems the user owns or has explicit permission to test, which could lead to unauthorized use.","No OpenAgentSkill engagement data yet","Documentation summary is thin","The SKILL.md excerpt is truncated, but the provided content is comprehensive; however, the full documentation may lack a dedicated 'Limitations' section.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"agent_contract":{"task_input":"Use Vulnerability Scanning & Assessment in an agent workflow","recommended_action":"Require human approval before installing into a real workspace.","install_policy":"review","minimum_review_before_use":["Trust: 72/100 Strong shortlist","Audit: 79/100 Needs review","Safety: 67/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"masriyan-vulnerability-scanning-assessment (Vulnerability Scanning & Assessment)","install_command":"npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Vulnerability Scanning & Assessment","risk_summary":"Needs review; Reviewed with permission notes; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"masriyan-vulnerability-scanning-assessment","task":"Use Vulnerability Scanning & Assessment in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/masriyan-vulnerability-scanning-assessment","api":"https://www.openagentskill.com/api/agent/skills/masriyan-vulnerability-scanning-assessment","audit":"https://www.openagentskill.com/skills/masriyan-vulnerability-scanning-assessment/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=masriyan-vulnerability-scanning-assessment&task=Use%20Vulnerability%20Scanning%20%26%20Assessment%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20Vulnerability%20Scanning%20%26%20Assessment%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20Vulnerability%20Scanning%20%26%20Assessment%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/masriyan-vulnerability-scanning-assessment/install","manifest":"https://www.openagentskill.com/api/registry/manifest/masriyan-vulnerability-scanning-assessment"}},"platforms":["Claude Code"],"use_cases":[{"slug":"security-compliance","title":"Security and compliance","url":"https://www.openagentskill.com/use-cases/security-compliance"},{"slug":"coding-agents","title":"Coding agents","url":"https://www.openagentskill.com/use-cases/coding-agents"},{"slug":"research-agents","title":"Research agents","url":"https://www.openagentskill.com/use-cases/research-agents"},{"slug":"github-automation","title":"GitHub automation","url":"https://www.openagentskill.com/use-cases/github-automation"}],"install":"npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Vulnerability Scanning & Assessment","install_targets":[{"id":"openagentskill-cli","label":"CLI","title":"OpenAgentSkill CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add masriyan-vulnerability-scanning-assessment","description":"Resolve policy, run the source installer safely, and report a verified install receipt.","copyLabel":"Copy command"},{"id":"codex","label":"Codex","title":"Codex install prompt","kind":"agent-prompt","value":"Install the \"Vulnerability Scanning & Assessment\" agent skill from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"masriyan-vulnerability-scanning-assessment\",\"task\":\"Install Vulnerability Scanning & Assessment\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Give Codex a repo-aware install prompt when the skill is not available through a local CLI.","copyLabel":"Copy prompt"},{"id":"claude-code","label":"Claude Code","title":"Claude Code skill prompt","kind":"agent-prompt","value":"Add \"Vulnerability Scanning & Assessment\" as a Claude Code skill from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"masriyan-vulnerability-scanning-assessment\",\"task\":\"Install Vulnerability Scanning & Assessment\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this prompt to ask Claude Code to add the skill and explain the local activation steps.","copyLabel":"Copy prompt"},{"id":"cursor","label":"Cursor","title":"Cursor rule prompt","kind":"agent-prompt","value":"Turn \"Vulnerability Scanning & Assessment\" from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"masriyan-vulnerability-scanning-assessment\",\"task\":\"Install Vulnerability Scanning & Assessment\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this when installing as Cursor project rules or reusable agent instructions.","copyLabel":"Copy prompt"}],"repository":"https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner","github_repo":"Masriyan/Claude-Code-CyberSecurity-Skill","version":"3.0.0","license":"MIT","updated_at":"2026-09-05T18:12:50.213745+00:00","canonical_key":"masriyan/claude-code-cybersecurity-skill#skills/02-vulnerability-scanner","recommendation_reasons":["Matches task terms: vulnerability, scanning, assessment","Install handoff is available","Repository freshness signal is available","Registry match score 99"],"urls":{"web":"https://www.openagentskill.com/skills/masriyan-vulnerability-scanning-assessment","api":"https://www.openagentskill.com/api/agent/skills/masriyan-vulnerability-scanning-assessment","install_api":"https://www.openagentskill.com/api/skills/masriyan-vulnerability-scanning-assessment/install","audit":"https://www.openagentskill.com/skills/masriyan-vulnerability-scanning-assessment/audit","repository":"https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/02-vulnerability-scanner"}},{"rank":2,"match_type":"related","match_score":33,"raw_match_score":414.9,"semantic_relevance":64,"ranking_signals":{"retrieval":369,"semantic":64,"quality":17.9,"projectPopularity":22,"verifiedOutcomes":0,"verifiedSource":6},"slug":"projectdiscovery-nuclei","name":"Nuclei","description":"Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.","tagline":"Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.","category":"security","tags":["security","scanner","attack-surface","cve-scanner","dast","hacktoberfest","nuclei-engine","security-scanner","subdomain-takeover","vulnerability-assessment"],"author":{"name":"projectdiscovery","verified":true,"url":"https://github.com/projectdiscovery"},"attribution":{"status":"community_indexed","statusLabel":"Community indexed","shortLabel":"COMMUNITY INDEXED","sourceLabel":"GitHub star discovery","sourceDetail":"projectdiscovery/nuclei","creatorName":"projectdiscovery","creatorUrl":"https://github.com/projectdiscovery","sourceUrl":"https://github.com/projectdiscovery/nuclei","indexedBy":"OpenAgentSkill community index","claimUrl":"https://www.openagentskill.com/skills/projectdiscovery-nuclei#claim-this-skill","claimCta":"Claim this skill","trustNote":"This listing was indexed from public sources and is not marked official until a maintainer claim is approved.","publicNote":"Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals."},"stats":{"stars":29159,"forks":3484,"verified_installs":0,"install_attempts":0,"successful_runs":0,"total_outcomes":0,"downloads":0,"rating":0,"review_count":0,"quality_score":71.45},"quality":{"score":100,"tier":"excellent","label":"Excellent","summary":"High-confidence pick with strong adoption and healthy maintenance signals.","signals":[{"label":"GitHub stars","value":"29K","tone":"positive"},{"label":"Freshness","value":"3mo ago","tone":"positive"},{"label":"Install ready","value":"Yes","tone":"positive"},{"label":"License","value":"MIT","tone":"neutral"}],"warnings":[]},"trust":{"version":"trust-score-v4","score":90,"tier":"production","label":"Production candidate","summary":"Strong OpenAgentSkill Trust Score across adoption, recent maintenance, license clarity, documentation, dependency/runtime risk, install safety, permission surface, and install availability.","recommendedAction":"Shortlist for production use, then run a normal repository and dependency review.","dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":100,"weight":0.13,"status":"pass","detail":"29K GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":97,"weight":0.08,"status":"pass","detail":"29K stars, 3.5K forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":88,"weight":0.14,"status":"pass","detail":"3mo since push"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"MIT"},{"id":"documentation","label":"README/SKILL.md completeness","score":66,"weight":0.14,"status":"info","detail":"Public metadata needs stronger README/SKILL.md context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":90,"weight":0.12,"status":"pass","detail":"no major dependency risk hints in public metadata"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add projectdiscovery/nuclei"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":100,"weight":0.07,"status":"pass","detail":"no high-risk permission surface in public metadata"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/projectdiscovery/nuclei"},{"id":"review_status","label":"Review status","score":88,"weight":0.05,"status":"pass","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"pass","label":"GitHub adoption","detail":"29K GitHub stars"},{"status":"pass","label":"Stars/forks activity","detail":"29K stars, 3.5K forks; issue activity unavailable in current metadata"},{"status":"pass","label":"Recent maintenance","detail":"3mo since push"},{"status":"pass","label":"License clarity","detail":"MIT"},{"status":"info","label":"README/SKILL.md completeness","detail":"Public metadata needs stronger README/SKILL.md context"},{"status":"pass","label":"Dependency/runtime risk","detail":"no major dependency risk hints in public metadata"},{"status":"pass","label":"Install availability","detail":"npx skills add projectdiscovery/nuclei"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"pass","label":"Permission surface","detail":"no high-risk permission surface in public metadata"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/projectdiscovery/nuclei"},{"status":"pass","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"pass","label":"Ownership","detail":"Listing manually verified"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["Manually verified listing","AI review approved","Install path is available","Repository evidence is available","Recently maintained repository","Large GitHub adoption signal","Install command has no obvious high-risk pattern"],"warnings":["Documentation summary is thin"],"evidence":{"stars":"29K GitHub stars","repoActivity":"29K stars, 3.5K forks","lastPushed":"3mo since push","license":"MIT","repository":"https://github.com/projectdiscovery/nuclei","install":"npx skills add projectdiscovery/nuclei","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Usable metadata, review docs","agentOutcomes":"No agent outcome data yet"},"installReadiness":{"ready":true,"command":"npx skills add projectdiscovery/nuclei","policy":"agent_install_candidate","label":"Agent install candidate","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","3mo since push"]},"agentCompatibility":["Go","Security","Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"low","label":"Low metadata risk","notes":["Documentation summary is thin"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":true,"sandboxRequired":true,"policy":"agent_install_candidate","reason":"Trust Score v4 allows sandbox-first agent installation after normal workspace review."},"bestFor":["security","scanner","attack-surface","cve-scanner","dast","hacktoberfest"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"knownRisks":["Documentation summary is thin"]},"safety":{"score":81,"level":"review_before_install","label":"Review before install","safety_tier":{"tier":"reviewed","label":"Reviewed","badge":"REVIEWED","summary":"Good audit and safety signals with no high-risk permission hints in public metadata.","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","auto_install_policy":"review","reasons":["Safe-to-try audit","81/100 agent safety score"]},"auto_install_allowed":false,"human_review_required":true,"blocked":false,"audit_risk":"safe_to_try","permission_hints":[{"id":"network","label":"Network access","reason":"Skill likely fetches remote pages, APIs, repositories, or external services.","severity":"medium"}],"policy_warnings":["Documentation summary is thin"],"constraints_applied":{"max_risk":"medium","needs_install_command":true,"min_stars":0}},"safety_gate":{"tier":"reviewed","label":"Reviewed","badge":"REVIEWED","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","reasons":["Safe-to-try audit","81/100 agent safety score"]},"supply_profile":{"track":{"slug":"coding","label":"Coding and developer agents","shortLabel":"Coding","description":"Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills."},"scenario":{"label":"Coding agents","description":"I need a coding agent that can understand a repository, edit code, and review pull requests.","useCases":[{"slug":"security-compliance","title":"Security and compliance"},{"slug":"browser-automation","title":"Browser automation"},{"slug":"local-desktop","title":"Local desktop"}]},"applicableAgents":["CLI","Codex","Claude Code","Cursor","Go"],"install":{"ready":true,"command":"npx skills add projectdiscovery/nuclei","primaryTarget":"CLI","targetCount":4},"githubQuality":{"stars":29159,"starsLabel":"29K","forks":3484,"license":"MIT","qualityScore":100,"trustScore":90,"auditScore":93},"maintenance":{"status":"active","label":"3mo since push","daysSincePush":84,"lastPushedAt":"2026-06-13T15:43:40+00:00"},"risk":{"level":"safe_to_try","label":"Safe to try","requiresReview":true,"notes":["Documentation summary is thin"]},"coverageTags":["Coding","Coding agents","security","scanner","attack-surface","cve-scanner","dast","hacktoberfest"]},"audit":{"audit_score":93,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Documentation summary is thin"]},"decision":{"readiness_score":100,"readiness_label":"Production-ready","headline":"Primary pick for Security and compliance","role":"Primary pick","primary_fit":"Security and compliance","best_for":["Security and compliance workflows","general agent builders","teams that value GitHub adoption signals"],"risks":["No OpenAgentSkill engagement data yet"],"next_steps":["Install it in a sandbox agent and run one Security and compliance task end to end.","Compare output quality, latency, and failure behavior against at least one alternative.","Promote it into production only after reviewing repository permissions, license, and maintenance signals."]},"agent_readable_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"projectdiscovery-nuclei","name":"Nuclei","description":"Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.","category":"security","url":"https://www.openagentskill.com/skills/projectdiscovery-nuclei","repository":"https://github.com/projectdiscovery/nuclei","github_repo":"projectdiscovery/nuclei"},"suited_tasks":["Security and compliance workflows","general agent builders","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Navigate pages","Click and type safely"],"suited_agents":["Go","Security","Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add projectdiscovery/nuclei","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add projectdiscovery-nuclei"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"Nuclei\" agent skill from https://github.com/projectdiscovery/nuclei. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"projectdiscovery-nuclei\",\"task\":\"Install Nuclei\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"Nuclei\" as a Claude Code skill from https://github.com/projectdiscovery/nuclei. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"projectdiscovery-nuclei\",\"task\":\"Install Nuclei\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"Nuclei\" from https://github.com/projectdiscovery/nuclei into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"projectdiscovery-nuclei\",\"task\":\"Install Nuclei\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/projectdiscovery-nuclei/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/projectdiscovery-nuclei"},"trust":{"score":90,"label":"Production candidate","version":"trust-score-v4","install_policy":"agent_install_candidate","evidence":{"stars":"29K GitHub stars","repoActivity":"29K stars, 3.5K forks","lastPushed":"3mo since push","license":"MIT","repository":"https://github.com/projectdiscovery/nuclei","install":"npx skills add projectdiscovery/nuclei","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Usable metadata, review docs","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":true,"sandbox_required":true,"reason":"Trust Score v4 allows sandbox-first agent installation after normal workspace review."},"best_for":["security","scanner","attack-surface","cve-scanner","dast","hacktoberfest"],"known_risks":["Documentation summary is thin"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":93,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Documentation summary is thin"]},"safety_gate":{"tier":"reviewed","label":"Reviewed","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow."},"quality":{"score":100,"label":"Excellent"},"supply":{"track":"Coding and developer agents","scenario":"Coding agents","maintenance":"3mo since push","risk":"Safe to try"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","high-compliance environments without internal security review","No OpenAgentSkill engagement data yet","Documentation summary is thin","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"agent_contract":{"task_input":"Use Nuclei in an agent workflow","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","install_policy":"review","minimum_review_before_use":["Trust: 90/100 Production candidate","Audit: 93/100 Safe to try","Safety: 81/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"projectdiscovery-nuclei (Nuclei)","install_command":"npx skills add projectdiscovery/nuclei","risk_summary":"Safe to try; Reviewed; Low metadata risk","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"projectdiscovery-nuclei","task":"Use Nuclei in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/projectdiscovery-nuclei","api":"https://www.openagentskill.com/api/agent/skills/projectdiscovery-nuclei","audit":"https://www.openagentskill.com/skills/projectdiscovery-nuclei/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=projectdiscovery-nuclei&task=Use%20Nuclei%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20Nuclei%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20Nuclei%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/projectdiscovery-nuclei/install","manifest":"https://www.openagentskill.com/api/registry/manifest/projectdiscovery-nuclei"}},"machine_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"projectdiscovery-nuclei","name":"Nuclei","description":"Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.","category":"security","url":"https://www.openagentskill.com/skills/projectdiscovery-nuclei","repository":"https://github.com/projectdiscovery/nuclei","github_repo":"projectdiscovery/nuclei"},"suited_tasks":["Security and compliance workflows","general agent builders","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Navigate pages","Click and type safely"],"suited_agents":["Go","Security","Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add projectdiscovery/nuclei","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add projectdiscovery-nuclei"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"Nuclei\" agent skill from https://github.com/projectdiscovery/nuclei. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"projectdiscovery-nuclei\",\"task\":\"Install Nuclei\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"Nuclei\" as a Claude Code skill from https://github.com/projectdiscovery/nuclei. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"projectdiscovery-nuclei\",\"task\":\"Install Nuclei\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"Nuclei\" from https://github.com/projectdiscovery/nuclei into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"projectdiscovery-nuclei\",\"task\":\"Install Nuclei\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/projectdiscovery-nuclei/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/projectdiscovery-nuclei"},"trust":{"score":90,"label":"Production candidate","version":"trust-score-v4","install_policy":"agent_install_candidate","evidence":{"stars":"29K GitHub stars","repoActivity":"29K stars, 3.5K forks","lastPushed":"3mo since push","license":"MIT","repository":"https://github.com/projectdiscovery/nuclei","install":"npx skills add projectdiscovery/nuclei","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Usable metadata, review docs","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":true,"sandbox_required":true,"reason":"Trust Score v4 allows sandbox-first agent installation after normal workspace review."},"best_for":["security","scanner","attack-surface","cve-scanner","dast","hacktoberfest"],"known_risks":["Documentation summary is thin"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":93,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Documentation summary is thin"]},"safety_gate":{"tier":"reviewed","label":"Reviewed","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow."},"quality":{"score":100,"label":"Excellent"},"supply":{"track":"Coding and developer agents","scenario":"Coding agents","maintenance":"3mo since push","risk":"Safe to try"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","high-compliance environments without internal security review","No OpenAgentSkill engagement data yet","Documentation summary is thin","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"agent_contract":{"task_input":"Use Nuclei in an agent workflow","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","install_policy":"review","minimum_review_before_use":["Trust: 90/100 Production candidate","Audit: 93/100 Safe to try","Safety: 81/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"projectdiscovery-nuclei (Nuclei)","install_command":"npx skills add projectdiscovery/nuclei","risk_summary":"Safe to try; Reviewed; Low metadata risk","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"projectdiscovery-nuclei","task":"Use Nuclei in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/projectdiscovery-nuclei","api":"https://www.openagentskill.com/api/agent/skills/projectdiscovery-nuclei","audit":"https://www.openagentskill.com/skills/projectdiscovery-nuclei/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=projectdiscovery-nuclei&task=Use%20Nuclei%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20Nuclei%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20Nuclei%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/projectdiscovery-nuclei/install","manifest":"https://www.openagentskill.com/api/registry/manifest/projectdiscovery-nuclei"}},"platforms":["Go","Security"],"use_cases":[{"slug":"security-compliance","title":"Security and compliance","url":"https://www.openagentskill.com/use-cases/security-compliance"},{"slug":"browser-automation","title":"Browser automation","url":"https://www.openagentskill.com/use-cases/browser-automation"},{"slug":"local-desktop","title":"Local desktop","url":"https://www.openagentskill.com/use-cases/local-desktop"},{"slug":"web-scraping","title":"Web scraping","url":"https://www.openagentskill.com/use-cases/web-scraping"}],"install":"npx skills add projectdiscovery/nuclei","install_targets":[{"id":"openagentskill-cli","label":"CLI","title":"OpenAgentSkill CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add projectdiscovery-nuclei","description":"Resolve policy, run the source installer safely, and report a verified install receipt.","copyLabel":"Copy command"},{"id":"codex","label":"Codex","title":"Codex install prompt","kind":"agent-prompt","value":"Install the \"Nuclei\" agent skill from https://github.com/projectdiscovery/nuclei. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"projectdiscovery-nuclei\",\"task\":\"Install Nuclei\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Give Codex a repo-aware install prompt when the skill is not available through a local CLI.","copyLabel":"Copy prompt"},{"id":"claude-code","label":"Claude Code","title":"Claude Code skill prompt","kind":"agent-prompt","value":"Add \"Nuclei\" as a Claude Code skill from https://github.com/projectdiscovery/nuclei. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"projectdiscovery-nuclei\",\"task\":\"Install Nuclei\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this prompt to ask Claude Code to add the skill and explain the local activation steps.","copyLabel":"Copy prompt"},{"id":"cursor","label":"Cursor","title":"Cursor rule prompt","kind":"agent-prompt","value":"Turn \"Nuclei\" from https://github.com/projectdiscovery/nuclei into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"projectdiscovery-nuclei\",\"task\":\"Install Nuclei\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this when installing as Cursor project rules or reusable agent instructions.","copyLabel":"Copy prompt"}],"repository":"https://github.com/projectdiscovery/nuclei","github_repo":"projectdiscovery/nuclei","version":"1.0.0","license":"MIT","updated_at":"2026-09-01T11:59:28.941454+00:00","canonical_key":"projectdiscovery/nuclei","recommendation_reasons":["Matches task terms: vulnerability, assessment","Strong GitHub adoption: 29,159 stars","Quality score 71/100","Install handoff is available","Repository freshness signal is available"],"urls":{"web":"https://www.openagentskill.com/skills/projectdiscovery-nuclei","api":"https://www.openagentskill.com/api/agent/skills/projectdiscovery-nuclei","install_api":"https://www.openagentskill.com/api/skills/projectdiscovery-nuclei/install","audit":"https://www.openagentskill.com/skills/projectdiscovery-nuclei/audit","repository":"https://github.com/projectdiscovery/nuclei"}},{"rank":3,"match_type":"related","match_score":33,"raw_match_score":406.2,"semantic_relevance":64,"ranking_signals":{"retrieval":369,"semantic":64,"quality":15.3,"projectPopularity":16,"verifiedOutcomes":0,"verifiedSource":6},"slug":"dwisiswant0-crlfuzz","name":"Crlfuzz","description":"A fast tool to scan CRLF vulnerability written in Go","tagline":"A fast tool to scan CRLF vulnerability written in Go","category":"security","tags":["security","vulnerability-scanner","crlf-injection","go","golang","vulnerability-scanning","github"],"author":{"name":"dwisiswant0","verified":true,"url":"https://github.com/dwisiswant0"},"attribution":{"status":"community_indexed","statusLabel":"Community indexed","shortLabel":"COMMUNITY INDEXED","sourceLabel":"GitHub star discovery","sourceDetail":"dwisiswant0/crlfuzz","creatorName":"dwisiswant0","creatorUrl":"https://github.com/dwisiswant0","sourceUrl":"https://github.com/dwisiswant0/crlfuzz","indexedBy":"OpenAgentSkill community index","claimUrl":"https://www.openagentskill.com/skills/dwisiswant0-crlfuzz#claim-this-skill","claimCta":"Claim this skill","trustNote":"This listing was indexed from public sources and is not marked official until a maintainer claim is approved.","publicNote":"Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals."},"stats":{"stars":1548,"forks":144,"verified_installs":0,"install_attempts":0,"successful_runs":0,"total_outcomes":0,"downloads":0,"rating":0,"review_count":0,"quality_score":61.03},"quality":{"score":91,"tier":"excellent","label":"Excellent","summary":"High-confidence pick with strong adoption and healthy maintenance signals.","signals":[{"label":"GitHub stars","value":"1.5K","tone":"positive"},{"label":"Freshness","value":"3mo ago","tone":"positive"},{"label":"Install ready","value":"Yes","tone":"positive"},{"label":"License","value":"MIT","tone":"neutral"}],"warnings":[]},"trust":{"version":"trust-score-v4","score":85,"tier":"strong","label":"Strong shortlist","summary":"Good trust signals with a few areas worth checking before rollout.","recommendedAction":"Test in a sandbox workflow and compare its install path with close alternatives.","dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":86,"weight":0.13,"status":"pass","detail":"1.5K GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":77,"weight":0.08,"status":"info","detail":"1.5K stars, 144 forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":88,"weight":0.14,"status":"pass","detail":"3mo since push"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"MIT"},{"id":"documentation","label":"README/SKILL.md completeness","score":50,"weight":0.14,"status":"warn","detail":"Public metadata needs stronger README/SKILL.md context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":90,"weight":0.12,"status":"pass","detail":"no major dependency risk hints in public metadata"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add dwisiswant0/crlfuzz"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":100,"weight":0.07,"status":"pass","detail":"no high-risk permission surface in public metadata"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/dwisiswant0/crlfuzz"},{"id":"review_status","label":"Review status","score":88,"weight":0.05,"status":"pass","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"pass","label":"GitHub adoption","detail":"1.5K GitHub stars"},{"status":"info","label":"Stars/forks activity","detail":"1.5K stars, 144 forks; issue activity unavailable in current metadata"},{"status":"pass","label":"Recent maintenance","detail":"3mo since push"},{"status":"pass","label":"License clarity","detail":"MIT"},{"status":"warn","label":"README/SKILL.md completeness","detail":"Public metadata needs stronger README/SKILL.md context"},{"status":"pass","label":"Dependency/runtime risk","detail":"no major dependency risk hints in public metadata"},{"status":"pass","label":"Install availability","detail":"npx skills add dwisiswant0/crlfuzz"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"pass","label":"Permission surface","detail":"no high-risk permission surface in public metadata"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/dwisiswant0/crlfuzz"},{"status":"pass","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"pass","label":"Ownership","detail":"Listing manually verified"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["Manually verified listing","AI review approved","Install path is available","Repository evidence is available","Recently maintained repository","Meaningful GitHub adoption signal","Install command has no obvious high-risk pattern"],"warnings":["Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"evidence":{"stars":"1.5K GitHub stars","repoActivity":"1.5K stars, 144 forks","lastPushed":"3mo since push","license":"MIT","repository":"https://github.com/dwisiswant0/crlfuzz","install":"npx skills add dwisiswant0/crlfuzz","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"installReadiness":{"ready":true,"command":"npx skills add dwisiswant0/crlfuzz","policy":"human_review_before_install","label":"Human review before install","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","3mo since push"]},"agentCompatibility":["Go","Security","Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"medium","label":"Review before production","notes":["Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":false,"sandboxRequired":true,"policy":"human_review_before_install","reason":"Human review or sandbox validation is required before automatic installation."},"bestFor":["security","vulnerability-scanner","crlf-injection","go","golang","vulnerability-scanning"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface","Automatic installation in a production workspace"],"knownRisks":["Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety":{"score":76,"level":"review_before_install","label":"Review before install","safety_tier":{"tier":"reviewed","label":"Reviewed","badge":"REVIEWED","summary":"Good audit and safety signals with no high-risk permission hints in public metadata.","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","auto_install_policy":"review","reasons":["Safe-to-try audit","76/100 agent safety score"]},"auto_install_allowed":false,"human_review_required":true,"blocked":false,"audit_risk":"safe_to_try","permission_hints":[{"id":"network","label":"Network access","reason":"Skill likely fetches remote pages, APIs, repositories, or external services.","severity":"medium"}],"policy_warnings":["Documentation summary is thin"],"constraints_applied":{"max_risk":"medium","needs_install_command":true,"min_stars":0}},"safety_gate":{"tier":"reviewed","label":"Reviewed","badge":"REVIEWED","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","reasons":["Safe-to-try audit","76/100 agent safety score"]},"supply_profile":{"track":{"slug":"coding","label":"Coding and developer agents","shortLabel":"Coding","description":"Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills."},"scenario":{"label":"GitHub automation","description":"I need my agent to triage GitHub issues, review pull requests, and summarize repository changes.","useCases":[{"slug":"security-compliance","title":"Security and compliance"},{"slug":"github-automation","title":"GitHub automation"},{"slug":"coding-agents","title":"Coding agents"}]},"applicableAgents":["CLI","Codex","Claude Code","Cursor","Go"],"install":{"ready":true,"command":"npx skills add dwisiswant0/crlfuzz","primaryTarget":"CLI","targetCount":4},"githubQuality":{"stars":1548,"starsLabel":"1.5K","forks":144,"license":"MIT","qualityScore":91,"trustScore":85,"auditScore":88},"maintenance":{"status":"active","label":"3mo since push","daysSincePush":78,"lastPushedAt":"2026-06-19T12:32:17+00:00"},"risk":{"level":"safe_to_try","label":"Safe to try","requiresReview":true,"notes":["Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"coverageTags":["Coding","GitHub automation","security","vulnerability-scanner","crlf-injection","go","golang","vulnerability-scanning"]},"audit":{"audit_score":88,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"decision":{"readiness_score":100,"readiness_label":"Production-ready","headline":"Primary pick for Security and compliance","role":"Primary pick","primary_fit":"Security and compliance","best_for":["Security and compliance workflows","general agent builders","teams that value GitHub adoption signals"],"risks":["No OpenAgentSkill engagement data yet"],"next_steps":["Install it in a sandbox agent and run one Security and compliance task end to end.","Compare output quality, latency, and failure behavior against at least one alternative.","Promote it into production only after reviewing repository permissions, license, and maintenance signals."]},"agent_readable_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"dwisiswant0-crlfuzz","name":"Crlfuzz","description":"A fast tool to scan CRLF vulnerability written in Go","category":"security","url":"https://www.openagentskill.com/skills/dwisiswant0-crlfuzz","repository":"https://github.com/dwisiswant0/crlfuzz","github_repo":"dwisiswant0/crlfuzz"},"suited_tasks":["Security and compliance workflows","general agent builders","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Inspect repository metadata","Compare code changes"],"suited_agents":["Go","Security","Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add dwisiswant0/crlfuzz","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add dwisiswant0-crlfuzz"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"Crlfuzz\" agent skill from https://github.com/dwisiswant0/crlfuzz. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: A fast tool to scan CRLF vulnerability written in Go After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"dwisiswant0-crlfuzz\",\"task\":\"Install Crlfuzz\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"Crlfuzz\" as a Claude Code skill from https://github.com/dwisiswant0/crlfuzz. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: A fast tool to scan CRLF vulnerability written in Go After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"dwisiswant0-crlfuzz\",\"task\":\"Install Crlfuzz\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"Crlfuzz\" from https://github.com/dwisiswant0/crlfuzz into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: A fast tool to scan CRLF vulnerability written in Go After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"dwisiswant0-crlfuzz\",\"task\":\"Install Crlfuzz\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/dwisiswant0-crlfuzz/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/dwisiswant0-crlfuzz"},"trust":{"score":85,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"1.5K GitHub stars","repoActivity":"1.5K stars, 144 forks","lastPushed":"3mo since push","license":"MIT","repository":"https://github.com/dwisiswant0/crlfuzz","install":"npx skills add dwisiswant0/crlfuzz","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","vulnerability-scanner","crlf-injection","go","golang","vulnerability-scanning"],"known_risks":["Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":88,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow."},"quality":{"score":91,"label":"Excellent"},"supply":{"track":"Coding and developer agents","scenario":"GitHub automation","maintenance":"3mo since push","risk":"Safe to try"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","high-compliance environments without internal security review","No OpenAgentSkill engagement data yet","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface","Automatic installation in a production workspace"],"agent_contract":{"task_input":"Use Crlfuzz in an agent workflow","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","install_policy":"review","minimum_review_before_use":["Trust: 85/100 Strong shortlist","Audit: 88/100 Safe to try","Safety: 76/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"dwisiswant0-crlfuzz (Crlfuzz)","install_command":"npx skills add dwisiswant0/crlfuzz","risk_summary":"Safe to try; Reviewed; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"dwisiswant0-crlfuzz","task":"Use Crlfuzz in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/dwisiswant0-crlfuzz","api":"https://www.openagentskill.com/api/agent/skills/dwisiswant0-crlfuzz","audit":"https://www.openagentskill.com/skills/dwisiswant0-crlfuzz/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=dwisiswant0-crlfuzz&task=Use%20Crlfuzz%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20Crlfuzz%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20Crlfuzz%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/dwisiswant0-crlfuzz/install","manifest":"https://www.openagentskill.com/api/registry/manifest/dwisiswant0-crlfuzz"}},"machine_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"dwisiswant0-crlfuzz","name":"Crlfuzz","description":"A fast tool to scan CRLF vulnerability written in Go","category":"security","url":"https://www.openagentskill.com/skills/dwisiswant0-crlfuzz","repository":"https://github.com/dwisiswant0/crlfuzz","github_repo":"dwisiswant0/crlfuzz"},"suited_tasks":["Security and compliance workflows","general agent builders","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Inspect repository metadata","Compare code changes"],"suited_agents":["Go","Security","Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add dwisiswant0/crlfuzz","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add dwisiswant0-crlfuzz"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"Crlfuzz\" agent skill from https://github.com/dwisiswant0/crlfuzz. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: A fast tool to scan CRLF vulnerability written in Go After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"dwisiswant0-crlfuzz\",\"task\":\"Install Crlfuzz\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"Crlfuzz\" as a Claude Code skill from https://github.com/dwisiswant0/crlfuzz. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: A fast tool to scan CRLF vulnerability written in Go After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"dwisiswant0-crlfuzz\",\"task\":\"Install Crlfuzz\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"Crlfuzz\" from https://github.com/dwisiswant0/crlfuzz into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: A fast tool to scan CRLF vulnerability written in Go After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"dwisiswant0-crlfuzz\",\"task\":\"Install Crlfuzz\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/dwisiswant0-crlfuzz/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/dwisiswant0-crlfuzz"},"trust":{"score":85,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"1.5K GitHub stars","repoActivity":"1.5K stars, 144 forks","lastPushed":"3mo since push","license":"MIT","repository":"https://github.com/dwisiswant0/crlfuzz","install":"npx skills add dwisiswant0/crlfuzz","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","vulnerability-scanner","crlf-injection","go","golang","vulnerability-scanning"],"known_risks":["Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":88,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow."},"quality":{"score":91,"label":"Excellent"},"supply":{"track":"Coding and developer agents","scenario":"GitHub automation","maintenance":"3mo since push","risk":"Safe to try"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","high-compliance environments without internal security review","No OpenAgentSkill engagement data yet","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface","Automatic installation in a production workspace"],"agent_contract":{"task_input":"Use Crlfuzz in an agent workflow","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","install_policy":"review","minimum_review_before_use":["Trust: 85/100 Strong shortlist","Audit: 88/100 Safe to try","Safety: 76/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"dwisiswant0-crlfuzz (Crlfuzz)","install_command":"npx skills add dwisiswant0/crlfuzz","risk_summary":"Safe to try; Reviewed; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"dwisiswant0-crlfuzz","task":"Use Crlfuzz in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/dwisiswant0-crlfuzz","api":"https://www.openagentskill.com/api/agent/skills/dwisiswant0-crlfuzz","audit":"https://www.openagentskill.com/skills/dwisiswant0-crlfuzz/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=dwisiswant0-crlfuzz&task=Use%20Crlfuzz%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20Crlfuzz%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20Crlfuzz%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/dwisiswant0-crlfuzz/install","manifest":"https://www.openagentskill.com/api/registry/manifest/dwisiswant0-crlfuzz"}},"platforms":["Go","Security"],"use_cases":[{"slug":"security-compliance","title":"Security and compliance","url":"https://www.openagentskill.com/use-cases/security-compliance"},{"slug":"github-automation","title":"GitHub automation","url":"https://www.openagentskill.com/use-cases/github-automation"},{"slug":"coding-agents","title":"Coding agents","url":"https://www.openagentskill.com/use-cases/coding-agents"},{"slug":"web-scraping","title":"Web scraping","url":"https://www.openagentskill.com/use-cases/web-scraping"}],"install":"npx skills add dwisiswant0/crlfuzz","install_targets":[{"id":"openagentskill-cli","label":"CLI","title":"OpenAgentSkill CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add dwisiswant0-crlfuzz","description":"Resolve policy, run the source installer safely, and report a verified install receipt.","copyLabel":"Copy command"},{"id":"codex","label":"Codex","title":"Codex install prompt","kind":"agent-prompt","value":"Install the \"Crlfuzz\" agent skill from https://github.com/dwisiswant0/crlfuzz. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: A fast tool to scan CRLF vulnerability written in Go After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"dwisiswant0-crlfuzz\",\"task\":\"Install Crlfuzz\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Give Codex a repo-aware install prompt when the skill is not available through a local CLI.","copyLabel":"Copy prompt"},{"id":"claude-code","label":"Claude Code","title":"Claude Code skill prompt","kind":"agent-prompt","value":"Add \"Crlfuzz\" as a Claude Code skill from https://github.com/dwisiswant0/crlfuzz. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: A fast tool to scan CRLF vulnerability written in Go After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"dwisiswant0-crlfuzz\",\"task\":\"Install Crlfuzz\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this prompt to ask Claude Code to add the skill and explain the local activation steps.","copyLabel":"Copy prompt"},{"id":"cursor","label":"Cursor","title":"Cursor rule prompt","kind":"agent-prompt","value":"Turn \"Crlfuzz\" from https://github.com/dwisiswant0/crlfuzz into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: A fast tool to scan CRLF vulnerability written in Go After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"dwisiswant0-crlfuzz\",\"task\":\"Install Crlfuzz\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this when installing as Cursor project rules or reusable agent instructions.","copyLabel":"Copy prompt"}],"repository":"https://github.com/dwisiswant0/crlfuzz","github_repo":"dwisiswant0/crlfuzz","version":"1.0.0","license":"MIT","updated_at":"2026-09-01T11:59:28.941454+00:00","canonical_key":"dwisiswant0/crlfuzz","recommendation_reasons":["Matches task terms: vulnerability, scanning","Useful GitHub adoption: 1,548 stars","Install handoff is available","Repository freshness signal is available","Registry match score 33"],"urls":{"web":"https://www.openagentskill.com/skills/dwisiswant0-crlfuzz","api":"https://www.openagentskill.com/api/agent/skills/dwisiswant0-crlfuzz","install_api":"https://www.openagentskill.com/api/skills/dwisiswant0-crlfuzz/install","audit":"https://www.openagentskill.com/skills/dwisiswant0-crlfuzz/audit","repository":"https://github.com/dwisiswant0/crlfuzz"}},{"rank":4,"match_type":"related","match_score":32,"raw_match_score":403.4,"semantic_relevance":52,"ranking_signals":{"retrieval":369,"semantic":52,"quality":13.1,"projectPopularity":15.4,"verifiedOutcomes":0,"verifiedSource":6},"slug":"hackmanit-web-cache-vulnerability-scanner","name":"Web Cache Vulnerability Scanner","description":"Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/).","tagline":"Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/).","category":"security","tags":["security","scanner","bugbounty","hacking","hacking-tool","penetration-testing","penetration-testing-tools","pentesting","security-audit","security-scanner"],"author":{"name":"Hackmanit","verified":true,"url":"https://github.com/Hackmanit"},"attribution":{"status":"community_indexed","statusLabel":"Community indexed","shortLabel":"COMMUNITY INDEXED","sourceLabel":"GitHub star discovery","sourceDetail":"Hackmanit/Web-Cache-Vulnerability-Scanner","creatorName":"Hackmanit","creatorUrl":"https://github.com/Hackmanit","sourceUrl":"https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner","indexedBy":"OpenAgentSkill community index","claimUrl":"https://www.openagentskill.com/skills/hackmanit-web-cache-vulnerability-scanner#claim-this-skill","claimCta":"Claim this skill","trustNote":"This listing was indexed from public sources and is not marked official until a maintainer claim is approved.","publicNote":"Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals."},"stats":{"stars":1178,"forks":159,"verified_installs":0,"install_attempts":0,"successful_runs":0,"total_outcomes":0,"downloads":0,"rating":0,"review_count":0,"quality_score":52.2},"quality":{"score":78,"tier":"strong","label":"Strong","summary":"Solid option that is likely worth shortlisting for production workflows.","signals":[{"label":"GitHub stars","value":"1.2K","tone":"positive"},{"label":"Freshness","value":"8mo ago","tone":"positive"},{"label":"Install ready","value":"Yes","tone":"positive"},{"label":"License","value":"Apache-2.0","tone":"neutral"}],"warnings":[]},"trust":{"version":"trust-score-v4","score":79,"tier":"strong","label":"Strong shortlist","summary":"Good trust signals with a few areas worth checking before rollout.","recommendedAction":"Test in a sandbox workflow and compare its install path with close alternatives.","dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":86,"weight":0.13,"status":"pass","detail":"1.2K GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":77,"weight":0.08,"status":"info","detail":"1.2K stars, 159 forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":62,"weight":0.14,"status":"info","detail":"8mo since push"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"Apache-2.0"},{"id":"documentation","label":"README/SKILL.md completeness","score":66,"weight":0.14,"status":"info","detail":"Public metadata needs stronger README/SKILL.md context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":64,"weight":0.12,"status":"info","detail":"command execution surface, network or browser surface"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add Hackmanit/Web-Cache-Vulnerability-Scanner"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":62,"weight":0.07,"status":"info","detail":"shell or command execution, network or browser access"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner"},{"id":"review_status","label":"Review status","score":88,"weight":0.05,"status":"pass","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"pass","label":"GitHub adoption","detail":"1.2K GitHub stars"},{"status":"info","label":"Stars/forks activity","detail":"1.2K stars, 159 forks; issue activity unavailable in current metadata"},{"status":"info","label":"Recent maintenance","detail":"8mo since push"},{"status":"pass","label":"License clarity","detail":"Apache-2.0"},{"status":"info","label":"README/SKILL.md completeness","detail":"Public metadata needs stronger README/SKILL.md context"},{"status":"info","label":"Dependency/runtime risk","detail":"command execution surface, network or browser surface"},{"status":"pass","label":"Install availability","detail":"npx skills add Hackmanit/Web-Cache-Vulnerability-Scanner"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"info","label":"Permission surface","detail":"shell or command execution, network or browser access"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner"},{"status":"pass","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"pass","label":"Ownership","detail":"Listing manually verified"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["Manually verified listing","AI review approved","Install path is available","Repository evidence is available","Meaningful GitHub adoption signal","Install command has no obvious high-risk pattern"],"warnings":["Quality score needs review","Documentation summary is thin"],"evidence":{"stars":"1.2K GitHub stars","repoActivity":"1.2K stars, 159 forks","lastPushed":"8mo since push","license":"Apache-2.0","repository":"https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner","install":"npx skills add Hackmanit/Web-Cache-Vulnerability-Scanner","installSafety":"standard package or runtime install path","permissionSurface":"shell or command execution, network or browser access","documentation":"Usable metadata, review docs","agentOutcomes":"No agent outcome data yet"},"installReadiness":{"ready":true,"command":"npx skills add Hackmanit/Web-Cache-Vulnerability-Scanner","policy":"human_review_before_install","label":"Human review before install","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","8mo since push"]},"agentCompatibility":["Go","Security","Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"medium","label":"Review before production","notes":["Quality score needs review","Documentation summary is thin"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":false,"sandboxRequired":true,"policy":"human_review_before_install","reason":"Human review or sandbox validation is required before automatic installation."},"bestFor":["security","scanner","bugbounty","hacking","hacking-tool","penetration-testing"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface","Automatic installation in a production workspace"],"knownRisks":["Quality score needs review","Documentation summary is thin"]},"safety":{"score":54,"level":"avoid_auto_install","label":"Avoid automatic install","safety_tier":{"tier":"experimental","label":"Experimental","badge":"EXPERIMENTAL","summary":"Sparse or mixed signals. Useful for discovery, but not for autonomous installation.","recommended_action":"Test manually in an isolated workspace and compare against safer alternatives.","auto_install_policy":"review","reasons":["High-risk permission hints: Shell or command execution","54/100 agent safety score"]},"auto_install_allowed":false,"human_review_required":true,"blocked":false,"audit_risk":"needs_review","permission_hints":[{"id":"shell","label":"Shell or command execution","reason":"Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.","severity":"high"},{"id":"network","label":"Network access","reason":"Skill likely fetches remote pages, APIs, repositories, or external services.","severity":"medium"}],"policy_warnings":["High-risk permission hints: Shell or command execution","Quality score needs review"],"constraints_applied":{"max_risk":"medium","needs_install_command":true,"min_stars":0}},"safety_gate":{"tier":"experimental","label":"Experimental","badge":"EXPERIMENTAL","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Test manually in an isolated workspace and compare against safer alternatives.","reasons":["High-risk permission hints: Shell or command execution","54/100 agent safety score"]},"supply_profile":{"track":{"slug":"coding","label":"Coding and developer agents","shortLabel":"Coding","description":"Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills."},"scenario":{"label":"Testing and QA","description":"I need my agent to test a web app, reproduce bugs, and verify fixes.","useCases":[{"slug":"security-compliance","title":"Security and compliance"},{"slug":"testing-qa","title":"Testing and QA"},{"slug":"coding-agents","title":"Coding agents"}]},"applicableAgents":["CLI","Codex","Claude Code","Cursor","Go"],"install":{"ready":true,"command":"npx skills add Hackmanit/Web-Cache-Vulnerability-Scanner","primaryTarget":"CLI","targetCount":4},"githubQuality":{"stars":1178,"starsLabel":"1.2K","forks":159,"license":"Apache-2.0","qualityScore":78,"trustScore":79,"auditScore":78},"maintenance":{"status":"stable","label":"8mo since push","daysSincePush":227,"lastPushedAt":"2026-01-21T10:18:50+00:00"},"risk":{"level":"needs_review","label":"Needs review","requiresReview":true,"notes":["Quality score needs review","Documentation summary is thin","Needs review"]},"coverageTags":["Coding","Testing and QA","security","scanner","bugbounty","hacking","hacking-tool","penetration-testing"]},"audit":{"audit_score":78,"risk_level":"needs_review","risk_label":"Needs review","warnings":["Quality score needs review","Documentation summary is thin"]},"decision":{"readiness_score":80,"readiness_label":"Strong shortlist","headline":"Companion skill for Security and compliance","role":"Companion skill","primary_fit":"Security and compliance","best_for":["Security and compliance workflows","general agent builders","teams that value GitHub adoption signals"],"risks":["No OpenAgentSkill engagement data yet"],"next_steps":["Install it in a sandbox agent and run one Security and compliance task end to end.","Compare output quality, latency, and failure behavior against at least one alternative.","Promote it into production only after reviewing repository permissions, license, and maintenance signals."]},"agent_readable_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"hackmanit-web-cache-vulnerability-scanner","name":"Web Cache Vulnerability Scanner","description":"Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/).","category":"security","url":"https://www.openagentskill.com/skills/hackmanit-web-cache-vulnerability-scanner","repository":"https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner","github_repo":"Hackmanit/Web-Cache-Vulnerability-Scanner"},"suited_tasks":["Security and compliance workflows","general agent builders","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Run test suites","Capture failures"],"suited_agents":["Go","Security","Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add Hackmanit/Web-Cache-Vulnerability-Scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add hackmanit-web-cache-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"Web Cache Vulnerability Scanner\" agent skill from https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"hackmanit-web-cache-vulnerability-scanner\",\"task\":\"Install Web Cache Vulnerability Scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"Web Cache Vulnerability Scanner\" as a Claude Code skill from https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"hackmanit-web-cache-vulnerability-scanner\",\"task\":\"Install Web Cache Vulnerability Scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"Web Cache Vulnerability Scanner\" from https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"hackmanit-web-cache-vulnerability-scanner\",\"task\":\"Install Web Cache Vulnerability Scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/hackmanit-web-cache-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/hackmanit-web-cache-vulnerability-scanner"},"trust":{"score":79,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"1.2K GitHub stars","repoActivity":"1.2K stars, 159 forks","lastPushed":"8mo since push","license":"Apache-2.0","repository":"https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner","install":"npx skills add Hackmanit/Web-Cache-Vulnerability-Scanner","installSafety":"standard package or runtime install path","permissionSurface":"shell or command execution, network or browser access","documentation":"Usable metadata, review docs","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","scanner","bugbounty","hacking","hacking-tool","penetration-testing"],"known_risks":["Quality score needs review","Documentation summary is thin"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":78,"risk_level":"needs_review","risk_label":"Needs review","warnings":["Quality score needs review","Documentation summary is thin"]},"safety_gate":{"tier":"experimental","label":"Experimental","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Test manually in an isolated workspace and compare against safer alternatives."},"quality":{"score":78,"label":"Strong"},"supply":{"track":"Coding and developer agents","scenario":"Testing and QA","maintenance":"8mo since push","risk":"Needs review"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","high-compliance environments without internal security review","No OpenAgentSkill engagement data yet","High-risk permission hints: Shell or command execution","Quality score needs review","Documentation summary is thin","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"agent_contract":{"task_input":"Use Web Cache Vulnerability Scanner in an agent workflow","recommended_action":"Test manually in an isolated workspace and compare against safer alternatives.","install_policy":"review","minimum_review_before_use":["Trust: 79/100 Strong shortlist","Audit: 78/100 Needs review","Safety: 54/100 Avoid automatic install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"hackmanit-web-cache-vulnerability-scanner (Web Cache Vulnerability Scanner)","install_command":"npx skills add Hackmanit/Web-Cache-Vulnerability-Scanner","risk_summary":"Needs review; Experimental; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"hackmanit-web-cache-vulnerability-scanner","task":"Use Web Cache Vulnerability Scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/hackmanit-web-cache-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/hackmanit-web-cache-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/hackmanit-web-cache-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=hackmanit-web-cache-vulnerability-scanner&task=Use%20Web%20Cache%20Vulnerability%20Scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20Web%20Cache%20Vulnerability%20Scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20Web%20Cache%20Vulnerability%20Scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/hackmanit-web-cache-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/hackmanit-web-cache-vulnerability-scanner"}},"machine_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"hackmanit-web-cache-vulnerability-scanner","name":"Web Cache Vulnerability Scanner","description":"Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/).","category":"security","url":"https://www.openagentskill.com/skills/hackmanit-web-cache-vulnerability-scanner","repository":"https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner","github_repo":"Hackmanit/Web-Cache-Vulnerability-Scanner"},"suited_tasks":["Security and compliance workflows","general agent builders","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Run test suites","Capture failures"],"suited_agents":["Go","Security","Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add Hackmanit/Web-Cache-Vulnerability-Scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add hackmanit-web-cache-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"Web Cache Vulnerability Scanner\" agent skill from https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"hackmanit-web-cache-vulnerability-scanner\",\"task\":\"Install Web Cache Vulnerability Scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"Web Cache Vulnerability Scanner\" as a Claude Code skill from https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"hackmanit-web-cache-vulnerability-scanner\",\"task\":\"Install Web Cache Vulnerability Scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"Web Cache Vulnerability Scanner\" from https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"hackmanit-web-cache-vulnerability-scanner\",\"task\":\"Install Web Cache Vulnerability Scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/hackmanit-web-cache-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/hackmanit-web-cache-vulnerability-scanner"},"trust":{"score":79,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"1.2K GitHub stars","repoActivity":"1.2K stars, 159 forks","lastPushed":"8mo since push","license":"Apache-2.0","repository":"https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner","install":"npx skills add Hackmanit/Web-Cache-Vulnerability-Scanner","installSafety":"standard package or runtime install path","permissionSurface":"shell or command execution, network or browser access","documentation":"Usable metadata, review docs","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","scanner","bugbounty","hacking","hacking-tool","penetration-testing"],"known_risks":["Quality score needs review","Documentation summary is thin"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":78,"risk_level":"needs_review","risk_label":"Needs review","warnings":["Quality score needs review","Documentation summary is thin"]},"safety_gate":{"tier":"experimental","label":"Experimental","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Test manually in an isolated workspace and compare against safer alternatives."},"quality":{"score":78,"label":"Strong"},"supply":{"track":"Coding and developer agents","scenario":"Testing and QA","maintenance":"8mo since push","risk":"Needs review"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","high-compliance environments without internal security review","No OpenAgentSkill engagement data yet","High-risk permission hints: Shell or command execution","Quality score needs review","Documentation summary is thin","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"agent_contract":{"task_input":"Use Web Cache Vulnerability Scanner in an agent workflow","recommended_action":"Test manually in an isolated workspace and compare against safer alternatives.","install_policy":"review","minimum_review_before_use":["Trust: 79/100 Strong shortlist","Audit: 78/100 Needs review","Safety: 54/100 Avoid automatic install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"hackmanit-web-cache-vulnerability-scanner (Web Cache Vulnerability Scanner)","install_command":"npx skills add Hackmanit/Web-Cache-Vulnerability-Scanner","risk_summary":"Needs review; Experimental; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"hackmanit-web-cache-vulnerability-scanner","task":"Use Web Cache Vulnerability Scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/hackmanit-web-cache-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/hackmanit-web-cache-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/hackmanit-web-cache-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=hackmanit-web-cache-vulnerability-scanner&task=Use%20Web%20Cache%20Vulnerability%20Scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20Web%20Cache%20Vulnerability%20Scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20Web%20Cache%20Vulnerability%20Scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/hackmanit-web-cache-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/hackmanit-web-cache-vulnerability-scanner"}},"platforms":["Go","Security"],"use_cases":[{"slug":"security-compliance","title":"Security and compliance","url":"https://www.openagentskill.com/use-cases/security-compliance"},{"slug":"testing-qa","title":"Testing and QA","url":"https://www.openagentskill.com/use-cases/testing-qa"},{"slug":"coding-agents","title":"Coding agents","url":"https://www.openagentskill.com/use-cases/coding-agents"},{"slug":"browser-automation","title":"Browser automation","url":"https://www.openagentskill.com/use-cases/browser-automation"}],"install":"npx skills add Hackmanit/Web-Cache-Vulnerability-Scanner","install_targets":[{"id":"openagentskill-cli","label":"CLI","title":"OpenAgentSkill CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add hackmanit-web-cache-vulnerability-scanner","description":"Resolve policy, run the source installer safely, and report a verified install receipt.","copyLabel":"Copy command"},{"id":"codex","label":"Codex","title":"Codex install prompt","kind":"agent-prompt","value":"Install the \"Web Cache Vulnerability Scanner\" agent skill from https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"hackmanit-web-cache-vulnerability-scanner\",\"task\":\"Install Web Cache Vulnerability Scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Give Codex a repo-aware install prompt when the skill is not available through a local CLI.","copyLabel":"Copy prompt"},{"id":"claude-code","label":"Claude Code","title":"Claude Code skill prompt","kind":"agent-prompt","value":"Add \"Web Cache Vulnerability Scanner\" as a Claude Code skill from https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"hackmanit-web-cache-vulnerability-scanner\",\"task\":\"Install Web Cache Vulnerability Scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this prompt to ask Claude Code to add the skill and explain the local activation steps.","copyLabel":"Copy prompt"},{"id":"cursor","label":"Cursor","title":"Cursor rule prompt","kind":"agent-prompt","value":"Turn \"Web Cache Vulnerability Scanner\" from https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"hackmanit-web-cache-vulnerability-scanner\",\"task\":\"Install Web Cache Vulnerability Scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this when installing as Cursor project rules or reusable agent instructions.","copyLabel":"Copy prompt"}],"repository":"https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner","github_repo":"Hackmanit/Web-Cache-Vulnerability-Scanner","version":"1.0.0","license":"Apache-2.0","updated_at":"2026-09-01T11:59:28.941454+00:00","canonical_key":"hackmanit/web-cache-vulnerability-scanner","recommendation_reasons":["Matches task terms: vulnerability","Useful GitHub adoption: 1,178 stars","Install handoff is available","Repository freshness signal is available","Registry match score 32"],"urls":{"web":"https://www.openagentskill.com/skills/hackmanit-web-cache-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/hackmanit-web-cache-vulnerability-scanner","install_api":"https://www.openagentskill.com/api/skills/hackmanit-web-cache-vulnerability-scanner/install","audit":"https://www.openagentskill.com/skills/hackmanit-web-cache-vulnerability-scanner/audit","repository":"https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner"}},{"rank":5,"match_type":"related","match_score":32,"raw_match_score":400.8,"semantic_relevance":52,"ranking_signals":{"retrieval":369,"semantic":52,"quality":12.6,"projectPopularity":19.2,"verifiedOutcomes":0,"verifiedSource":0},"slug":"trailofbits-solana-vulnerability-scanner","name":"solana-vulnerability-scanner","description":"Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.","tagline":"Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.","category":"security","tags":["agent-skill"],"author":{"name":"trailofbits","verified":false,"url":"https://github.com/trailofbits"},"attribution":{"status":"registry_indexed","statusLabel":"Registry indexed","shortLabel":"REGISTRY INDEXED","sourceLabel":"recursive skill source sync","sourceDetail":"trailofbits/skills","creatorName":"trailofbits","creatorUrl":"https://github.com/trailofbits","sourceUrl":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner","indexedBy":"OpenAgentSkill community index","claimUrl":"https://www.openagentskill.com/skills/trailofbits-solana-vulnerability-scanner#claim-this-skill","claimCta":"Claim this skill","trustNote":"This listing was indexed from public sources and is not marked official until a maintainer claim is approved.","publicNote":"Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals."},"stats":{"stars":6844,"forks":586,"verified_installs":0,"install_attempts":0,"successful_runs":0,"total_outcomes":0,"downloads":0,"rating":0,"review_count":0,"quality_score":50.4},"quality":{"score":80,"tier":"strong","label":"Strong","summary":"Solid option that is likely worth shortlisting for production workflows.","signals":[{"label":"GitHub stars","value":"6.8K","tone":"positive"},{"label":"Freshness","value":"11d ago","tone":"positive"},{"label":"Install ready","value":"Yes","tone":"positive"},{"label":"License","value":"CC-BY-SA-4.0","tone":"neutral"}],"warnings":[]},"trust":{"version":"trust-score-v4","score":83,"tier":"strong","label":"Strong shortlist","summary":"Good trust signals with a few areas worth checking before rollout.","recommendedAction":"Test in a sandbox workflow and compare its install path with close alternatives.","dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":94,"weight":0.13,"status":"pass","detail":"6.8K GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":88,"weight":0.08,"status":"pass","detail":"6.8K stars, 586 forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":100,"weight":0.14,"status":"pass","detail":"11d since push"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"CC-BY-SA-4.0"},{"id":"documentation","label":"README/SKILL.md completeness","score":52,"weight":0.14,"status":"warn","detail":"Public metadata needs stronger README/SKILL.md context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":90,"weight":0.12,"status":"pass","detail":"no major dependency risk hints in public metadata"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add trailofbits/skills --skill solana-vulnerability-scanner"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":100,"weight":0.07,"status":"pass","detail":"no high-risk permission surface in public metadata"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner"},{"id":"review_status","label":"Review status","score":88,"weight":0.05,"status":"pass","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"pass","label":"GitHub adoption","detail":"6.8K GitHub stars"},{"status":"pass","label":"Stars/forks activity","detail":"6.8K stars, 586 forks; issue activity unavailable in current metadata"},{"status":"pass","label":"Recent maintenance","detail":"11d since push"},{"status":"pass","label":"License clarity","detail":"CC-BY-SA-4.0"},{"status":"warn","label":"README/SKILL.md completeness","detail":"Public metadata needs stronger README/SKILL.md context"},{"status":"pass","label":"Dependency/runtime risk","detail":"no major dependency risk hints in public metadata"},{"status":"pass","label":"Install availability","detail":"npx skills add trailofbits/skills --skill solana-vulnerability-scanner"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"pass","label":"Permission surface","detail":"no high-risk permission surface in public metadata"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner"},{"status":"pass","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"warn","label":"Ownership","detail":"No approved owner claim yet"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["AI review approved","Install path is available","Repository evidence is available","Recently maintained repository","Large GitHub adoption signal","Install command has no obvious high-risk pattern"],"warnings":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 586 forks","lastPushed":"11d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill solana-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"installReadiness":{"ready":true,"command":"npx skills add trailofbits/skills --skill solana-vulnerability-scanner","policy":"human_review_before_install","label":"Human review before install","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","11d since push"]},"agentCompatibility":["Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"medium","label":"Review before production","notes":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":false,"sandboxRequired":true,"policy":"human_review_before_install","reason":"Human review or sandbox validation is required before automatic installation."},"bestFor":["security","agent-skill"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface","Automatic installation in a production workspace"],"knownRisks":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety":{"score":75,"level":"review_before_install","label":"Review before install","safety_tier":{"tier":"reviewed","label":"Reviewed","badge":"REVIEWED","summary":"Good audit and safety signals with no high-risk permission hints in public metadata.","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","auto_install_policy":"review","reasons":["Safe-to-try audit","75/100 agent safety score"]},"auto_install_allowed":false,"human_review_required":true,"blocked":false,"audit_risk":"safe_to_try","permission_hints":[{"id":"network","label":"Network access","reason":"Skill likely fetches remote pages, APIs, repositories, or external services.","severity":"medium"}],"policy_warnings":["Quality score needs review"],"constraints_applied":{"max_risk":"medium","needs_install_command":true,"min_stars":0}},"safety_gate":{"tier":"reviewed","label":"Reviewed","badge":"REVIEWED","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","reasons":["Safe-to-try audit","75/100 agent safety score"]},"supply_profile":{"track":{"slug":"research","label":"Research and knowledge work","shortLabel":"Research","description":"Deep research, source comparison, literature review, RAG, knowledge search, and reports."},"scenario":{"label":"RAG and knowledge","description":"I need my agent to build a RAG workflow over documents and retrieve reliable context.","useCases":[{"slug":"security-compliance","title":"Security and compliance"},{"slug":"web-scraping","title":"Web scraping"},{"slug":"coding-agents","title":"Coding agents"}]},"applicableAgents":["Claude Code","CLI","Codex","Cursor"],"install":{"ready":true,"command":"npx skills add trailofbits/skills --skill solana-vulnerability-scanner","primaryTarget":"CLI","targetCount":4},"githubQuality":{"stars":6844,"starsLabel":"6.8K","forks":586,"license":"CC-BY-SA-4.0","qualityScore":80,"trustScore":83,"auditScore":87},"maintenance":{"status":"fresh","label":"11d since push","daysSincePush":11,"lastPushedAt":"2026-08-25T13:19:32+00:00"},"risk":{"level":"safe_to_try","label":"Safe to try","requiresReview":true,"notes":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"coverageTags":["Research","RAG and knowledge","security","agent-skill"]},"audit":{"audit_score":87,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"decision":{"readiness_score":91,"readiness_label":"Production-ready","headline":"Primary pick for Security and compliance","role":"Primary pick","primary_fit":"Security and compliance","best_for":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals"],"risks":["No OpenAgentSkill engagement data yet"],"next_steps":["Install it in a sandbox agent and run one Security and compliance task end to end.","Compare output quality, latency, and failure behavior against at least one alternative.","Promote it into production only after reviewing repository permissions, license, and maintenance signals."]},"agent_readable_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-solana-vulnerability-scanner","name":"solana-vulnerability-scanner","description":"Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-solana-vulnerability-scanner","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner","github_repo":"trailofbits/skills"},"suited_tasks":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Crawl target URLs","Extract tables and metadata"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill solana-vulnerability-scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-solana-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"solana-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-solana-vulnerability-scanner\",\"task\":\"Install solana-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"solana-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-solana-vulnerability-scanner\",\"task\":\"Install solana-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"solana-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-solana-vulnerability-scanner\",\"task\":\"Install solana-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-solana-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-solana-vulnerability-scanner"},"trust":{"score":83,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 586 forks","lastPushed":"11d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill solana-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","agent-skill"],"known_risks":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":87,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow."},"quality":{"score":80,"label":"Strong"},"supply":{"track":"Research and knowledge work","scenario":"RAG and knowledge","maintenance":"11d since push","risk":"Safe to try"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","high-compliance environments without internal security review","No OpenAgentSkill engagement data yet","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"agent_contract":{"task_input":"Use solana-vulnerability-scanner in an agent workflow","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","install_policy":"review","minimum_review_before_use":["Trust: 83/100 Strong shortlist","Audit: 87/100 Safe to try","Safety: 75/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-solana-vulnerability-scanner (solana-vulnerability-scanner)","install_command":"npx skills add trailofbits/skills --skill solana-vulnerability-scanner","risk_summary":"Safe to try; Reviewed; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-solana-vulnerability-scanner","task":"Use solana-vulnerability-scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-solana-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-solana-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/trailofbits-solana-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-solana-vulnerability-scanner&task=Use%20solana-vulnerability-scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20solana-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20solana-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-solana-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-solana-vulnerability-scanner"}},"machine_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-solana-vulnerability-scanner","name":"solana-vulnerability-scanner","description":"Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-solana-vulnerability-scanner","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner","github_repo":"trailofbits/skills"},"suited_tasks":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Crawl target URLs","Extract tables and metadata"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill solana-vulnerability-scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-solana-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"solana-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-solana-vulnerability-scanner\",\"task\":\"Install solana-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"solana-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-solana-vulnerability-scanner\",\"task\":\"Install solana-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"solana-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-solana-vulnerability-scanner\",\"task\":\"Install solana-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-solana-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-solana-vulnerability-scanner"},"trust":{"score":83,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 586 forks","lastPushed":"11d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill solana-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","agent-skill"],"known_risks":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":87,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow."},"quality":{"score":80,"label":"Strong"},"supply":{"track":"Research and knowledge work","scenario":"RAG and knowledge","maintenance":"11d since push","risk":"Safe to try"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","high-compliance environments without internal security review","No OpenAgentSkill engagement data yet","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"agent_contract":{"task_input":"Use solana-vulnerability-scanner in an agent workflow","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","install_policy":"review","minimum_review_before_use":["Trust: 83/100 Strong shortlist","Audit: 87/100 Safe to try","Safety: 75/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-solana-vulnerability-scanner (solana-vulnerability-scanner)","install_command":"npx skills add trailofbits/skills --skill solana-vulnerability-scanner","risk_summary":"Safe to try; Reviewed; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-solana-vulnerability-scanner","task":"Use solana-vulnerability-scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-solana-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-solana-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/trailofbits-solana-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-solana-vulnerability-scanner&task=Use%20solana-vulnerability-scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20solana-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20solana-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-solana-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-solana-vulnerability-scanner"}},"platforms":["Claude Code"],"use_cases":[{"slug":"security-compliance","title":"Security and compliance","url":"https://www.openagentskill.com/use-cases/security-compliance"},{"slug":"web-scraping","title":"Web scraping","url":"https://www.openagentskill.com/use-cases/web-scraping"},{"slug":"coding-agents","title":"Coding agents","url":"https://www.openagentskill.com/use-cases/coding-agents"},{"slug":"rag-knowledge","title":"RAG and knowledge","url":"https://www.openagentskill.com/use-cases/rag-knowledge"}],"install":"npx skills add trailofbits/skills --skill solana-vulnerability-scanner","install_targets":[{"id":"openagentskill-cli","label":"CLI","title":"OpenAgentSkill CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-solana-vulnerability-scanner","description":"Resolve policy, run the source installer safely, and report a verified install receipt.","copyLabel":"Copy command"},{"id":"codex","label":"Codex","title":"Codex install prompt","kind":"agent-prompt","value":"Install the \"solana-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-solana-vulnerability-scanner\",\"task\":\"Install solana-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Give Codex a repo-aware install prompt when the skill is not available through a local CLI.","copyLabel":"Copy prompt"},{"id":"claude-code","label":"Claude Code","title":"Claude Code skill prompt","kind":"agent-prompt","value":"Add \"solana-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-solana-vulnerability-scanner\",\"task\":\"Install solana-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this prompt to ask Claude Code to add the skill and explain the local activation steps.","copyLabel":"Copy prompt"},{"id":"cursor","label":"Cursor","title":"Cursor rule prompt","kind":"agent-prompt","value":"Turn \"solana-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-solana-vulnerability-scanner\",\"task\":\"Install solana-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this when installing as Cursor project rules or reusable agent instructions.","copyLabel":"Copy prompt"}],"repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner","github_repo":"trailofbits/skills","version":"1.0.0","license":"CC-BY-SA-4.0","updated_at":"2026-09-01T11:59:28.941454+00:00","canonical_key":"trailofbits/skills#plugins/building-secure-contracts/skills/solana-vulnerability-scanner","recommendation_reasons":["Matches task terms: vulnerability","Useful GitHub adoption: 6,844 stars","Install handoff is available","Repository freshness signal is available","Registry match score 32"],"urls":{"web":"https://www.openagentskill.com/skills/trailofbits-solana-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-solana-vulnerability-scanner","install_api":"https://www.openagentskill.com/api/skills/trailofbits-solana-vulnerability-scanner/install","audit":"https://www.openagentskill.com/skills/trailofbits-solana-vulnerability-scanner/audit","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/solana-vulnerability-scanner"}},{"rank":6,"match_type":"related","match_score":32,"raw_match_score":400.7,"semantic_relevance":52,"ranking_signals":{"retrieval":369,"semantic":52,"quality":12.6,"projectPopularity":19.2,"verifiedOutcomes":0,"verifiedSource":0},"slug":"trailofbits-algorand-vulnerability-scanner","name":"algorand-vulnerability-scanner","description":"Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).","tagline":"Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).","category":"security","tags":["agent-skill"],"author":{"name":"trailofbits","verified":false,"url":"https://github.com/trailofbits"},"attribution":{"status":"registry_indexed","statusLabel":"Registry indexed","shortLabel":"REGISTRY INDEXED","sourceLabel":"recursive skill source sync","sourceDetail":"trailofbits/skills","creatorName":"trailofbits","creatorUrl":"https://github.com/trailofbits","sourceUrl":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner","indexedBy":"OpenAgentSkill community index","claimUrl":"https://www.openagentskill.com/skills/trailofbits-algorand-vulnerability-scanner#claim-this-skill","claimCta":"Claim this skill","trustNote":"This listing was indexed from public sources and is not marked official until a maintainer claim is approved.","publicNote":"Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals."},"stats":{"stars":6823,"forks":585,"verified_installs":0,"install_attempts":0,"successful_runs":0,"total_outcomes":0,"downloads":0,"rating":0,"review_count":0,"quality_score":50.24},"quality":{"score":80,"tier":"strong","label":"Strong","summary":"Solid option that is likely worth shortlisting for production workflows.","signals":[{"label":"GitHub stars","value":"6.8K","tone":"positive"},{"label":"Freshness","value":"12d ago","tone":"positive"},{"label":"Install ready","value":"Yes","tone":"positive"},{"label":"License","value":"CC-BY-SA-4.0","tone":"neutral"}],"warnings":[]},"trust":{"version":"trust-score-v4","score":83,"tier":"strong","label":"Strong shortlist","summary":"Good trust signals with a few areas worth checking before rollout.","recommendedAction":"Test in a sandbox workflow and compare its install path with close alternatives.","dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":94,"weight":0.13,"status":"pass","detail":"6.8K GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":88,"weight":0.08,"status":"pass","detail":"6.8K stars, 585 forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":100,"weight":0.14,"status":"pass","detail":"12d since push"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"CC-BY-SA-4.0"},{"id":"documentation","label":"README/SKILL.md completeness","score":52,"weight":0.14,"status":"warn","detail":"Public metadata needs stronger README/SKILL.md context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":90,"weight":0.12,"status":"pass","detail":"no major dependency risk hints in public metadata"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add trailofbits/skills --skill algorand-vulnerability-scanner"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":100,"weight":0.07,"status":"pass","detail":"no high-risk permission surface in public metadata"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner"},{"id":"review_status","label":"Review status","score":88,"weight":0.05,"status":"pass","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"pass","label":"GitHub adoption","detail":"6.8K GitHub stars"},{"status":"pass","label":"Stars/forks activity","detail":"6.8K stars, 585 forks; issue activity unavailable in current metadata"},{"status":"pass","label":"Recent maintenance","detail":"12d since push"},{"status":"pass","label":"License clarity","detail":"CC-BY-SA-4.0"},{"status":"warn","label":"README/SKILL.md completeness","detail":"Public metadata needs stronger README/SKILL.md context"},{"status":"pass","label":"Dependency/runtime risk","detail":"no major dependency risk hints in public metadata"},{"status":"pass","label":"Install availability","detail":"npx skills add trailofbits/skills --skill algorand-vulnerability-scanner"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"pass","label":"Permission surface","detail":"no high-risk permission surface in public metadata"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner"},{"status":"pass","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"warn","label":"Ownership","detail":"No approved owner claim yet"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["AI review approved","Install path is available","Repository evidence is available","Recently maintained repository","Large GitHub adoption signal","Install command has no obvious high-risk pattern"],"warnings":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"12d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill algorand-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"installReadiness":{"ready":true,"command":"npx skills add trailofbits/skills --skill algorand-vulnerability-scanner","policy":"human_review_before_install","label":"Human review before install","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","12d since push"]},"agentCompatibility":["Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"medium","label":"Review before production","notes":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":false,"sandboxRequired":true,"policy":"human_review_before_install","reason":"Human review or sandbox validation is required before automatic installation."},"bestFor":["security","agent-skill"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface","Automatic installation in a production workspace"],"knownRisks":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety":{"score":75,"level":"review_before_install","label":"Review before install","safety_tier":{"tier":"reviewed","label":"Reviewed","badge":"REVIEWED","summary":"Good audit and safety signals with no high-risk permission hints in public metadata.","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","auto_install_policy":"review","reasons":["Safe-to-try audit","75/100 agent safety score"]},"auto_install_allowed":false,"human_review_required":true,"blocked":false,"audit_risk":"safe_to_try","permission_hints":[{"id":"network","label":"Network access","reason":"Skill likely fetches remote pages, APIs, repositories, or external services.","severity":"medium"}],"policy_warnings":["Quality score needs review"],"constraints_applied":{"max_risk":"medium","needs_install_command":true,"min_stars":0}},"safety_gate":{"tier":"reviewed","label":"Reviewed","badge":"REVIEWED","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","reasons":["Safe-to-try audit","75/100 agent safety score"]},"supply_profile":{"track":{"slug":"legal","label":"Legal, policy, and compliance","shortLabel":"Legal","description":"Contract analysis, privacy, policy review, compliance checks, governance, and document risk review."},"scenario":{"label":"Security and compliance","description":"I need my agent to scan a project for security risks and summarize what needs attention.","useCases":[{"slug":"security-compliance","title":"Security and compliance"},{"slug":"github-automation","title":"GitHub automation"},{"slug":"legal-compliance","title":"Legal and compliance"}]},"applicableAgents":["Claude Code","CLI","Codex","Cursor"],"install":{"ready":true,"command":"npx skills add trailofbits/skills --skill algorand-vulnerability-scanner","primaryTarget":"CLI","targetCount":4},"githubQuality":{"stars":6823,"starsLabel":"6.8K","forks":585,"license":"CC-BY-SA-4.0","qualityScore":80,"trustScore":83,"auditScore":87},"maintenance":{"status":"fresh","label":"12d since push","daysSincePush":12,"lastPushedAt":"2026-08-24T13:20:11+00:00"},"risk":{"level":"safe_to_try","label":"Safe to try","requiresReview":true,"notes":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"coverageTags":["Legal","Security and compliance","security","agent-skill"]},"audit":{"audit_score":87,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"decision":{"readiness_score":91,"readiness_label":"Production-ready","headline":"Primary pick for Security and compliance","role":"Primary pick","primary_fit":"Security and compliance","best_for":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals"],"risks":["No OpenAgentSkill engagement data yet"],"next_steps":["Install it in a sandbox agent and run one Security and compliance task end to end.","Compare output quality, latency, and failure behavior against at least one alternative.","Promote it into production only after reviewing repository permissions, license, and maintenance signals."]},"agent_readable_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-algorand-vulnerability-scanner","name":"algorand-vulnerability-scanner","description":"Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-algorand-vulnerability-scanner","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner","github_repo":"trailofbits/skills"},"suited_tasks":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Inspect repository metadata","Compare code changes"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill algorand-vulnerability-scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-algorand-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"algorand-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-algorand-vulnerability-scanner\",\"task\":\"Install algorand-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"algorand-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-algorand-vulnerability-scanner\",\"task\":\"Install algorand-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"algorand-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-algorand-vulnerability-scanner\",\"task\":\"Install algorand-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-algorand-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-algorand-vulnerability-scanner"},"trust":{"score":83,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"12d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill algorand-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","agent-skill"],"known_risks":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":87,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow."},"quality":{"score":80,"label":"Strong"},"supply":{"track":"Legal, policy, and compliance","scenario":"Security and compliance","maintenance":"12d since push","risk":"Safe to try"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","high-compliance environments without internal security review","No OpenAgentSkill engagement data yet","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"agent_contract":{"task_input":"Use algorand-vulnerability-scanner in an agent workflow","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","install_policy":"review","minimum_review_before_use":["Trust: 83/100 Strong shortlist","Audit: 87/100 Safe to try","Safety: 75/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-algorand-vulnerability-scanner (algorand-vulnerability-scanner)","install_command":"npx skills add trailofbits/skills --skill algorand-vulnerability-scanner","risk_summary":"Safe to try; Reviewed; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-algorand-vulnerability-scanner","task":"Use algorand-vulnerability-scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-algorand-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-algorand-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/trailofbits-algorand-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-algorand-vulnerability-scanner&task=Use%20algorand-vulnerability-scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20algorand-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20algorand-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-algorand-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-algorand-vulnerability-scanner"}},"machine_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-algorand-vulnerability-scanner","name":"algorand-vulnerability-scanner","description":"Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-algorand-vulnerability-scanner","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner","github_repo":"trailofbits/skills"},"suited_tasks":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Inspect repository metadata","Compare code changes"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill algorand-vulnerability-scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-algorand-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"algorand-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-algorand-vulnerability-scanner\",\"task\":\"Install algorand-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"algorand-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-algorand-vulnerability-scanner\",\"task\":\"Install algorand-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"algorand-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-algorand-vulnerability-scanner\",\"task\":\"Install algorand-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-algorand-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-algorand-vulnerability-scanner"},"trust":{"score":83,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"12d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill algorand-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","agent-skill"],"known_risks":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":87,"risk_level":"safe_to_try","risk_label":"Safe to try","warnings":["Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow."},"quality":{"score":80,"label":"Strong"},"supply":{"track":"Legal, policy, and compliance","scenario":"Security and compliance","maintenance":"12d since push","risk":"Safe to try"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","high-compliance environments without internal security review","No OpenAgentSkill engagement data yet","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context","Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface"],"agent_contract":{"task_input":"Use algorand-vulnerability-scanner in an agent workflow","recommended_action":"Review the audit page, then allow agent install in a sandboxed workflow.","install_policy":"review","minimum_review_before_use":["Trust: 83/100 Strong shortlist","Audit: 87/100 Safe to try","Safety: 75/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-algorand-vulnerability-scanner (algorand-vulnerability-scanner)","install_command":"npx skills add trailofbits/skills --skill algorand-vulnerability-scanner","risk_summary":"Safe to try; Reviewed; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-algorand-vulnerability-scanner","task":"Use algorand-vulnerability-scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-algorand-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-algorand-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/trailofbits-algorand-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-algorand-vulnerability-scanner&task=Use%20algorand-vulnerability-scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20algorand-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20algorand-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-algorand-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-algorand-vulnerability-scanner"}},"platforms":["Claude Code"],"use_cases":[{"slug":"security-compliance","title":"Security and compliance","url":"https://www.openagentskill.com/use-cases/security-compliance"},{"slug":"github-automation","title":"GitHub automation","url":"https://www.openagentskill.com/use-cases/github-automation"},{"slug":"legal-compliance","title":"Legal and compliance","url":"https://www.openagentskill.com/use-cases/legal-compliance"},{"slug":"web-scraping","title":"Web scraping","url":"https://www.openagentskill.com/use-cases/web-scraping"}],"install":"npx skills add trailofbits/skills --skill algorand-vulnerability-scanner","install_targets":[{"id":"openagentskill-cli","label":"CLI","title":"OpenAgentSkill CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-algorand-vulnerability-scanner","description":"Resolve policy, run the source installer safely, and report a verified install receipt.","copyLabel":"Copy command"},{"id":"codex","label":"Codex","title":"Codex install prompt","kind":"agent-prompt","value":"Install the \"algorand-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-algorand-vulnerability-scanner\",\"task\":\"Install algorand-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Give Codex a repo-aware install prompt when the skill is not available through a local CLI.","copyLabel":"Copy prompt"},{"id":"claude-code","label":"Claude Code","title":"Claude Code skill prompt","kind":"agent-prompt","value":"Add \"algorand-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-algorand-vulnerability-scanner\",\"task\":\"Install algorand-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this prompt to ask Claude Code to add the skill and explain the local activation steps.","copyLabel":"Copy prompt"},{"id":"cursor","label":"Cursor","title":"Cursor rule prompt","kind":"agent-prompt","value":"Turn \"algorand-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-algorand-vulnerability-scanner\",\"task\":\"Install algorand-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this when installing as Cursor project rules or reusable agent instructions.","copyLabel":"Copy prompt"}],"repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner","github_repo":"trailofbits/skills","version":"1.0.0","license":"CC-BY-SA-4.0","updated_at":"2026-09-01T11:59:28.941454+00:00","canonical_key":"trailofbits/skills#plugins/building-secure-contracts/skills/algorand-vulnerability-scanner","recommendation_reasons":["Matches task terms: vulnerability","Useful GitHub adoption: 6,823 stars","Install handoff is available","Repository freshness signal is available","Registry match score 32"],"urls":{"web":"https://www.openagentskill.com/skills/trailofbits-algorand-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-algorand-vulnerability-scanner","install_api":"https://www.openagentskill.com/api/skills/trailofbits-algorand-vulnerability-scanner/install","audit":"https://www.openagentskill.com/skills/trailofbits-algorand-vulnerability-scanner/audit","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner"}},{"rank":7,"match_type":"related","match_score":32,"raw_match_score":400.7,"semantic_relevance":52,"ranking_signals":{"retrieval":369,"semantic":52,"quality":12.5,"projectPopularity":19.2,"verifiedOutcomes":0,"verifiedSource":0},"slug":"trailofbits-ton-vulnerability-scanner","name":"ton-vulnerability-scanner","description":"Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.","tagline":"Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.","category":"security","tags":["agent-skill"],"author":{"name":"trailofbits","verified":false,"url":"https://github.com/trailofbits"},"attribution":{"status":"registry_indexed","statusLabel":"Registry indexed","shortLabel":"REGISTRY INDEXED","sourceLabel":"recursive skill source sync","sourceDetail":"trailofbits/skills","creatorName":"trailofbits","creatorUrl":"https://github.com/trailofbits","sourceUrl":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner","indexedBy":"OpenAgentSkill community index","claimUrl":"https://www.openagentskill.com/skills/trailofbits-ton-vulnerability-scanner#claim-this-skill","claimCta":"Claim this skill","trustNote":"This listing was indexed from public sources and is not marked official until a maintainer claim is approved.","publicNote":"Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals."},"stats":{"stars":6844,"forks":586,"verified_installs":0,"install_attempts":0,"successful_runs":0,"total_outcomes":0,"downloads":0,"rating":0,"review_count":0,"quality_score":50.1},"quality":{"score":79,"tier":"strong","label":"Strong","summary":"Solid option that is likely worth shortlisting for production workflows.","signals":[{"label":"GitHub stars","value":"6.8K","tone":"positive"},{"label":"Freshness","value":"11d ago","tone":"positive"},{"label":"Install ready","value":"Yes","tone":"positive"},{"label":"License","value":"CC-BY-SA-4.0","tone":"neutral"}],"warnings":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly."]},"trust":{"version":"trust-score-v4","score":76,"tier":"strong","label":"Strong shortlist","summary":"Good trust signals with a few areas worth checking before rollout.","recommendedAction":"Test in a sandbox workflow and compare its install path with close alternatives.","dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":94,"weight":0.13,"status":"pass","detail":"6.8K GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":88,"weight":0.08,"status":"pass","detail":"6.8K stars, 586 forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":100,"weight":0.14,"status":"pass","detail":"11d since push"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"CC-BY-SA-4.0"},{"id":"documentation","label":"README/SKILL.md completeness","score":52,"weight":0.14,"status":"warn","detail":"Public metadata needs stronger README/SKILL.md context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":90,"weight":0.12,"status":"pass","detail":"no major dependency risk hints in public metadata"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add trailofbits/skills --skill ton-vulnerability-scanner"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":86,"weight":0.07,"status":"pass","detail":"network or browser access"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner"},{"id":"review_status","label":"Review status","score":66,"weight":0.05,"status":"info","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"pass","label":"GitHub adoption","detail":"6.8K GitHub stars"},{"status":"pass","label":"Stars/forks activity","detail":"6.8K stars, 586 forks; issue activity unavailable in current metadata"},{"status":"pass","label":"Recent maintenance","detail":"11d since push"},{"status":"pass","label":"License clarity","detail":"CC-BY-SA-4.0"},{"status":"warn","label":"README/SKILL.md completeness","detail":"Public metadata needs stronger README/SKILL.md context"},{"status":"pass","label":"Dependency/runtime risk","detail":"no major dependency risk hints in public metadata"},{"status":"pass","label":"Install availability","detail":"npx skills add trailofbits/skills --skill ton-vulnerability-scanner"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"pass","label":"Permission surface","detail":"network or browser access"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner"},{"status":"info","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"warn","label":"Ownership","detail":"No approved owner claim yet"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["AI review approved","Install path is available","Repository evidence is available","Recently maintained repository","Large GitHub adoption signal","Install command has no obvious high-risk pattern"],"warnings":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 586 forks","lastPushed":"11d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill ton-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"network or browser access","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"installReadiness":{"ready":true,"command":"npx skills add trailofbits/skills --skill ton-vulnerability-scanner","policy":"human_review_before_install","label":"Human review before install","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","11d since push"]},"agentCompatibility":["Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"medium","label":"Review before production","notes":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":false,"sandboxRequired":true,"policy":"human_review_before_install","reason":"Human review or sandbox validation is required before automatic installation."},"bestFor":["security","agent-skill"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface","Automatic installation in a production workspace"],"knownRisks":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety":{"score":71,"level":"review_before_install","label":"Review before install","safety_tier":{"tier":"reviewed","label":"Reviewed with permission notes","badge":"REVIEWED","summary":"Usable candidate, but the agent should surface permission and audit notes before installation.","recommended_action":"Require human approval before installing into a real workspace.","auto_install_policy":"review","reasons":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","71/100 agent safety score"]},"auto_install_allowed":false,"human_review_required":true,"blocked":false,"audit_risk":"needs_review","permission_hints":[{"id":"network","label":"Network access","reason":"Skill likely fetches remote pages, APIs, repositories, or external services.","severity":"medium"}],"policy_warnings":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly."],"constraints_applied":{"max_risk":"medium","needs_install_command":true,"min_stars":0}},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","badge":"REVIEWED","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace.","reasons":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","71/100 agent safety score"]},"supply_profile":{"track":{"slug":"legal","label":"Legal, policy, and compliance","shortLabel":"Legal","description":"Contract analysis, privacy, policy review, compliance checks, governance, and document risk review."},"scenario":{"label":"Security and compliance","description":"I need my agent to scan a project for security risks and summarize what needs attention.","useCases":[{"slug":"security-compliance","title":"Security and compliance"},{"slug":"legal-compliance","title":"Legal and compliance"},{"slug":"web-scraping","title":"Web scraping"}]},"applicableAgents":["Claude Code","CLI","Codex","Cursor"],"install":{"ready":true,"command":"npx skills add trailofbits/skills --skill ton-vulnerability-scanner","primaryTarget":"CLI","targetCount":4},"githubQuality":{"stars":6844,"starsLabel":"6.8K","forks":586,"license":"CC-BY-SA-4.0","qualityScore":79,"trustScore":76,"auditScore":83},"maintenance":{"status":"fresh","label":"11d since push","daysSincePush":11,"lastPushedAt":"2026-08-25T13:19:32+00:00"},"risk":{"level":"needs_review","label":"Needs review","requiresReview":true,"notes":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","The SKILL.md pattern summary lists three different patterns than the description, which may confuse users about what the skill actually checks.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"coverageTags":["Legal","Security and compliance","security","agent-skill"]},"audit":{"audit_score":83,"risk_level":"needs_review","risk_label":"Needs review","warnings":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","The SKILL.md pattern summary lists three different patterns than the description, which may confuse users about what the skill actually checks.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"decision":{"readiness_score":90,"readiness_label":"Production-ready","headline":"Primary pick for Security and compliance","role":"Primary pick","primary_fit":"Security and compliance","best_for":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals"],"risks":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","No OpenAgentSkill engagement data yet"],"next_steps":["Install it in a sandbox agent and run one Security and compliance task end to end.","Compare output quality, latency, and failure behavior against at least one alternative.","Promote it into production only after reviewing repository permissions, license, and maintenance signals."]},"agent_readable_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-ton-vulnerability-scanner","name":"ton-vulnerability-scanner","description":"Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-ton-vulnerability-scanner","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner","github_repo":"trailofbits/skills"},"suited_tasks":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Extract obligations","Highlight risky clauses"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill ton-vulnerability-scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-ton-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"ton-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-ton-vulnerability-scanner\",\"task\":\"Install ton-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"ton-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-ton-vulnerability-scanner\",\"task\":\"Install ton-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"ton-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-ton-vulnerability-scanner\",\"task\":\"Install ton-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-ton-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-ton-vulnerability-scanner"},"trust":{"score":76,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 586 forks","lastPushed":"11d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill ton-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"network or browser access","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","agent-skill"],"known_risks":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":83,"risk_level":"needs_review","risk_label":"Needs review","warnings":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","The SKILL.md pattern summary lists three different patterns than the description, which may confuse users about what the skill actually checks.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace."},"quality":{"score":79,"label":"Strong"},"supply":{"track":"Legal, policy, and compliance","scenario":"Security and compliance","maintenance":"11d since push","risk":"Needs review"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","production agents without a repository review","Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","No OpenAgentSkill engagement data yet","The SKILL.md pattern summary lists three different patterns than the description, which may confuse users about what the skill actually checks.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"agent_contract":{"task_input":"Use ton-vulnerability-scanner in an agent workflow","recommended_action":"Require human approval before installing into a real workspace.","install_policy":"review","minimum_review_before_use":["Trust: 76/100 Strong shortlist","Audit: 83/100 Needs review","Safety: 71/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-ton-vulnerability-scanner (ton-vulnerability-scanner)","install_command":"npx skills add trailofbits/skills --skill ton-vulnerability-scanner","risk_summary":"Needs review; Reviewed with permission notes; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-ton-vulnerability-scanner","task":"Use ton-vulnerability-scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-ton-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-ton-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/trailofbits-ton-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-ton-vulnerability-scanner&task=Use%20ton-vulnerability-scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20ton-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20ton-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-ton-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-ton-vulnerability-scanner"}},"machine_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-ton-vulnerability-scanner","name":"ton-vulnerability-scanner","description":"Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-ton-vulnerability-scanner","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner","github_repo":"trailofbits/skills"},"suited_tasks":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Extract obligations","Highlight risky clauses"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill ton-vulnerability-scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-ton-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"ton-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-ton-vulnerability-scanner\",\"task\":\"Install ton-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"ton-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-ton-vulnerability-scanner\",\"task\":\"Install ton-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"ton-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-ton-vulnerability-scanner\",\"task\":\"Install ton-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-ton-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-ton-vulnerability-scanner"},"trust":{"score":76,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 586 forks","lastPushed":"11d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill ton-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"network or browser access","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","agent-skill"],"known_risks":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":83,"risk_level":"needs_review","risk_label":"Needs review","warnings":["Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","The SKILL.md pattern summary lists three different patterns than the description, which may confuse users about what the skill actually checks.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace."},"quality":{"score":79,"label":"Strong"},"supply":{"track":"Legal, policy, and compliance","scenario":"Security and compliance","maintenance":"11d since push","risk":"Needs review"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","production agents without a repository review","Inconsistency between the description (mentions integer-as-boolean misuse, fake Jetton contracts, forward TON without gas checks) and the SKILL.md pattern summary (Missing Sender Check, Integer Overflow, Improper Gas Handling). The detailed patterns file includes 'Integer as Boolean' but not 'fake Jetton' or 'forward TON without gas checks' explicitly.","No OpenAgentSkill engagement data yet","The SKILL.md pattern summary lists three different patterns than the description, which may confuse users about what the skill actually checks.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"agent_contract":{"task_input":"Use ton-vulnerability-scanner in an agent workflow","recommended_action":"Require human approval before installing into a real workspace.","install_policy":"review","minimum_review_before_use":["Trust: 76/100 Strong shortlist","Audit: 83/100 Needs review","Safety: 71/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-ton-vulnerability-scanner (ton-vulnerability-scanner)","install_command":"npx skills add trailofbits/skills --skill ton-vulnerability-scanner","risk_summary":"Needs review; Reviewed with permission notes; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-ton-vulnerability-scanner","task":"Use ton-vulnerability-scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-ton-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-ton-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/trailofbits-ton-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-ton-vulnerability-scanner&task=Use%20ton-vulnerability-scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20ton-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20ton-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-ton-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-ton-vulnerability-scanner"}},"platforms":["Claude Code"],"use_cases":[{"slug":"security-compliance","title":"Security and compliance","url":"https://www.openagentskill.com/use-cases/security-compliance"},{"slug":"legal-compliance","title":"Legal and compliance","url":"https://www.openagentskill.com/use-cases/legal-compliance"},{"slug":"web-scraping","title":"Web scraping","url":"https://www.openagentskill.com/use-cases/web-scraping"},{"slug":"coding-agents","title":"Coding agents","url":"https://www.openagentskill.com/use-cases/coding-agents"}],"install":"npx skills add trailofbits/skills --skill ton-vulnerability-scanner","install_targets":[{"id":"openagentskill-cli","label":"CLI","title":"OpenAgentSkill CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-ton-vulnerability-scanner","description":"Resolve policy, run the source installer safely, and report a verified install receipt.","copyLabel":"Copy command"},{"id":"codex","label":"Codex","title":"Codex install prompt","kind":"agent-prompt","value":"Install the \"ton-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-ton-vulnerability-scanner\",\"task\":\"Install ton-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Give Codex a repo-aware install prompt when the skill is not available through a local CLI.","copyLabel":"Copy prompt"},{"id":"claude-code","label":"Claude Code","title":"Claude Code skill prompt","kind":"agent-prompt","value":"Add \"ton-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-ton-vulnerability-scanner\",\"task\":\"Install ton-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this prompt to ask Claude Code to add the skill and explain the local activation steps.","copyLabel":"Copy prompt"},{"id":"cursor","label":"Cursor","title":"Cursor rule prompt","kind":"agent-prompt","value":"Turn \"ton-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-ton-vulnerability-scanner\",\"task\":\"Install ton-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this when installing as Cursor project rules or reusable agent instructions.","copyLabel":"Copy prompt"}],"repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner","github_repo":"trailofbits/skills","version":"1.0.0","license":"CC-BY-SA-4.0","updated_at":"2026-09-01T11:59:28.941454+00:00","canonical_key":"trailofbits/skills#plugins/building-secure-contracts/skills/ton-vulnerability-scanner","recommendation_reasons":["Matches task terms: vulnerability","Useful GitHub adoption: 6,844 stars","Install handoff is available","Repository freshness signal is available","Registry match score 32"],"urls":{"web":"https://www.openagentskill.com/skills/trailofbits-ton-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-ton-vulnerability-scanner","install_api":"https://www.openagentskill.com/api/skills/trailofbits-ton-vulnerability-scanner/install","audit":"https://www.openagentskill.com/skills/trailofbits-ton-vulnerability-scanner/audit","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/ton-vulnerability-scanner"}},{"rank":8,"match_type":"related","match_score":32,"raw_match_score":400.7,"semantic_relevance":52,"ranking_signals":{"retrieval":369,"semantic":52,"quality":12.5,"projectPopularity":19.2,"verifiedOutcomes":0,"verifiedSource":0},"slug":"trailofbits-cairo-vulnerability-scanner","name":"cairo-vulnerability-scanner","description":"Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.","tagline":"Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.","category":"security","tags":["agent-skill"],"author":{"name":"trailofbits","verified":false,"url":"https://github.com/trailofbits"},"attribution":{"status":"registry_indexed","statusLabel":"Registry indexed","shortLabel":"REGISTRY INDEXED","sourceLabel":"recursive skill source sync","sourceDetail":"trailofbits/skills","creatorName":"trailofbits","creatorUrl":"https://github.com/trailofbits","sourceUrl":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner","indexedBy":"OpenAgentSkill community index","claimUrl":"https://www.openagentskill.com/skills/trailofbits-cairo-vulnerability-scanner#claim-this-skill","claimCta":"Claim this skill","trustNote":"This listing was indexed from public sources and is not marked official until a maintainer claim is approved.","publicNote":"Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals."},"stats":{"stars":6823,"forks":585,"verified_installs":0,"install_attempts":0,"successful_runs":0,"total_outcomes":0,"downloads":0,"rating":0,"review_count":0,"quality_score":50.09},"quality":{"score":79,"tier":"strong","label":"Strong","summary":"Solid option that is likely worth shortlisting for production workflows.","signals":[{"label":"GitHub stars","value":"6.8K","tone":"positive"},{"label":"Freshness","value":"12d ago","tone":"positive"},{"label":"Install ready","value":"Yes","tone":"positive"},{"label":"License","value":"CC-BY-SA-4.0","tone":"neutral"}],"warnings":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns)."]},"trust":{"version":"trust-score-v4","score":77,"tier":"strong","label":"Strong shortlist","summary":"Good trust signals with a few areas worth checking before rollout.","recommendedAction":"Test in a sandbox workflow and compare its install path with close alternatives.","dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":94,"weight":0.13,"status":"pass","detail":"6.8K GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":88,"weight":0.08,"status":"pass","detail":"6.8K stars, 585 forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":100,"weight":0.14,"status":"pass","detail":"12d since push"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"CC-BY-SA-4.0"},{"id":"documentation","label":"README/SKILL.md completeness","score":52,"weight":0.14,"status":"warn","detail":"Public metadata needs stronger README/SKILL.md context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":90,"weight":0.12,"status":"pass","detail":"no major dependency risk hints in public metadata"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add trailofbits/skills --skill cairo-vulnerability-scanner"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":100,"weight":0.07,"status":"pass","detail":"no high-risk permission surface in public metadata"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner"},{"id":"review_status","label":"Review status","score":66,"weight":0.05,"status":"info","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"pass","label":"GitHub adoption","detail":"6.8K GitHub stars"},{"status":"pass","label":"Stars/forks activity","detail":"6.8K stars, 585 forks; issue activity unavailable in current metadata"},{"status":"pass","label":"Recent maintenance","detail":"12d since push"},{"status":"pass","label":"License clarity","detail":"CC-BY-SA-4.0"},{"status":"warn","label":"README/SKILL.md completeness","detail":"Public metadata needs stronger README/SKILL.md context"},{"status":"pass","label":"Dependency/runtime risk","detail":"no major dependency risk hints in public metadata"},{"status":"pass","label":"Install availability","detail":"npx skills add trailofbits/skills --skill cairo-vulnerability-scanner"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"pass","label":"Permission surface","detail":"no high-risk permission surface in public metadata"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner"},{"status":"info","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"warn","label":"Ownership","detail":"No approved owner claim yet"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["AI review approved","Install path is available","Repository evidence is available","Recently maintained repository","Large GitHub adoption signal","Install command has no obvious high-risk pattern"],"warnings":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"12d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill cairo-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"installReadiness":{"ready":true,"command":"npx skills add trailofbits/skills --skill cairo-vulnerability-scanner","policy":"human_review_before_install","label":"Human review before install","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","12d since push"]},"agentCompatibility":["Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"medium","label":"Review before production","notes":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":false,"sandboxRequired":true,"policy":"human_review_before_install","reason":"Human review or sandbox validation is required before automatic installation."},"bestFor":["security","agent-skill"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface","Automatic installation in a production workspace"],"knownRisks":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety":{"score":72,"level":"review_before_install","label":"Review before install","safety_tier":{"tier":"reviewed","label":"Reviewed with permission notes","badge":"REVIEWED","summary":"Usable candidate, but the agent should surface permission and audit notes before installation.","recommended_action":"Require human approval before installing into a real workspace.","auto_install_policy":"review","reasons":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","72/100 agent safety score"]},"auto_install_allowed":false,"human_review_required":true,"blocked":false,"audit_risk":"needs_review","permission_hints":[{"id":"network","label":"Network access","reason":"Skill likely fetches remote pages, APIs, repositories, or external services.","severity":"medium"}],"policy_warnings":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns)."],"constraints_applied":{"max_risk":"medium","needs_install_command":true,"min_stars":0}},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","badge":"REVIEWED","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace.","reasons":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","72/100 agent safety score"]},"supply_profile":{"track":{"slug":"legal","label":"Legal, policy, and compliance","shortLabel":"Legal","description":"Contract analysis, privacy, policy review, compliance checks, governance, and document risk review."},"scenario":{"label":"Security and compliance","description":"I need my agent to scan a project for security risks and summarize what needs attention.","useCases":[{"slug":"security-compliance","title":"Security and compliance"},{"slug":"github-automation","title":"GitHub automation"},{"slug":"legal-compliance","title":"Legal and compliance"}]},"applicableAgents":["Claude Code","CLI","Codex","Cursor"],"install":{"ready":true,"command":"npx skills add trailofbits/skills --skill cairo-vulnerability-scanner","primaryTarget":"CLI","targetCount":4},"githubQuality":{"stars":6823,"starsLabel":"6.8K","forks":585,"license":"CC-BY-SA-4.0","qualityScore":79,"trustScore":77,"auditScore":84},"maintenance":{"status":"fresh","label":"12d since push","daysSincePush":12,"lastPushedAt":"2026-08-24T13:20:11+00:00"},"risk":{"level":"needs_review","label":"Needs review","requiresReview":true,"notes":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","The skill references Caracal installation via `cargo install` but does not warn about potential supply chain risks of running arbitrary code; users should review before executing.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"coverageTags":["Legal","Security and compliance","security","agent-skill"]},"audit":{"audit_score":84,"risk_level":"needs_review","risk_label":"Needs review","warnings":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","The skill references Caracal installation via `cargo install` but does not warn about potential supply chain risks of running arbitrary code; users should review before executing.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"decision":{"readiness_score":90,"readiness_label":"Production-ready","headline":"Primary pick for Security and compliance","role":"Primary pick","primary_fit":"Security and compliance","best_for":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals"],"risks":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","No OpenAgentSkill engagement data yet"],"next_steps":["Install it in a sandbox agent and run one Security and compliance task end to end.","Compare output quality, latency, and failure behavior against at least one alternative.","Promote it into production only after reviewing repository permissions, license, and maintenance signals."]},"agent_readable_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-cairo-vulnerability-scanner","name":"cairo-vulnerability-scanner","description":"Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-cairo-vulnerability-scanner","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner","github_repo":"trailofbits/skills"},"suited_tasks":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Inspect repository metadata","Compare code changes"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill cairo-vulnerability-scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-cairo-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"cairo-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cairo-vulnerability-scanner\",\"task\":\"Install cairo-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"cairo-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cairo-vulnerability-scanner\",\"task\":\"Install cairo-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"cairo-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cairo-vulnerability-scanner\",\"task\":\"Install cairo-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-cairo-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-cairo-vulnerability-scanner"},"trust":{"score":77,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"12d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill cairo-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","agent-skill"],"known_risks":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":84,"risk_level":"needs_review","risk_label":"Needs review","warnings":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","The skill references Caracal installation via `cargo install` but does not warn about potential supply chain risks of running arbitrary code; users should review before executing.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace."},"quality":{"score":79,"label":"Strong"},"supply":{"track":"Legal, policy, and compliance","scenario":"Security and compliance","maintenance":"12d since push","risk":"Needs review"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","production agents without a repository review","SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","No OpenAgentSkill engagement data yet","The skill references Caracal installation via `cargo install` but does not warn about potential supply chain risks of running arbitrary code; users should review before executing.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"agent_contract":{"task_input":"Use cairo-vulnerability-scanner in an agent workflow","recommended_action":"Require human approval before installing into a real workspace.","install_policy":"review","minimum_review_before_use":["Trust: 77/100 Strong shortlist","Audit: 84/100 Needs review","Safety: 72/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-cairo-vulnerability-scanner (cairo-vulnerability-scanner)","install_command":"npx skills add trailofbits/skills --skill cairo-vulnerability-scanner","risk_summary":"Needs review; Reviewed with permission notes; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-cairo-vulnerability-scanner","task":"Use cairo-vulnerability-scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-cairo-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-cairo-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/trailofbits-cairo-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-cairo-vulnerability-scanner&task=Use%20cairo-vulnerability-scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20cairo-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20cairo-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-cairo-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-cairo-vulnerability-scanner"}},"machine_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-cairo-vulnerability-scanner","name":"cairo-vulnerability-scanner","description":"Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-cairo-vulnerability-scanner","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner","github_repo":"trailofbits/skills"},"suited_tasks":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Inspect repository metadata","Compare code changes"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill cairo-vulnerability-scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-cairo-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"cairo-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cairo-vulnerability-scanner\",\"task\":\"Install cairo-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"cairo-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cairo-vulnerability-scanner\",\"task\":\"Install cairo-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"cairo-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cairo-vulnerability-scanner\",\"task\":\"Install cairo-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-cairo-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-cairo-vulnerability-scanner"},"trust":{"score":77,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"12d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill cairo-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","agent-skill"],"known_risks":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":84,"risk_level":"needs_review","risk_label":"Needs review","warnings":["SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","The skill references Caracal installation via `cargo install` but does not warn about potential supply chain risks of running arbitrary code; users should review before executing.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace."},"quality":{"score":79,"label":"Strong"},"supply":{"track":"Legal, policy, and compliance","scenario":"Security and compliance","maintenance":"12d since push","risk":"Needs review"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","production agents without a repository review","SKILL.md does not explicitly list its own limitations (e.g., that it focuses on Cairo 1.x and may miss issues outside the six patterns).","No OpenAgentSkill engagement data yet","The skill references Caracal installation via `cargo install` but does not warn about potential supply chain risks of running arbitrary code; users should review before executing.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"agent_contract":{"task_input":"Use cairo-vulnerability-scanner in an agent workflow","recommended_action":"Require human approval before installing into a real workspace.","install_policy":"review","minimum_review_before_use":["Trust: 77/100 Strong shortlist","Audit: 84/100 Needs review","Safety: 72/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-cairo-vulnerability-scanner (cairo-vulnerability-scanner)","install_command":"npx skills add trailofbits/skills --skill cairo-vulnerability-scanner","risk_summary":"Needs review; Reviewed with permission notes; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-cairo-vulnerability-scanner","task":"Use cairo-vulnerability-scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-cairo-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-cairo-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/trailofbits-cairo-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-cairo-vulnerability-scanner&task=Use%20cairo-vulnerability-scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20cairo-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20cairo-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-cairo-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-cairo-vulnerability-scanner"}},"platforms":["Claude Code"],"use_cases":[{"slug":"security-compliance","title":"Security and compliance","url":"https://www.openagentskill.com/use-cases/security-compliance"},{"slug":"github-automation","title":"GitHub automation","url":"https://www.openagentskill.com/use-cases/github-automation"},{"slug":"legal-compliance","title":"Legal and compliance","url":"https://www.openagentskill.com/use-cases/legal-compliance"},{"slug":"web-scraping","title":"Web scraping","url":"https://www.openagentskill.com/use-cases/web-scraping"}],"install":"npx skills add trailofbits/skills --skill cairo-vulnerability-scanner","install_targets":[{"id":"openagentskill-cli","label":"CLI","title":"OpenAgentSkill CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-cairo-vulnerability-scanner","description":"Resolve policy, run the source installer safely, and report a verified install receipt.","copyLabel":"Copy command"},{"id":"codex","label":"Codex","title":"Codex install prompt","kind":"agent-prompt","value":"Install the \"cairo-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cairo-vulnerability-scanner\",\"task\":\"Install cairo-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Give Codex a repo-aware install prompt when the skill is not available through a local CLI.","copyLabel":"Copy prompt"},{"id":"claude-code","label":"Claude Code","title":"Claude Code skill prompt","kind":"agent-prompt","value":"Add \"cairo-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cairo-vulnerability-scanner\",\"task\":\"Install cairo-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this prompt to ask Claude Code to add the skill and explain the local activation steps.","copyLabel":"Copy prompt"},{"id":"cursor","label":"Cursor","title":"Cursor rule prompt","kind":"agent-prompt","value":"Turn \"cairo-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cairo-vulnerability-scanner\",\"task\":\"Install cairo-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this when installing as Cursor project rules or reusable agent instructions.","copyLabel":"Copy prompt"}],"repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner","github_repo":"trailofbits/skills","version":"1.0.0","license":"CC-BY-SA-4.0","updated_at":"2026-09-01T11:59:28.941454+00:00","canonical_key":"trailofbits/skills#plugins/building-secure-contracts/skills/cairo-vulnerability-scanner","recommendation_reasons":["Matches task terms: vulnerability","Useful GitHub adoption: 6,823 stars","Install handoff is available","Repository freshness signal is available","Registry match score 32"],"urls":{"web":"https://www.openagentskill.com/skills/trailofbits-cairo-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-cairo-vulnerability-scanner","install_api":"https://www.openagentskill.com/api/skills/trailofbits-cairo-vulnerability-scanner/install","audit":"https://www.openagentskill.com/skills/trailofbits-cairo-vulnerability-scanner/audit","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cairo-vulnerability-scanner"}},{"rank":9,"match_type":"related","match_score":32,"raw_match_score":400.7,"semantic_relevance":52,"ranking_signals":{"retrieval":369,"semantic":52,"quality":12.5,"projectPopularity":19.2,"verifiedOutcomes":0,"verifiedSource":0},"slug":"trailofbits-cosmos-vulnerability-scanner","name":"cosmos-vulnerability-scanner","description":"Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.","tagline":"Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch ","category":"security","tags":["agent-skill"],"author":{"name":"trailofbits","verified":false,"url":"https://github.com/trailofbits"},"attribution":{"status":"registry_indexed","statusLabel":"Registry indexed","shortLabel":"REGISTRY INDEXED","sourceLabel":"recursive skill source sync","sourceDetail":"trailofbits/skills","creatorName":"trailofbits","creatorUrl":"https://github.com/trailofbits","sourceUrl":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner","indexedBy":"OpenAgentSkill community index","claimUrl":"https://www.openagentskill.com/skills/trailofbits-cosmos-vulnerability-scanner#claim-this-skill","claimCta":"Claim this skill","trustNote":"This listing was indexed from public sources and is not marked official until a maintainer claim is approved.","publicNote":"Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals."},"stats":{"stars":6823,"forks":585,"verified_installs":0,"install_attempts":0,"successful_runs":0,"total_outcomes":0,"downloads":0,"rating":0,"review_count":0,"quality_score":50.09},"quality":{"score":85,"tier":"excellent","label":"Excellent","summary":"High-confidence pick with strong adoption and healthy maintenance signals.","signals":[{"label":"GitHub stars","value":"6.8K","tone":"positive"},{"label":"Freshness","value":"12d ago","tone":"positive"},{"label":"Install ready","value":"Yes","tone":"positive"},{"label":"License","value":"CC-BY-SA-4.0","tone":"neutral"}],"warnings":["Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy."]},"trust":{"version":"trust-score-v4","score":77,"tier":"strong","label":"Strong shortlist","summary":"Good trust signals with a few areas worth checking before rollout.","recommendedAction":"Test in a sandbox workflow and compare its install path with close alternatives.","dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":94,"weight":0.13,"status":"pass","detail":"6.8K GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":88,"weight":0.08,"status":"pass","detail":"6.8K stars, 585 forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":100,"weight":0.14,"status":"pass","detail":"12d since push"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"CC-BY-SA-4.0"},{"id":"documentation","label":"README/SKILL.md completeness","score":52,"weight":0.14,"status":"warn","detail":"Public metadata needs stronger README/SKILL.md context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":90,"weight":0.12,"status":"pass","detail":"no major dependency risk hints in public metadata"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":100,"weight":0.07,"status":"pass","detail":"no high-risk permission surface in public metadata"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner"},{"id":"review_status","label":"Review status","score":66,"weight":0.05,"status":"info","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"pass","label":"GitHub adoption","detail":"6.8K GitHub stars"},{"status":"pass","label":"Stars/forks activity","detail":"6.8K stars, 585 forks; issue activity unavailable in current metadata"},{"status":"pass","label":"Recent maintenance","detail":"12d since push"},{"status":"pass","label":"License clarity","detail":"CC-BY-SA-4.0"},{"status":"warn","label":"README/SKILL.md completeness","detail":"Public metadata needs stronger README/SKILL.md context"},{"status":"pass","label":"Dependency/runtime risk","detail":"no major dependency risk hints in public metadata"},{"status":"pass","label":"Install availability","detail":"npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"pass","label":"Permission surface","detail":"no high-risk permission surface in public metadata"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner"},{"status":"info","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"warn","label":"Ownership","detail":"No approved owner claim yet"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["AI review approved","Install path is available","Repository evidence is available","Recently maintained repository","Large GitHub adoption signal","Install command has no obvious high-risk pattern"],"warnings":["Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.","Financial research output is not financial advice; require human review before any live investment decision.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"12d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"installReadiness":{"ready":true,"command":"npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner","policy":"human_review_before_install","label":"Human review before install","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","12d since push","Financial domain: human review is required before use in a live investment workflow."]},"agentCompatibility":["Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"medium","label":"Review before production","notes":["Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.","Financial research output is not financial advice; require human review before any live investment decision.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":false,"sandboxRequired":true,"policy":"human_review_before_install","reason":"Human review or sandbox validation is required before automatic installation."},"bestFor":["security","agent-skill"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface","Automatic installation in a production workspace","Autonomous investment, trading, tax, or suitability decisions without a qualified human review"],"knownRisks":["Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.","Financial research output is not financial advice; require human review before any live investment decision.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety":{"score":73,"level":"review_before_install","label":"Review before install","safety_tier":{"tier":"reviewed","label":"Reviewed with permission notes","badge":"REVIEWED","summary":"Usable candidate, but the agent should surface permission and audit notes before installation.","recommended_action":"Require human approval before installing into a real workspace.","auto_install_policy":"review","reasons":["Financial research output is not financial advice; require human review before any live investment decision","73/100 agent safety score"]},"auto_install_allowed":false,"human_review_required":true,"blocked":false,"audit_risk":"needs_review","permission_hints":[{"id":"network","label":"Network access","reason":"Skill likely fetches remote pages, APIs, repositories, or external services.","severity":"medium"}],"policy_warnings":["Financial research output is not financial advice; require human review before any live investment decision"],"constraints_applied":{"max_risk":"medium","needs_install_command":true,"min_stars":0}},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","badge":"REVIEWED","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace.","reasons":["Financial research output is not financial advice; require human review before any live investment decision","73/100 agent safety score"]},"supply_profile":{"track":{"slug":"legal","label":"Legal, policy, and compliance","shortLabel":"Legal","description":"Contract analysis, privacy, policy review, compliance checks, governance, and document risk review."},"scenario":{"label":"Security and compliance","description":"I need my agent to scan a project for security risks and summarize what needs attention.","useCases":[{"slug":"security-compliance","title":"Security and compliance"},{"slug":"coding-agents","title":"Coding agents"},{"slug":"workflow-automation","title":"Workflow automation"}]},"applicableAgents":["Claude Code","CLI","Codex","Cursor"],"install":{"ready":true,"command":"npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner","primaryTarget":"CLI","targetCount":4},"githubQuality":{"stars":6823,"starsLabel":"6.8K","forks":585,"license":"CC-BY-SA-4.0","qualityScore":85,"trustScore":77,"auditScore":85},"maintenance":{"status":"fresh","label":"12d since push","daysSincePush":12,"lastPushedAt":"2026-08-24T13:20:11+00:00"},"risk":{"level":"needs_review","label":"Needs review","requiresReview":true,"notes":["Financial research output is not financial advice; require human review before any live investment decision","Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.","The skill writes a CLAUDE.md file into the target repo root during discovery; this modifies the target filesystem. Ensure this is expected and communicated clearly to users.","Financial research output is not financial advice; require human review before any live investment decision.","Quality score needs review"]},"coverageTags":["Legal","Security and compliance","security","agent-skill"]},"audit":{"audit_score":85,"risk_level":"needs_review","risk_label":"Needs review","warnings":["Financial research output is not financial advice; require human review before any live investment decision","Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.","The skill writes a CLAUDE.md file into the target repo root during discovery; this modifies the target filesystem. Ensure this is expected and communicated clearly to users.","Financial research output is not financial advice; require human review before any live investment decision.","Quality score needs review"]},"decision":{"readiness_score":96,"readiness_label":"Production-ready","headline":"Primary pick for Security and compliance","role":"Primary pick","primary_fit":"Security and compliance","best_for":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals"],"risks":["Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.","No OpenAgentSkill engagement data yet"],"next_steps":["Install it in a sandbox agent and run one Security and compliance task end to end.","Compare output quality, latency, and failure behavior against at least one alternative.","Promote it into production only after reviewing repository permissions, license, and maintenance signals."]},"agent_readable_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-cosmos-vulnerability-scanner","name":"cosmos-vulnerability-scanner","description":"Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-cosmos-vulnerability-scanner","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner","github_repo":"trailofbits/skills"},"suited_tasks":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Inspect source files","Explain architecture"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-cosmos-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"cosmos-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cosmos-vulnerability-scanner\",\"task\":\"Install cosmos-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"cosmos-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cosmos-vulnerability-scanner\",\"task\":\"Install cosmos-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"cosmos-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cosmos-vulnerability-scanner\",\"task\":\"Install cosmos-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-cosmos-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-cosmos-vulnerability-scanner"},"trust":{"score":77,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"12d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","agent-skill"],"known_risks":["Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.","Financial research output is not financial advice; require human review before any live investment decision.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":85,"risk_level":"needs_review","risk_label":"Needs review","warnings":["Financial research output is not financial advice; require human review before any live investment decision","Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.","The skill writes a CLAUDE.md file into the target repo root during discovery; this modifies the target filesystem. Ensure this is expected and communicated clearly to users.","Financial research output is not financial advice; require human review before any live investment decision.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace."},"quality":{"score":85,"label":"Excellent"},"supply":{"track":"Legal, policy, and compliance","scenario":"Security and compliance","maintenance":"12d since push","risk":"Needs review"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","production agents without a repository review","Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.","No OpenAgentSkill engagement data yet","Financial research output is not financial advice; require human review before any live investment decision","The skill writes a CLAUDE.md file into the target repo root during discovery; this modifies the target filesystem. Ensure this is expected and communicated clearly to users.","Financial research output is not financial advice; require human review before any live investment decision.","Quality score needs review"],"agent_contract":{"task_input":"Use cosmos-vulnerability-scanner in an agent workflow","recommended_action":"Require human approval before installing into a real workspace.","install_policy":"review","minimum_review_before_use":["Trust: 77/100 Strong shortlist","Audit: 85/100 Needs review","Safety: 73/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-cosmos-vulnerability-scanner (cosmos-vulnerability-scanner)","install_command":"npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner","risk_summary":"Needs review; Reviewed with permission notes; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-cosmos-vulnerability-scanner","task":"Use cosmos-vulnerability-scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-cosmos-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-cosmos-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/trailofbits-cosmos-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-cosmos-vulnerability-scanner&task=Use%20cosmos-vulnerability-scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20cosmos-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20cosmos-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-cosmos-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-cosmos-vulnerability-scanner"}},"machine_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-cosmos-vulnerability-scanner","name":"cosmos-vulnerability-scanner","description":"Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-cosmos-vulnerability-scanner","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner","github_repo":"trailofbits/skills"},"suited_tasks":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Inspect source files","Explain architecture"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-cosmos-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"cosmos-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cosmos-vulnerability-scanner\",\"task\":\"Install cosmos-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"cosmos-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cosmos-vulnerability-scanner\",\"task\":\"Install cosmos-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"cosmos-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cosmos-vulnerability-scanner\",\"task\":\"Install cosmos-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-cosmos-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-cosmos-vulnerability-scanner"},"trust":{"score":77,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 585 forks","lastPushed":"12d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","agent-skill"],"known_risks":["Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.","Financial research output is not financial advice; require human review before any live investment decision.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":85,"risk_level":"needs_review","risk_label":"Needs review","warnings":["Financial research output is not financial advice; require human review before any live investment decision","Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.","The skill writes a CLAUDE.md file into the target repo root during discovery; this modifies the target filesystem. Ensure this is expected and communicated clearly to users.","Financial research output is not financial advice; require human review before any live investment decision.","Quality score needs review","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace."},"quality":{"score":85,"label":"Excellent"},"supply":{"track":"Legal, policy, and compliance","scenario":"Security and compliance","maintenance":"12d since push","risk":"Needs review"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","production agents without a repository review","Minor inconsistency: description mentions 25 core patterns, but CHANGELOG refers to 28 core patterns. Clarify the count for accuracy.","No OpenAgentSkill engagement data yet","Financial research output is not financial advice; require human review before any live investment decision","The skill writes a CLAUDE.md file into the target repo root during discovery; this modifies the target filesystem. Ensure this is expected and communicated clearly to users.","Financial research output is not financial advice; require human review before any live investment decision.","Quality score needs review"],"agent_contract":{"task_input":"Use cosmos-vulnerability-scanner in an agent workflow","recommended_action":"Require human approval before installing into a real workspace.","install_policy":"review","minimum_review_before_use":["Trust: 77/100 Strong shortlist","Audit: 85/100 Needs review","Safety: 73/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-cosmos-vulnerability-scanner (cosmos-vulnerability-scanner)","install_command":"npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner","risk_summary":"Needs review; Reviewed with permission notes; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-cosmos-vulnerability-scanner","task":"Use cosmos-vulnerability-scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-cosmos-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-cosmos-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/trailofbits-cosmos-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-cosmos-vulnerability-scanner&task=Use%20cosmos-vulnerability-scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20cosmos-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20cosmos-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-cosmos-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-cosmos-vulnerability-scanner"}},"platforms":["Claude Code"],"use_cases":[{"slug":"security-compliance","title":"Security and compliance","url":"https://www.openagentskill.com/use-cases/security-compliance"},{"slug":"coding-agents","title":"Coding agents","url":"https://www.openagentskill.com/use-cases/coding-agents"},{"slug":"workflow-automation","title":"Workflow automation","url":"https://www.openagentskill.com/use-cases/workflow-automation"},{"slug":"github-automation","title":"GitHub automation","url":"https://www.openagentskill.com/use-cases/github-automation"}],"install":"npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner","install_targets":[{"id":"openagentskill-cli","label":"CLI","title":"OpenAgentSkill CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-cosmos-vulnerability-scanner","description":"Resolve policy, run the source installer safely, and report a verified install receipt.","copyLabel":"Copy command"},{"id":"codex","label":"Codex","title":"Codex install prompt","kind":"agent-prompt","value":"Install the \"cosmos-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cosmos-vulnerability-scanner\",\"task\":\"Install cosmos-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Give Codex a repo-aware install prompt when the skill is not available through a local CLI.","copyLabel":"Copy prompt"},{"id":"claude-code","label":"Claude Code","title":"Claude Code skill prompt","kind":"agent-prompt","value":"Add \"cosmos-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cosmos-vulnerability-scanner\",\"task\":\"Install cosmos-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this prompt to ask Claude Code to add the skill and explain the local activation steps.","copyLabel":"Copy prompt"},{"id":"cursor","label":"Cursor","title":"Cursor rule prompt","kind":"agent-prompt","value":"Turn \"cosmos-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-cosmos-vulnerability-scanner\",\"task\":\"Install cosmos-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this when installing as Cursor project rules or reusable agent instructions.","copyLabel":"Copy prompt"}],"repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner","github_repo":"trailofbits/skills","version":"1.0.0","license":"CC-BY-SA-4.0","updated_at":"2026-09-01T11:59:28.941454+00:00","canonical_key":"trailofbits/skills#plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner","recommendation_reasons":["Matches task terms: vulnerability","Useful GitHub adoption: 6,823 stars","Install handoff is available","Repository freshness signal is available","Registry match score 32"],"urls":{"web":"https://www.openagentskill.com/skills/trailofbits-cosmos-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-cosmos-vulnerability-scanner","install_api":"https://www.openagentskill.com/api/skills/trailofbits-cosmos-vulnerability-scanner/install","audit":"https://www.openagentskill.com/skills/trailofbits-cosmos-vulnerability-scanner/audit","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/cosmos-vulnerability-scanner"}},{"rank":10,"match_type":"related","match_score":32,"raw_match_score":400.7,"semantic_relevance":52,"ranking_signals":{"retrieval":369,"semantic":52,"quality":12.5,"projectPopularity":19.2,"verifiedOutcomes":0,"verifiedSource":0},"slug":"trailofbits-substrate-vulnerability-scanner","name":"substrate-vulnerability-scanner","description":"Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.","tagline":"Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.","category":"security","tags":["agent-skill"],"author":{"name":"trailofbits","verified":false,"url":"https://github.com/trailofbits"},"attribution":{"status":"registry_indexed","statusLabel":"Registry indexed","shortLabel":"REGISTRY INDEXED","sourceLabel":"recursive skill source sync","sourceDetail":"trailofbits/skills","creatorName":"trailofbits","creatorUrl":"https://github.com/trailofbits","sourceUrl":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner","indexedBy":"OpenAgentSkill community index","claimUrl":"https://www.openagentskill.com/skills/trailofbits-substrate-vulnerability-scanner#claim-this-skill","claimCta":"Claim this skill","trustNote":"This listing was indexed from public sources and is not marked official until a maintainer claim is approved.","publicNote":"Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals."},"stats":{"stars":6844,"forks":586,"verified_installs":0,"install_attempts":0,"successful_runs":0,"total_outcomes":0,"downloads":0,"rating":0,"review_count":0,"quality_score":49.95},"quality":{"score":79,"tier":"strong","label":"Strong","summary":"Solid option that is likely worth shortlisting for production workflows.","signals":[{"label":"GitHub stars","value":"6.8K","tone":"positive"},{"label":"Freshness","value":"11d ago","tone":"positive"},{"label":"Install ready","value":"Yes","tone":"positive"},{"label":"License","value":"CC-BY-SA-4.0","tone":"neutral"}],"warnings":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review)."]},"trust":{"version":"trust-score-v4","score":75,"tier":"strong","label":"Strong shortlist","summary":"Good trust signals with a few areas worth checking before rollout.","recommendedAction":"Test in a sandbox workflow and compare its install path with close alternatives.","dimensions":[{"id":"github_adoption","label":"GitHub adoption","score":94,"weight":0.13,"status":"pass","detail":"6.8K GitHub stars"},{"id":"repo_activity","label":"Stars/forks activity","score":88,"weight":0.08,"status":"pass","detail":"6.8K stars, 586 forks; issue activity unavailable in current metadata"},{"id":"maintenance","label":"Recent maintenance","score":100,"weight":0.14,"status":"pass","detail":"11d since push"},{"id":"license","label":"License clarity","score":86,"weight":0.09,"status":"pass","detail":"CC-BY-SA-4.0"},{"id":"documentation","label":"README/SKILL.md completeness","score":52,"weight":0.14,"status":"warn","detail":"Public metadata needs stronger README/SKILL.md context"},{"id":"dependency_risk","label":"Dependency/runtime risk","score":90,"weight":0.12,"status":"pass","detail":"no major dependency risk hints in public metadata"},{"id":"installability","label":"Install availability","score":92,"weight":0.1,"status":"pass","detail":"npx skills add trailofbits/skills --skill substrate-vulnerability-scanner"},{"id":"install_safety","label":"Install command safety","score":92,"weight":0.1,"status":"pass","detail":"standard package or runtime install path"},{"id":"permission_surface","label":"Permission surface","score":100,"weight":0.07,"status":"pass","detail":"no high-risk permission surface in public metadata"},{"id":"repository","label":"Repository evidence","score":86,"weight":0.04,"status":"pass","detail":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner"},{"id":"review_status","label":"Review status","score":66,"weight":0.05,"status":"info","detail":"AI review data available"},{"id":"agent_outcomes","label":"Agent Proven outcomes","score":54,"weight":0.13,"status":"info","detail":"No agent outcome data yet"}],"checks":[{"status":"pass","label":"GitHub adoption","detail":"6.8K GitHub stars"},{"status":"pass","label":"Stars/forks activity","detail":"6.8K stars, 586 forks; issue activity unavailable in current metadata"},{"status":"pass","label":"Recent maintenance","detail":"11d since push"},{"status":"pass","label":"License clarity","detail":"CC-BY-SA-4.0"},{"status":"warn","label":"README/SKILL.md completeness","detail":"Public metadata needs stronger README/SKILL.md context"},{"status":"pass","label":"Dependency/runtime risk","detail":"no major dependency risk hints in public metadata"},{"status":"pass","label":"Install availability","detail":"npx skills add trailofbits/skills --skill substrate-vulnerability-scanner"},{"status":"pass","label":"Install command safety","detail":"standard package or runtime install path"},{"status":"pass","label":"Permission surface","detail":"no high-risk permission surface in public metadata"},{"status":"pass","label":"Repository evidence","detail":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner"},{"status":"info","label":"Review status","detail":"AI review data available"},{"status":"info","label":"Agent Proven outcomes","detail":"No agent outcome data yet"},{"status":"warn","label":"Ownership","detail":"No approved owner claim yet"},{"status":"info","label":"OpenAgentSkill usage","detail":"No local usage activity yet"},{"status":"info","label":"Agent outcomes","detail":"No agent outcome data yet"}],"strengths":["AI review approved","Install path is available","Repository evidence is available","Recently maintained repository","Large GitHub adoption signal","Install command has no obvious high-risk pattern"],"warnings":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"],"evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 586 forks","lastPushed":"11d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill substrate-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"installReadiness":{"ready":true,"command":"npx skills add trailofbits/skills --skill substrate-vulnerability-scanner","policy":"human_review_before_install","label":"Human review before install","notes":["Install path is available","Repository evidence is available","License is declared","No Agent Proven outcome evidence yet","11d since push"]},"agentCompatibility":["Codex","Claude Code","Cursor","OpenAgentSkill CLI"],"riskSummary":{"level":"medium","label":"Review before production","notes":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"outcomeEvidence":{"total":0,"successes":0,"failures":0,"notRelevant":0,"successRate":null,"installAttempts":0,"riskBlocked":0,"setupRequired":0,"installSuccessRate":null,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"recentSuccessRate":null,"recentFailureRate":null,"uniqueAgents":0,"agentProvenScore":0,"agentProvenLabel":"Needs first agent run","lastOutcomeAt":null,"label":"No agent outcome data yet"},"autoInstall":{"allowed":false,"sandboxRequired":true,"policy":"human_review_before_install","reason":"Human review or sandbox validation is required before automatic installation."},"bestFor":["security","agent-skill"],"doNotUseFor":["Production credentials, payments, or irreversible account changes without explicit human review","Sensitive private data before reviewing repository code, license, and permission surface","Automatic installation in a production workspace"],"knownRisks":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety":{"score":71,"level":"review_before_install","label":"Review before install","safety_tier":{"tier":"reviewed","label":"Reviewed with permission notes","badge":"REVIEWED","summary":"Usable candidate, but the agent should surface permission and audit notes before installation.","recommended_action":"Require human approval before installing into a real workspace.","auto_install_policy":"review","reasons":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","71/100 agent safety score"]},"auto_install_allowed":false,"human_review_required":true,"blocked":false,"audit_risk":"needs_review","permission_hints":[{"id":"network","label":"Network access","reason":"Skill likely fetches remote pages, APIs, repositories, or external services.","severity":"medium"}],"policy_warnings":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review)."],"constraints_applied":{"max_risk":"medium","needs_install_command":true,"min_stars":0}},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","badge":"REVIEWED","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace.","reasons":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","71/100 agent safety score"]},"supply_profile":{"track":{"slug":"research","label":"Research and knowledge work","shortLabel":"Research","description":"Deep research, source comparison, literature review, RAG, knowledge search, and reports."},"scenario":{"label":"RAG and knowledge","description":"I need my agent to build a RAG workflow over documents and retrieve reliable context.","useCases":[{"slug":"security-compliance","title":"Security and compliance"},{"slug":"web-scraping","title":"Web scraping"},{"slug":"coding-agents","title":"Coding agents"}]},"applicableAgents":["Claude Code","CLI","Codex","Cursor"],"install":{"ready":true,"command":"npx skills add trailofbits/skills --skill substrate-vulnerability-scanner","primaryTarget":"CLI","targetCount":4},"githubQuality":{"stars":6844,"starsLabel":"6.8K","forks":586,"license":"CC-BY-SA-4.0","qualityScore":79,"trustScore":75,"auditScore":83},"maintenance":{"status":"fresh","label":"11d since push","daysSincePush":11,"lastPushedAt":"2026-08-25T13:19:32+00:00"},"risk":{"level":"needs_review","label":"Needs review","requiresReview":true,"notes":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","No clear output format specification for findings (e.g., JSON, markdown report).","The skill assumes the agent can search the codebase but does not specify how to handle large codebases or performance constraints.","Quality score needs review","Documentation summary is thin"]},"coverageTags":["Research","RAG and knowledge","security","agent-skill"]},"audit":{"audit_score":83,"risk_level":"needs_review","risk_label":"Needs review","warnings":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","No clear output format specification for findings (e.g., JSON, markdown report).","The skill assumes the agent can search the codebase but does not specify how to handle large codebases or performance constraints.","Quality score needs review","Documentation summary is thin"]},"decision":{"readiness_score":90,"readiness_label":"Production-ready","headline":"Primary pick for Security and compliance","role":"Primary pick","primary_fit":"Security and compliance","best_for":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals"],"risks":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","No OpenAgentSkill engagement data yet"],"next_steps":["Install it in a sandbox agent and run one Security and compliance task end to end.","Compare output quality, latency, and failure behavior against at least one alternative.","Promote it into production only after reviewing repository permissions, license, and maintenance signals."]},"agent_readable_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-substrate-vulnerability-scanner","name":"substrate-vulnerability-scanner","description":"Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-substrate-vulnerability-scanner","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner","github_repo":"trailofbits/skills"},"suited_tasks":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Crawl target URLs","Extract tables and metadata"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill substrate-vulnerability-scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-substrate-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"substrate-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-substrate-vulnerability-scanner\",\"task\":\"Install substrate-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"substrate-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-substrate-vulnerability-scanner\",\"task\":\"Install substrate-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"substrate-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-substrate-vulnerability-scanner\",\"task\":\"Install substrate-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-substrate-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-substrate-vulnerability-scanner"},"trust":{"score":75,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 586 forks","lastPushed":"11d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill substrate-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","agent-skill"],"known_risks":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":83,"risk_level":"needs_review","risk_label":"Needs review","warnings":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","No clear output format specification for findings (e.g., JSON, markdown report).","The skill assumes the agent can search the codebase but does not specify how to handle large codebases or performance constraints.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace."},"quality":{"score":79,"label":"Strong"},"supply":{"track":"Research and knowledge work","scenario":"RAG and knowledge","maintenance":"11d since push","risk":"Needs review"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","production agents without a repository review","SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","No OpenAgentSkill engagement data yet","No clear output format specification for findings (e.g., JSON, markdown report).","The skill assumes the agent can search the codebase but does not specify how to handle large codebases or performance constraints.","Quality score needs review","Documentation summary is thin"],"agent_contract":{"task_input":"Use substrate-vulnerability-scanner in an agent workflow","recommended_action":"Require human approval before installing into a real workspace.","install_policy":"review","minimum_review_before_use":["Trust: 75/100 Strong shortlist","Audit: 83/100 Needs review","Safety: 71/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-substrate-vulnerability-scanner (substrate-vulnerability-scanner)","install_command":"npx skills add trailofbits/skills --skill substrate-vulnerability-scanner","risk_summary":"Needs review; Reviewed with permission notes; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-substrate-vulnerability-scanner","task":"Use substrate-vulnerability-scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-substrate-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-substrate-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/trailofbits-substrate-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-substrate-vulnerability-scanner&task=Use%20substrate-vulnerability-scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20substrate-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20substrate-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-substrate-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-substrate-vulnerability-scanner"}},"machine_metadata":{"version":"openagentskill-agent-metadata-v2","skill":{"slug":"trailofbits-substrate-vulnerability-scanner","name":"substrate-vulnerability-scanner","description":"Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.","category":"security","url":"https://www.openagentskill.com/skills/trailofbits-substrate-vulnerability-scanner","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner","github_repo":"trailofbits/skills"},"suited_tasks":["Security and compliance workflows","Claude Code teams","teams that value GitHub adoption signals","Inspect risky files","Prioritize findings","Explain remediation steps","Crawl target URLs","Extract tables and metadata"],"suited_agents":["Codex","Claude Code","Cursor","OpenAgentSkill CLI","CLI"],"install":{"command":"npx skills add trailofbits/skills --skill substrate-vulnerability-scanner","ready":true,"targets":[{"id":"openagentskill-cli","label":"CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-substrate-vulnerability-scanner"},{"id":"codex","label":"Codex","kind":"agent-prompt","value":"Install the \"substrate-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-substrate-vulnerability-scanner\",\"task\":\"Install substrate-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"claude-code","label":"Claude Code","kind":"agent-prompt","value":"Add \"substrate-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-substrate-vulnerability-scanner\",\"task\":\"Install substrate-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."},{"id":"cursor","label":"Cursor","kind":"agent-prompt","value":"Turn \"substrate-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-substrate-vulnerability-scanner\",\"task\":\"Install substrate-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes."}],"handoff_url":"https://www.openagentskill.com/api/skills/trailofbits-substrate-vulnerability-scanner/install","manifest_url":"https://www.openagentskill.com/api/registry/manifest/trailofbits-substrate-vulnerability-scanner"},"trust":{"score":75,"label":"Strong shortlist","version":"trust-score-v4","install_policy":"human_review_before_install","evidence":{"stars":"6.8K GitHub stars","repoActivity":"6.8K stars, 586 forks","lastPushed":"11d since push","license":"CC-BY-SA-4.0","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner","install":"npx skills add trailofbits/skills --skill substrate-vulnerability-scanner","installSafety":"standard package or runtime install path","permissionSurface":"no high-risk permission surface in public metadata","documentation":"Thin public metadata","agentOutcomes":"No agent outcome data yet"},"outcome_evidence":{"total":0,"successes":0,"failures":0,"not_relevant":0,"success_rate":null,"recent_success_rate":null,"recent_failure_rate":null,"install_attempts":0,"install_success_rate":null,"risk_blocked":0,"setup_required":0,"avg_output_quality":null,"production_outcomes":0,"last_outcome_at":null,"label":"No agent outcome data yet"},"auto_install":{"allowed":false,"sandbox_required":true,"reason":"Human review or sandbox validation is required before automatic installation."},"best_for":["security","agent-skill"],"known_risks":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"agent_proven":{"version":"agent-proven-v1","score":0,"tier":"unproven","label":"Needs first agent run","summary":"No agent outcome reports yet. Use Resolve, run one narrow sandbox task, then report the result.","metrics":{"totalOutcomes":0,"successfulOutcomes":0,"failedOutcomes":0,"installAttempts":0,"installSuccessRate":null,"successRate":null,"recentSuccessRate":null,"recentFailureRate":null,"riskBlocked":0,"setupRequired":0,"notRelevant":0,"avgOutputQuality":null,"avgTimeToUsefulMs":null,"productionOutcomes":0,"humanReviewRequired":0,"uniqueAgents":0,"lastOutcomeAt":null},"signals":[],"penalties":["No real agent outcome evidence yet"]},"audit":{"score":83,"risk_level":"needs_review","risk_label":"Needs review","warnings":["SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","No clear output format specification for findings (e.g., JSON, markdown report).","The skill assumes the agent can search the codebase but does not specify how to handle large codebases or performance constraints.","Quality score needs review","Documentation summary is thin","README/SKILL.md completeness: Public metadata needs stronger README/SKILL.md context"]},"safety_gate":{"tier":"reviewed","label":"Reviewed with permission notes","auto_install_policy":"review","auto_install_allowed":false,"human_review_required":true,"blocked":false,"recommended_action":"Require human approval before installing into a real workspace."},"quality":{"score":79,"label":"Strong"},"supply":{"track":"Research and knowledge work","scenario":"RAG and knowledge","maintenance":"11d since push","risk":"Needs review"},"alternative_skills":[],"do_not_use_when":["teams that need a vendor-supported SLA","production agents without a repository review","SKILL.md does not explicitly state limitations (e.g., static analysis only, potential false positives, need for manual review).","No OpenAgentSkill engagement data yet","No clear output format specification for findings (e.g., JSON, markdown report).","The skill assumes the agent can search the codebase but does not specify how to handle large codebases or performance constraints.","Quality score needs review","Documentation summary is thin"],"agent_contract":{"task_input":"Use substrate-vulnerability-scanner in an agent workflow","recommended_action":"Require human approval before installing into a real workspace.","install_policy":"review","minimum_review_before_use":["Trust: 75/100 Strong shortlist","Audit: 83/100 Needs review","Safety: 71/100 Review before install","Review repository, license, install command, and permission surface before production use."],"expected_agent_output":{"selected_skill":"trailofbits-substrate-vulnerability-scanner (substrate-vulnerability-scanner)","install_command":"npx skills add trailofbits/skills --skill substrate-vulnerability-scanner","risk_summary":"Needs review; Reviewed with permission notes; Review before production","verification_result":"Report the smallest successful task, files touched, warnings, and any missing setup."}},"outcome_feedback":{"endpoint":"https://www.openagentskill.com/api/agent/outcome","method":"POST","requires_resolve_event_id":true,"event_id_source":"Use install_receipt.outcome_feedback.event_id or feedback.event_id returned by /api/agent/resolve for the current task.","expected_outcomes":["success","failed","not_relevant","blocked_by_risk","setup_required"],"payload_template":{"event_id":"<install_receipt.outcome_feedback.event_id or feedback.event_id from /api/agent/resolve>","skill_slug":"trailofbits-substrate-vulnerability-scanner","task":"Use substrate-vulnerability-scanner in an agent workflow","agent":"codex","outcome":"success","install_used":true,"risk_blocked":false,"setup_required":false,"task_success":true,"output_quality":4,"error_type":null,"human_review_required":false,"workspace":"sandbox","time_to_useful_ms":120000,"notes":"Report the smallest successful task, setup friction, files touched, and risk notes."}},"endpoints":{"web":"https://www.openagentskill.com/skills/trailofbits-substrate-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-substrate-vulnerability-scanner","audit":"https://www.openagentskill.com/skills/trailofbits-substrate-vulnerability-scanner/audit","eval":"https://www.openagentskill.com/api/agent/evals?slug=trailofbits-substrate-vulnerability-scanner&task=Use%20substrate-vulnerability-scanner%20in%20an%20agent%20workflow&max_risk=medium","resolve":"https://www.openagentskill.com/api/agent/resolve?task=Use%20substrate-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium","receipt":"https://www.openagentskill.com/api/agent/receipt?task=Use%20substrate-vulnerability-scanner%20in%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text","install":"https://www.openagentskill.com/api/skills/trailofbits-substrate-vulnerability-scanner/install","manifest":"https://www.openagentskill.com/api/registry/manifest/trailofbits-substrate-vulnerability-scanner"}},"platforms":["Claude Code"],"use_cases":[{"slug":"security-compliance","title":"Security and compliance","url":"https://www.openagentskill.com/use-cases/security-compliance"},{"slug":"web-scraping","title":"Web scraping","url":"https://www.openagentskill.com/use-cases/web-scraping"},{"slug":"coding-agents","title":"Coding agents","url":"https://www.openagentskill.com/use-cases/coding-agents"},{"slug":"rag-knowledge","title":"RAG and knowledge","url":"https://www.openagentskill.com/use-cases/rag-knowledge"}],"install":"npx skills add trailofbits/skills --skill substrate-vulnerability-scanner","install_targets":[{"id":"openagentskill-cli","label":"CLI","title":"OpenAgentSkill CLI","kind":"command","value":"npx --yes https://github.com/Leon-Drq/openagentskill/releases/download/cli-v0.3.0/openagentskill-0.3.0.tgz add trailofbits-substrate-vulnerability-scanner","description":"Resolve policy, run the source installer safely, and report a verified install receipt.","copyLabel":"Copy command"},{"id":"codex","label":"Codex","title":"Codex install prompt","kind":"agent-prompt","value":"Install the \"substrate-vulnerability-scanner\" agent skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-substrate-vulnerability-scanner\",\"task\":\"Install substrate-vulnerability-scanner\",\"agent\":\"codex\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Give Codex a repo-aware install prompt when the skill is not available through a local CLI.","copyLabel":"Copy prompt"},{"id":"claude-code","label":"Claude Code","title":"Claude Code skill prompt","kind":"agent-prompt","value":"Add \"substrate-vulnerability-scanner\" as a Claude Code skill from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner. Inspect the skill instructions, place the reusable skill files in the appropriate local skills location for this project, and report the activation steps. Skill purpose: Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-substrate-vulnerability-scanner\",\"task\":\"Install substrate-vulnerability-scanner\",\"agent\":\"claude-code\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this prompt to ask Claude Code to add the skill and explain the local activation steps.","copyLabel":"Copy prompt"},{"id":"cursor","label":"Cursor","title":"Cursor rule prompt","kind":"agent-prompt","value":"Turn \"substrate-vulnerability-scanner\" from https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner into a reusable Cursor project rule or agent instruction. Preserve the core workflow, adapt paths to this repo, and keep the rule scoped to tasks where it is relevant. Skill purpose: Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {\"event_id\":\"install_<unique-id>\",\"skill_slug\":\"trailofbits-substrate-vulnerability-scanner\",\"task\":\"Install substrate-vulnerability-scanner\",\"agent\":\"cursor\",\"outcome\":\"success\",\"install_used\":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.","description":"Use this when installing as Cursor project rules or reusable agent instructions.","copyLabel":"Copy prompt"}],"repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner","github_repo":"trailofbits/skills","version":"1.0.0","license":"CC-BY-SA-4.0","updated_at":"2026-09-01T11:59:28.941454+00:00","canonical_key":"trailofbits/skills#plugins/building-secure-contracts/skills/substrate-vulnerability-scanner","recommendation_reasons":["Matches task terms: vulnerability","Useful GitHub adoption: 6,844 stars","Install handoff is available","Repository freshness signal is available","Registry match score 32"],"urls":{"web":"https://www.openagentskill.com/skills/trailofbits-substrate-vulnerability-scanner","api":"https://www.openagentskill.com/api/agent/skills/trailofbits-substrate-vulnerability-scanner","install_api":"https://www.openagentskill.com/api/skills/trailofbits-substrate-vulnerability-scanner/install","audit":"https://www.openagentskill.com/skills/trailofbits-substrate-vulnerability-scanner/audit","repository":"https://github.com/trailofbits/skills/tree/main/plugins/building-secure-contracts/skills/substrate-vulnerability-scanner"}}],"meta":{"endpoint":"/api/skills/search","canonical_agent_endpoint":"/api/agent/resolve","ranking_model":"hybrid-v2-task-fit-quality-outcomes","shortlist_policy":"Return one best match plus up to four distinct alternatives; suppress unrelated direct-name matches.","lookup_intent":false,"exact_match_found":true,"match_counts":{"exact":1,"near":0,"related":9},"no_match_message":null,"safety_policy":"Blocked candidates are excluded by default. Pass include_blocked=true only for manual audit workflows.","agent_friendly":true,"api_version":"1.0","generated_at":"2026-09-06T03:01:58.173Z"}}