diff --git a/auditor/audits/microsoft-skills.findings.jsonl b/auditor/audits/microsoft-skills.findings.jsonl new file mode 100644 index 000000000..cb284cd36 --- /dev/null +++ b/auditor/audits/microsoft-skills.findings.jsonl @@ -0,0 +1,111 @@ +{"category":"bug","rule_id":"BUG-broken-reference","file":".github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md","line":null,"severity":"high","confidence":"high","evidence":"ls on azure-cosmos-py/ shows only SKILL.md and references/; no scripts/ dir exists, yet the Reference Files table links to scripts/setup_cosmos_container.py","penalty":null,"pattern":"","description":"SKILL.md's Reference Files table links to scripts/setup_cosmos_container.py, but no scripts/ directory exists in this skill folder.","false_positive":false,"suggested_fix":"Add the missing scripts/setup_cosmos_container.py file, or remove that row from the Reference Files table."} +{"category":"bug","rule_id":"BUG-broken-reference","file":".github/plugins/azure-sdk-python/skills/azure-ai-projects-py/SKILL.md","line":null,"severity":"high","confidence":"high","evidence":"frontmatter description references an 'azure-ai-agents-python' skill; find/grep across target-repo shows no such directory anywhere","penalty":null,"pattern":"","description":"The description directs readers to a sibling skill 'azure-ai-agents-python' that does not exist in the repo.","false_positive":false,"suggested_fix":"Create the referenced skill, correct the name to an actually-existing skill/package, or remove the sentence."} +{"category":"bug","rule_id":"BUG-broken-reference","file":".github/plugins/azure-sdk-java/skills/azure-monitor-ingestion-java/SKILL.md","line":227,"severity":"medium","confidence":"high","evidence":"Line 227 links to '../query/SKILL.md' which resolves to skills/query/SKILL.md; the actual directory is skills/azure-monitor-query-java/","penalty":null,"pattern":"","description":"The 'Querying Uploaded Logs' section links to a sibling skill using a relative path that does not match any real directory.","false_positive":false,"suggested_fix":"Change '../query/SKILL.md' to '../azure-monitor-query-java/SKILL.md'."} +{"category":"security","rule_id":"SEC-eval-interpolated-vars","file":".github/plugins/azure-skills/skills/python-appservice-deploy/scripts/retry-az-create.sh","line":36,"severity":"critical","confidence":"medium","evidence":"","penalty":null,"pattern":"eval \"$VAR ...\"","description":"eval executes caller-supplied $SHOW_CMD/$CREATE_CMD strings passed as $1/$2; any unsanitized data reaching these args gets full shell execution.","false_positive":false,"suggested_fix":"Require callers to pass argv arrays instead of shell-quoted strings; replace eval with direct execution of a constructed argv array."} +{"category":"security","rule_id":"SEC-shell-to-python-injection","file":".github/plugins/azure-skills/skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh","line":104,"severity":"medium","confidence":"medium","evidence":"","penalty":null,"pattern":"python3 -c \"...${VAR}...\" unescaped interpolation","description":"MODEL_NAME/MODEL_VERSION and API JSON responses are interpolated directly into an embedded Python source string executed via python3 -c without escaping.","false_positive":false,"suggested_fix":"Pass values via environment variables or stdin instead of string-interpolating into the -c source."} +{"category":"security","rule_id":"SEC-shell-to-python-injection","file":".github/plugins/azure-skills/skills/azure-quotas/scripts/check-quota.sh","line":71,"severity":"medium","confidence":"medium","evidence":"","penalty":null,"pattern":"python3 -c \"...${VAR}...\" unescaped interpolation","description":"$USAGES_JSON (az CLI output) is interpolated directly into json.loads('''$USAGES_JSON''') without escaping.","false_positive":false,"suggested_fix":"Pipe $USAGES_JSON to the Python process via stdin (json.load(sys.stdin)) instead of interpolating it into the source string."} +{"category":"security","rule_id":"SEC-telemetry-network-call","file":".github/plugins/azure-skills/hooks/scripts/track-telemetry.sh","line":360,"severity":"low","confidence":"medium","evidence":"","penalty":null,"pattern":"npx -y @azure/mcp@latest ... publish telemetry","description":"Every tracked tool/skill invocation shells out via npx to an unpinned MCP package and publishes client/session/skill/tool metadata to a remote endpoint; opt-out via AZURE_MCP_COLLECT_TELEMETRY=false but undocumented elsewhere.","false_positive":false,"suggested_fix":"Document the telemetry call, what it sends, and the opt-out flag prominently in the plugin's user-facing README."} +{"category":"security","rule_id":"SEC-unpinned-mcp-server","file":".vscode/mcp.json","line":13,"severity":"low","confidence":"medium","evidence":"","penalty":null,"pattern":"npx @latest","description":"Multiple MCP servers (chrome-devtools-mcp@latest, @upstash/context7-mcp@latest, @playwright/mcp@latest) are launched unpinned via npx.","false_positive":false,"suggested_fix":"Pin MCP server packages to exact versions instead of @latest to avoid unreviewed supply-chain changes landing silently."} +{"category":"nl_quality","rule_id":"R09","file":".github/plugins/deep-wiki/agents/wiki-researcher.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"Description has zero blocks.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R11","file":".github/plugins/deep-wiki/agents/wiki-researcher.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"No tools/allowed-tools field in frontmatter (only name/description/model present).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/deep-wiki/agents/wiki-researcher.md","line":38,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"1 vague quantifier hit: 'relevant files' (line 38).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R09","file":".github/plugins/deep-wiki/agents/wiki-architect.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"Description has zero blocks.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R11","file":".github/plugins/deep-wiki/agents/wiki-architect.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"No tools/allowed-tools field in frontmatter (only name/description/model present).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R09","file":".github/plugins/deep-wiki/agents/wiki-writer.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"Description has zero blocks.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R11","file":".github/plugins/deep-wiki/agents/wiki-writer.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"No tools/allowed-tools field in frontmatter (only name/description/model present).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/deep-wiki/agents/wiki-writer.md","line":38,"severity":"low","confidence":"high","evidence":"","penalty":-6,"pattern":"","description":"3 vague quantifier hits: 'relevant file' (line38), 'relevant files' (line47), 'as appropriate' (line54).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R09","file":".github/agents/frontend.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"No blocks anywhere in the file.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R10","file":".github/agents/frontend.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter has name/description/tools only; no model field.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R11","file":".github/agents/frontend.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Declared 'search' tool has no corresponding search-related instruction anywhere in the body.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R12","file":".github/agents/frontend.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"No section defines the format of the agent's own output/response; body is patterns/rules/file-location tables only.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R09","file":".github/agents/planner.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"No blocks anywhere in the file.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R10","file":".github/agents/planner.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter has name/description/tools/handoffs only; no model field.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R11","file":".github/agents/planner.agent.md","line":null,"severity":"low","confidence":"high","evidence":"tools: [\"read\",\"search\",\"web\"] in frontmatter; body's 'Explore the Codebase' section only mentions searching/reading local files, no web usage anywhere.","penalty":-3,"pattern":"","description":"Declared 'web' tool but body never references external web content, URLs, or internet search — all references are to local files.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/agents/planner.agent.md","line":30,"severity":"low","confidence":"high","evidence":"","penalty":-4,"pattern":"","description":"2 vague quantifier hits: 'relevant files' (line30), 'appropriate specialist agent' (line89).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R09","file":".github/agents/presenter.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"No blocks anywhere in the file.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R10","file":".github/agents/presenter.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter has name/description/tools only; no model field.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R11","file":".github/agents/presenter.agent.md","line":null,"severity":"low","confidence":"high","evidence":"tools: [\"read\",\"edit\",\"search\",\"execute\"] in frontmatter; full-file read shows no bash code fence or 'Commands' heading anywhere.","penalty":-3,"pattern":"","description":"Declared 'execute' tool but file contains no Commands/bash section at all, unlike sibling agents.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R11","file":".github/agents/presenter.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Declared 'search' tool has no corresponding search-related instruction in the body.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R12","file":".github/agents/presenter.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"No section defines the format of the agent's own output/response.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R09","file":".github/agents/backend.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"No blocks anywhere in the file.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R10","file":".github/agents/backend.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter has name/description/tools only; no model field.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R11","file":".github/agents/backend.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Declared 'search' tool has no corresponding search-related instruction anywhere in the body.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R12","file":".github/agents/backend.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"No section defines the format of the agent's own output/response; body is patterns/router examples/file tables only.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R09","file":".github/agents/scaffolder.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"No blocks anywhere in the file.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R10","file":".github/agents/scaffolder.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter has name/description/tools only; no model field.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R11","file":".github/agents/scaffolder.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Declared 'search' tool has no corresponding search-related instruction anywhere in the body.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R09","file":".github/agents/infrastructure.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"No blocks anywhere in the file.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R10","file":".github/agents/infrastructure.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter has name/description/tools only; no model field.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R11","file":".github/agents/infrastructure.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Declared 'search' tool has no corresponding search-related instruction anywhere in the body.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R12","file":".github/agents/infrastructure.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"No section defines the format of the agent's own output/response; body is deployment workflows/tables only.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R18","file":".github/plugins/deep-wiki/commands/generate.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token.","penalty":-5,"pattern":"","description":"Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R18","file":".github/plugins/deep-wiki/commands/agents.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token.","penalty":-5,"pattern":"","description":"Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R18","file":".github/plugins/deep-wiki/commands/changelog.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token.","penalty":-5,"pattern":"","description":"Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R17","file":".github/plugins/deep-wiki/commands/changelog.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"No instruction for the edge case of an empty/shallow git history — process assumes commits exist.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R18","file":".github/plugins/deep-wiki/commands/deploy.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token.","penalty":-5,"pattern":"","description":"Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R18","file":".github/plugins/deep-wiki/commands/build.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token.","penalty":-5,"pattern":"","description":"Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R17","file":".github/plugins/deep-wiki/commands/build.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Prerequisites section only states wiki markdown 'should already exist' with no actual check-and-respond instruction, unlike sibling deploy.md.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R15","file":".github/plugins/deep-wiki/commands/ask.md","line":null,"severity":"low","confidence":"high","evidence":"body's '## Question' section is literally the bare '$ARGUMENTS' token with no empty-check or fallback prompt anywhere in the file.","penalty":-10,"pattern":"","description":"Command's entire purpose is answering '$ARGUMENTS' as a question, but there is no instruction for what to do if no question is supplied.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R18","file":".github/plugins/deep-wiki/commands/ask.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter block contains only 'description:'.","penalty":-5,"pattern":"","description":"Frontmatter has only a description field; no argument-hint despite the command being fully argument-driven.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/deep-wiki/commands/ask.md","line":27,"severity":"low","confidence":"high","evidence":"","penalty":-4,"pattern":"","description":"2 vague quantifier hits: 'relevant to the question' (line27), '[Relevant snippet...]' (line48).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-dotnet/skills/azure-mgmt-arizeaiobservabilityeval-dotnet/SKILL.md","line":201,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 201: 'Close clients properly' uses vague quantifier 'properly' instead of a concrete instruction.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R05","file":".github/plugins/azure-sdk-python/skills/azure-identity-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"File is 544 total lines; frontmatter closes at line 11, leaving 533 lines of body content.","penalty":-10,"pattern":"","description":"Body exceeds 500 lines (533 lines of content).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-storage-blob-py/SKILL.md","line":257,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 257: 'Set appropriate content types for web-served blobs' uses vague quantifier 'appropriate'.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-monitor-opentelemetry-exporter-py/SKILL.md","line":238,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 238: 'Set export intervals appropriate for your workload' uses vague quantifier 'appropriate'.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-eventgrid-py/SKILL.md","line":195,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 195: 'Set appropriate event types for routing and filtering' uses vague quantifier 'appropriate'.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-storage-queue-py/SKILL.md","line":234,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 234: 'Set appropriate visibility timeout based on processing time' uses vague quantifier 'appropriate'.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R04","file":".github/plugins/azure-sdk-python/skills/azure-ai-voicelive-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"Description field measured at 517 characters, falling in the 500-800 char band.","penalty":-5,"pattern":"","description":"Description is 517 characters, in the 500-800 char penalty band.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-monitor-ingestion-py/SKILL.md","line":229,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 229: 'SDK handles batching, but send reasonable chunks' uses vague quantifier 'reasonable'.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-eventhub-py/SKILL.md","line":252,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 252: 'Set appropriate consumer groups for different applications' uses vague quantifier 'appropriate'.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R05","file":".github/plugins/azure-sdk-python/skills/azure-search-documents-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"File is 554 total lines; body ~543 lines, overage largely caused by a duplicated 'Additional Azure AI Search Patterns' section repeating earlier content near-verbatim.","penalty":-10,"pattern":"","description":"Body exceeds 500 lines (543 lines), driven by a duplicated second section repeating earlier content.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R07","file":".github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"No scope note distinguishing this skill from sibling azure-cosmos-db-py, which covers the same azure-cosmos package with overlapping trigger phrases.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #4 says 'appropriate scopes' without specifying which scopes for which scenario.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-keyvault-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #9 says 'Cache secrets appropriately' without concrete guidance on TTL or strategy.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-ai-contentsafety-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #4 says 'severity thresholds appropriate for your use case' without concrete guidance.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-mgmt-botservice-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #9 says 'Configure proper CORS' without specifying the actual policy.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-speech-to-text-rest-py/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-2,"pattern":"","description":"Error-handling example's docstring says 'Transcribe with proper error handling' — an unspecific qualifier inside a code comment.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Storage Requirements says 'SAS tokens with appropriate permissions' without full specification.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-monitor-query-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #6 says 'appropriate granularity' without concrete guidance.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-ai-language-conversations-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"System Prompt section says 'Handle exceptions properly' without specifying which exceptions or how.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-mgmt-fabric-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #5 says 'scale up as needed' without concrete triggers.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-mgmt-fabric-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #8 says 'Handle LRO properly' without specifying the actual handling steps.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-ai-projects-py/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-2,"pattern":"","description":"Code sample comment 'Add tools as needed' is an unspecific qualifier.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R07","file":".github/plugins/azure-sdk-python/skills/azure-cosmos-db-py/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"No cross-reference/scope note distinguishing this skill from sibling azure-cosmos-py, which covers the same package with overlapping trigger phrases.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-ai-voicelive-java/SKILL.md","line":221,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 221: 'Close sessions properly when conversation ends' uses vague qualifier 'properly'.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-communication-common-java/SKILL.md","line":173,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 173: '// Parse raw ID to appropriate type' is a code comment using 'appropriate' instead of naming concrete types.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R07","file":".github/plugins/azure-sdk-java/skills/azure-security-keyvault-secrets-java/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"No mention/link to sibling azure-security-keyvault-keys-java skill despite both operating on the same vault.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-ai-contentsafety-java/SKILL.md","line":287,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 287: 'Cache blocklist results where appropriate' does not specify when caching is appropriate.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R05","file":".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"Body (lines 13-434) is approximately 422 lines, within the 400-500 line penalty band.","penalty":-5,"pattern":"","description":"Body length (422 lines) in the 400-500 penalty band.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md","line":61,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 61: 'TokenCredential with appropriate permissions' does not name the required permissions.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md","line":417,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 417: 'Set appropriate timeouts' is vague about the actual timeout values.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md","line":421,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 421: 'Cache results ... cache when appropriate' does not specify caching criteria.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R04","file":".github/plugins/azure-sdk-java/skills/azure-communication-callingserver-java/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-15,"pattern":"","description":"Frontmatter description gives only one concrete trigger condition ('maintaining legacy code') rather than a list of specific invocation phrases like sibling skills use.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R07","file":".github/plugins/azure-sdk-java/skills/azure-communication-callautomation-java/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Code examples import CommunicationUserIdentifier/PhoneNumberIdentifier from com.azure.communication.common but the skill never links azure-communication-common-java.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-messaging-webpubsub-java/SKILL.md","line":306,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 306: 'Set appropriate token expiration for security' does not specify a recommended value or range.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R07","file":".github/plugins/azure-sdk-java/skills/azure-communication-chat-java/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Client Creation section uses CommunicationTokenCredential, documented in azure-communication-common-java, which is never referenced.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R05","file":".github/plugins/azure-sdk-java/skills/azure-appconfiguration-java/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"Body (lines 12-487) is approximately 476 lines, within the 400-500 line penalty band.","penalty":-5,"pattern":"","description":"Body length (476 lines) in the 400-500 penalty band.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R07","file":".github/plugins/azure-sdk-java/skills/azure-security-keyvault-keys-java/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"No mention/link to sibling azure-security-keyvault-secrets-java skill despite both operating on the same vault.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-monitor-opentelemetry-exporter-java/SKILL.md","line":273,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 273: 'Add relevant attributes — Include contextual data for debugging' does not specify which attributes are relevant.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-ai-agents-persistent-java/SKILL.md","line":130,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 130: 'Poll with appropriate delays' pairs a vague qualifier with a concrete number in the same sentence; the heading itself remains vague.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-compute-batch-java/SKILL.md","line":380,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 380: 'Handle LRO properly — Pool resize, delete operations are long-running' uses 'properly' instead of describing the expected pattern.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R04","file":".github/skills/debugview/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter description is roughly 775 characters (500-800 range).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R06","file":".github/skills/cloud-solution-architect/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Complex architectural concepts (44 patterns, WAF pillars, mission-critical design) are covered entirely with reference tables; the only code-shaped block is a generic ADR template, not an implementation example.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/skills/cloud-solution-architect/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"1 vague quantifier occurrence ('relevant').","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R05","file":".github/skills/skill-creator/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"SKILL.md body is ~1310 lines, well over the 500-line threshold.","penalty":-10,"pattern":"","description":"Body is 1310 lines — over 2.5x the skill's own mandated 500-line ceiling.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/skills/skill-creator/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"15 vague-quantifier occurrences found (appropriate x5, as needed x2, several, significantly, sufficient, typically, etc.); capped at -20.","penalty":-20,"pattern":"","description":"Heavy vague-quantifier usage, capped at -20.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R04","file":".github/skills/applicationinsights-web-ts/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter description is roughly 524 characters (500-800 range).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R05","file":".github/skills/applicationinsights-web-ts/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"SKILL.md body is 457 lines (400-500 range).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R04","file":".github/skills/kql/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter description is roughly 797 characters (500-800 range, just under the -10 threshold).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R05","file":".github/skills/kql/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"SKILL.md body is 439 lines (400-500 range).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R05","file":".github/skills/copilot-sdk/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"SKILL.md body is ~901 lines, well over the 500-line threshold.","penalty":-10,"pattern":"","description":"Body is 901 lines, far over the 500-line guidance.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/skills/copilot-sdk/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"1 vague quantifier occurrence ('effectively').","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R06","file":".github/skills/mcp-builder/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Core 'Implement Tools' section is described narratively with zero inline code snippets; every concrete example lives in a separate ./reference/*.md file.","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/skills/mcp-builder/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-10,"pattern":"","description":"5 vague-quantifier occurrences (relevant x2, as needed x2, effectively).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R04","file":".github/skills/entra-agent-id/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter description is roughly 715 characters (500-800 range).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/skills/microsoft-docs/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"1 vague quantifier occurrence ('relevant').","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R04","file":".github/skills/frontend-design-review/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter description is roughly 595 characters (500-800 range).","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/skills/frontend-design-review/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"1 vague quantifier occurrence ('context-appropriate').","false_positive":false,"suggested_fix":""} +{"category":"nl_quality","rule_id":"R01","file":".github/skills/github-issue-creator/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-4,"pattern":"","description":"2 vague quantifier occurrences ('relevant' x2).","false_positive":false,"suggested_fix":""} +{"category":"cross_component","rule_id":"CC-orphan-component","file":".github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":null,"pattern":"","description":"Overlapping coverage with sibling azure-cosmos-db-py skill for the same azure-cosmos package; no scope note disambiguates the two for routing.","false_positive":false,"suggested_fix":""} +{"category":"cross_component","rule_id":"CC-orphan-component","file":".github/plugins/azure-sdk-java/skills/azure-security-keyvault-secrets-java/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":null,"pattern":"","description":"No cross-link to sibling azure-security-keyvault-keys-java skill despite both operating on the same Key Vault resource.","false_positive":false,"suggested_fix":""} +{"category":"cross_component","rule_id":"CC-terminology-drift","file":".github/agents/frontend.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":null,"pattern":"","description":"This agent and its 5 siblings (backend/planner/presenter/scaffolder/infrastructure) plus the 3 deep-wiki agents all independently omit blocks and model declaration, indicating a shared template gap rather than isolated defects.","false_positive":false,"suggested_fix":""} diff --git a/auditor/audits/microsoft-skills.md b/auditor/audits/microsoft-skills.md new file mode 100644 index 000000000..452792034 --- /dev/null +++ b/auditor/audits/microsoft-skills.md @@ -0,0 +1,264 @@ +# NLPM Audit: microsoft/skills +**Date**: 2026-04-06 | **Artifacts**: 226 | **Strategy**: progressive +**NL Score**: 94/100 +**Security**: BLOCKED +**Bugs**: 3 | **Quality Issues**: 100 | **Security Findings**: 5 + +## NL Score Summary +| File | Type | Score | Top Issue | +|------|------|-------|-----------| +| .github/agents/presenter.agent.md | agent | 64 | Zero `` blocks; 'execute'/'search' tools unused; no output-format spec | +| .github/agents/frontend.agent.md | agent | 67 | Zero `` blocks; model tier not declared; no output-format spec | +| .github/agents/backend.agent.md | agent | 67 | Zero `` blocks; model tier not declared; no output-format spec | +| .github/agents/infrastructure.agent.md | agent | 67 | Zero `` blocks; model tier not declared; no output-format spec | +| .github/skills/skill-creator/SKILL.md | skill | 70 | Body is 1310 lines (>2.5x the skill's own 500-line rule) + heavy vague-quantifier usage | +| .github/agents/planner.agent.md | agent | 73 | Zero `` blocks; declared 'web' tool never used | +| .github/plugins/deep-wiki/agents/wiki-writer.md | agent | 74 | Zero `` blocks; heaviest vague-quantifier usage | +| .github/agents/scaffolder.agent.md | agent | 77 | Zero `` blocks; model tier not declared | +| .github/plugins/deep-wiki/agents/wiki-researcher.md | agent | 78 | Zero `` blocks; no tools declared | +| .github/plugins/deep-wiki/agents/wiki-architect.md | agent | 80 | Zero `` blocks; no tools declared | +| .github/plugins/deep-wiki/commands/ask.md | command | 81 | No empty-input handling; no argument-hint | +| .github/plugins/azure-sdk-java/skills/azure-communication-callingserver-java/SKILL.md | skill | 85 | Thin/generic frontmatter description | +| .github/skills/mcp-builder/SKILL.md | skill | 85 | No inline code examples in Implementation phase; 5 vague quantifiers | +| .github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md | skill | 87 | Broken reference: `scripts/setup_cosmos_container.py` does not exist | +| .github/plugins/azure-sdk-python/skills/azure-ai-projects-py/SKILL.md | skill | 88 | Broken cross-reference to nonexistent `azure-ai-agents-python` skill | +| .github/skills/copilot-sdk/SKILL.md | skill | 88 | Body is 901 lines, far over the 500-line guidance | +| .github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md | skill | 89 | Body 422 lines (400-500 band) + 3 vague quantifiers | +| .github/plugins/deep-wiki/commands/changelog.md | command | 90 | No argument-hint; no empty-git-history handling | +| .github/plugins/deep-wiki/commands/build.md | command | 90 | No argument-hint; missing-wiki precondition not actually checked | +| .github/plugins/azure-sdk-python/skills/azure-identity-py/SKILL.md | skill | 90 | Body exceeds 500 lines (533) | +| .github/plugins/azure-sdk-python/skills/azure-search-documents-py/SKILL.md | skill | 90 | Body exceeds 500 lines (543), duplicated section | +| .github/plugins/azure-sdk-java/skills/azure-monitor-ingestion-java/SKILL.md | skill | 90 | Broken cross-reference (wrong relative path to query skill) | +| .github/skills/applicationinsights-web-ts/SKILL.md | skill | 90 | Description + body both in penalized length bands | +| .github/skills/kql/SKILL.md | skill | 90 | Description + body both in penalized length bands | +| .github/skills/cloud-solution-architect/SKILL.md | skill | 93 | 44 design patterns/complex concepts with no code examples | +| .github/skills/frontend-design-review/SKILL.md | skill | 93 | Description 500-800 chars + vague quantifier | +| .github/plugins/deep-wiki/commands/generate.md | command | 95 | No argument-hint despite consuming $ARGUMENTS | +| .github/plugins/deep-wiki/commands/agents.md | command | 95 | No argument-hint despite consuming $ARGUMENTS | +| .github/plugins/deep-wiki/commands/deploy.md | command | 95 | No argument-hint despite consuming $ARGUMENTS | +| .github/plugins/azure-sdk-python/skills/azure-ai-voicelive-py/SKILL.md | skill | 95 | Description 500-800 chars | +| .github/plugins/azure-sdk-java/skills/azure-appconfiguration-java/SKILL.md | skill | 95 | Body 476 lines (400-500 band) | +| .github/skills/debugview/SKILL.md | skill | 95 | Description 500-800 chars | +| .github/skills/entra-agent-id/SKILL.md | skill | 95 | Description 500-800 chars | +| .github/plugins/azure-sdk-python/skills/azure-mgmt-fabric-py/SKILL.md | skill | 96 | 2 vague quantifiers | +| .github/skills/github-issue-creator/SKILL.md | skill | 96 | 2 vague quantifiers | +| .github/plugins/azure-sdk-python/skills/azure-cosmos-db-py/SKILL.md | skill | 97 | No scope note distinguishing from sibling azure-cosmos-py | +| .github/plugins/azure-sdk-java/skills/azure-security-keyvault-secrets-java/SKILL.md | skill | 97 | No cross-reference to sibling Key Vault Keys skill | +| .github/plugins/azure-sdk-java/skills/azure-communication-callautomation-java/SKILL.md | skill | 97 | No cross-reference to azure-communication-common-java | +| .github/plugins/azure-sdk-java/skills/azure-communication-chat-java/SKILL.md | skill | 97 | No cross-reference to azure-communication-common-java | +| .github/plugins/azure-sdk-java/skills/azure-security-keyvault-keys-java/SKILL.md | skill | 97 | No cross-reference to sibling Key Vault Secrets skill | +| .github/plugins/azure-sdk-dotnet/skills/azure-mgmt-arizeaiobservabilityeval-dotnet/SKILL.md | skill | 98 | Vague quantifier ("properly") | +| .github/plugins/azure-sdk-python/skills/azure-storage-blob-py/SKILL.md | skill | 98 | Vague quantifier ("appropriate") | +| .github/plugins/azure-sdk-python/skills/azure-monitor-opentelemetry-exporter-py/SKILL.md | skill | 98 | Vague quantifier ("appropriate") | +| .github/plugins/azure-sdk-python/skills/azure-eventgrid-py/SKILL.md | skill | 98 | Vague quantifier ("appropriate") | +| .github/plugins/azure-sdk-python/skills/azure-storage-queue-py/SKILL.md | skill | 98 | Vague quantifier ("appropriate") | +| .github/plugins/azure-sdk-python/skills/azure-monitor-ingestion-py/SKILL.md | skill | 98 | Vague quantifier ("reasonable") | +| .github/plugins/azure-sdk-python/skills/azure-eventhub-py/SKILL.md | skill | 98 | Vague quantifier ("appropriate") | +| .github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md | skill | 98 | Vague quantifier ("appropriate") | +| .github/plugins/azure-sdk-python/skills/azure-keyvault-py/SKILL.md | skill | 98 | Vague quantifier ("appropriately") | +| .github/plugins/azure-sdk-python/skills/azure-ai-contentsafety-py/SKILL.md | skill | 98 | Vague quantifier ("appropriate") | +| .github/plugins/azure-sdk-python/skills/azure-mgmt-botservice-py/SKILL.md | skill | 98 | Vague quantifier ("proper") | +| .github/plugins/azure-sdk-python/skills/azure-speech-to-text-rest-py/SKILL.md | skill | 98 | Vague quantifier ("proper") in code comment | +| .github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py/SKILL.md | skill | 98 | Vague quantifier ("appropriate") | +| .github/plugins/azure-sdk-python/skills/azure-monitor-query-py/SKILL.md | skill | 98 | Vague quantifier ("appropriate") | +| .github/plugins/azure-sdk-python/skills/azure-ai-language-conversations-py/SKILL.md | skill | 98 | Vague quantifier ("properly") | +| .github/plugins/azure-sdk-java/skills/azure-ai-voicelive-java/SKILL.md | skill | 98 | Vague quantifier ("properly") | +| .github/plugins/azure-sdk-java/skills/azure-communication-common-java/SKILL.md | skill | 98 | Vague quantifier ("appropriate") in code comment | +| .github/plugins/azure-sdk-java/skills/azure-ai-contentsafety-java/SKILL.md | skill | 98 | Vague quantifier ("appropriate") | +| .github/plugins/azure-sdk-java/skills/azure-messaging-webpubsub-java/SKILL.md | skill | 98 | Vague quantifier ("appropriate") | +| .github/plugins/azure-sdk-java/skills/azure-monitor-opentelemetry-exporter-java/SKILL.md | skill | 98 | Vague quantifier ("relevant") | +| .github/plugins/azure-sdk-java/skills/azure-ai-agents-persistent-java/SKILL.md | skill | 98 | Vague quantifier ("appropriate") | +| .github/plugins/azure-sdk-java/skills/azure-compute-batch-java/SKILL.md | skill | 98 | Vague quantifier ("properly") | +| .github/skills/microsoft-docs/SKILL.md | skill | 98 | Vague quantifier ("relevant") | +| .github/plugins/azure-sdk-dotnet/skills/azure-search-documents-dotnet/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-ai-textanalytics-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-storage-file-share-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-containerregistry-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-appconfiguration-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-ai-ml-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/fastapi-router-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-data-tables-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-monitor-opentelemetry-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-ai-translation-text-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-servicebus-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/pydantic-models-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-ai-vision-imageanalysis-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-mgmt-apicenter-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-ai-transcription-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-ai-contentunderstanding-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/m365-agents-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-messaging-webpubsubservice-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/azure-storage-file-datalake-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-python/skills/agent-framework-azure-ai-py/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-java/skills/azure-storage-blob-java/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-java/skills/azure-eventgrid-java/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-java/skills/azure-ai-projects-java/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-java/skills/azure-ai-formrecognizer-java/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-java/skills/azure-ai-vision-imageanalysis-java/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-java/skills/azure-communication-sms-java/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-java/skills/azure-eventhub-java/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-java/skills/azure-ai-anomalydetector-java/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-java/skills/azure-identity-java/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-java/skills/azure-cosmos-java/SKILL.md | skill | 100 | — | +| .github/plugins/azure-sdk-java/skills/azure-data-tables-java/SKILL.md | skill | 100 | — | +| .github/skills/continual-learning/SKILL.md | skill | 100 | — | +| .github/skills/podcast-generation/SKILL.md | skill | 100 | — | +| .github/plugins/azure-skills/hooks/hooks.json | hook | 100 | — | +| .github/plugins/azure-sdk-typescript/.claude-plugin/plugin.json | plugin.json | 100 | — | +| .github/plugins/microsoft-365-agents-toolkit/.claude-plugin/plugin.json | plugin.json | 100 | — | +| .github/plugins/microsoft-foundry/.claude-plugin/plugin.json | plugin.json | 100 | — | + +## Security Scan +| Severity | Count | +|----------|-------| +| Critical | 1 | +| High | 0 | +| Medium | 2 | +| Low | 2 | + +### Execution Surface Inventory +| Surface | Files | +|---------|-------| +| Hooks (`hooks/` + `.github/plugins/azure-skills/hooks/`, incl. `hooks.json`) | 2 | +| Scripts (`.sh`/`.py`/`.js` under `.github/`) | 61 | +| MCP configs (`.mcp.json`, `.vscode/mcp.json`) | 3 | +| Manifest/package files (`plugin.json`, `package.json`, `requirements.txt`) | 3 | + +### Security Findings +| # | Severity | File | Line | Pattern | Description | +|---|----------|------|------|---------|-------------| +| 1 | Critical | .github/plugins/azure-skills/skills/python-appservice-deploy/scripts/retry-az-create.sh | 36 | `eval "$VAR ..."` | `eval` executes caller-supplied `$SHOW_CMD`/`$CREATE_CMD` strings, passed in as `$1`/`$2` and documented as "single shell-quoted strings." Generic az-CLI retry wrapper by design, but any unsanitized data reaching these positional args gets full shell execution, not just an `az` invocation. | +| 2 | Medium | .github/plugins/azure-skills/skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh | 104 | `python3 -c "...${VAR}..."` unescaped interpolation | `MODEL_NAME`/`MODEL_VERSION` (script args) and `CAPACITY_JSON`/`PROJECTS_JSON`/`QUOTA_JSON` (Azure API responses) are interpolated directly into an embedded Python source string executed via `python3 -c "..."` without escaping; a value containing a stray quote could break out of the string literal and inject Python code. | +| 3 | Medium | .github/plugins/azure-skills/skills/azure-quotas/scripts/check-quota.sh | 71 | `python3 -c "...${VAR}..."` unescaped interpolation | `$USAGES_JSON` (`az quota usage list` output) is interpolated directly into an embedded Python script via `json.loads('''$USAGES_JSON''')` without escaping — same injection class as finding #2, lower likelihood since the source is well-formed JSON from `az` CLI. | +| 4 | Low | .github/plugins/azure-skills/hooks/scripts/track-telemetry.sh | 360 | `npx -y @azure/mcp@latest ...` publish telemetry | On every tracked tool/skill invocation the hook shells out via `npx` to an unpinned (`@latest`) MCP package and publishes client name, session id, skill name/version, tool name, and referenced file paths to a remote telemetry endpoint. No secrets or file contents are sent, and it's opt-out via `AZURE_MCP_COLLECT_TELEMETRY=false`, but the background network call isn't disclosed anywhere else in the repo. | +| 5 | Low | .vscode/mcp.json | 13 | `npx @latest` | Multiple MCP servers (`chrome-devtools-mcp@latest`, `@upstash/context7-mcp@latest`, `@playwright/mcp@latest`, plus `azure/.mcp.json`'s `@azure/mcp@latest`) are launched unpinned via `npx`, so each session can silently pull a newer package version — a supply-chain risk if any of those npm packages is compromised upstream. | + +## Bugs (PR-worthy) +| # | File | Issue | Impact | +|---|------|-------|--------| +| 1 | .github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md | Reference Files table links to `scripts/setup_cosmos_container.py`, but no `scripts/` directory exists in this skill folder (only `SKILL.md` and `references/`). | A reader or agent following the reference for the CLI container-setup tool finds nothing. | +| 2 | .github/plugins/azure-sdk-python/skills/azure-ai-projects-py/SKILL.md | Frontmatter description directs readers to a sibling skill "azure-ai-agents-python" for low-level agent operations, but no such skill exists anywhere in the repo (only `-dotnet`/`-java` variants of `azure-ai-agents-persistent` exist, under other language plugins). | A reader or routing agent following this pointer finds nothing and may hallucinate the skill's content. | +| 3 | .github/plugins/azure-sdk-java/skills/azure-monitor-ingestion-java/SKILL.md | "Querying Uploaded Logs" section links to `../query/SKILL.md`, which resolves to `skills/query/SKILL.md` — a directory that doesn't exist. The real directory is `skills/azure-monitor-query-java/`. | A reader following the link to find `LogsQueryClient` documentation hits a missing file. | + +## Security Fixes (PR-worthy, Medium/Low only) +| # | File | Issue | Suggested Fix | +|---|------|-------|---------------| +| 1 | .github/plugins/azure-skills/skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh | Unescaped shell-to-Python string interpolation of API response data into `python3 -c "..."`. | Pass `MODEL_NAME`/`MODEL_VERSION`/JSON payloads via environment variables or stdin instead of interpolating into the `-c` source string. | +| 2 | .github/plugins/azure-skills/skills/azure-quotas/scripts/check-quota.sh | Unescaped shell-to-Python string interpolation (`json.loads('''$USAGES_JSON''')`). | Pipe `$USAGES_JSON` to the Python process via stdin (`json.load(sys.stdin)`) instead of interpolating it into the source string. | +| 3 | .github/plugins/azure-skills/hooks/scripts/track-telemetry.sh | Background telemetry network call on every hook invocation isn't documented outside the script itself. | Document the telemetry call, what it sends, and the `AZURE_MCP_COLLECT_TELEMETRY=false` opt-out in the plugin's user-facing README. | +| 4 | .vscode/mcp.json | Multiple MCP servers pinned to `@latest` instead of an exact version. | Pin `chrome-devtools-mcp`, `@upstash/context7-mcp`, `@playwright/mcp` (and `@azure/mcp` in the sibling `.mcp.json` files) to exact versions to avoid unreviewed supply-chain changes landing silently. | + +## Quality Issues (informational) +| # | File | Issue | Penalty | +|---|------|-------|---------| +| 1 | .github/plugins/deep-wiki/agents/wiki-researcher.md | [R09] Description has zero `` blocks. | -15 | +| 2 | .github/plugins/deep-wiki/agents/wiki-researcher.md | [R11] No tools/allowed-tools field in frontmatter (only name/description/model present). | -5 | +| 3 | .github/plugins/deep-wiki/agents/wiki-researcher.md | [vague-quantifier] 1 hit: 'relevant files' (line 38). | -2 | +| 4 | .github/plugins/deep-wiki/agents/wiki-architect.md | [R09] Description has zero `` blocks. | -15 | +| 5 | .github/plugins/deep-wiki/agents/wiki-architect.md | [R11] No tools/allowed-tools field in frontmatter (only name/description/model present). | -5 | +| 6 | .github/plugins/deep-wiki/agents/wiki-writer.md | [R09] Description has zero `` blocks. | -15 | +| 7 | .github/plugins/deep-wiki/agents/wiki-writer.md | [R11] No tools/allowed-tools field in frontmatter (only name/description/model present). | -5 | +| 8 | .github/plugins/deep-wiki/agents/wiki-writer.md | [vague-quantifier] 3 hits: 'relevant file' (line38), 'relevant files' (line47), 'as appropriate' (line54). | -6 | +| 9 | .github/agents/frontend.agent.md | [R09] No `` blocks anywhere in the file. | -15 | +| 10 | .github/agents/frontend.agent.md | [R10] Frontmatter has name/description/tools only; no model field. | -5 | +| 11 | .github/agents/frontend.agent.md | [R11] Declared 'search' tool has no corresponding search-related instruction anywhere in the body. | -3 | +| 12 | .github/agents/frontend.agent.md | [R12] No section defines the format of the agent's own output/response; body is patterns/rules/file-location tables only. | -10 | +| 13 | .github/agents/planner.agent.md | [R09] No `` blocks anywhere in the file. | -15 | +| 14 | .github/agents/planner.agent.md | [R10] Frontmatter has name/description/tools/handoffs only; no model field. | -5 | +| 15 | .github/agents/planner.agent.md | [R11] Declared 'web' tool but body never references external web content, URLs, or internet search — all references are to local files (PRD.md, source tree). | -3 | +| 16 | .github/agents/planner.agent.md | [vague-quantifier] 2 hits: 'relevant files' (line30), 'appropriate specialist agent' (line89). | -4 | +| 17 | .github/agents/presenter.agent.md | [R09] No `` blocks anywhere in the file. | -15 | +| 18 | .github/agents/presenter.agent.md | [R10] Frontmatter has name/description/tools only; no model field. | -5 | +| 19 | .github/agents/presenter.agent.md | [R11] Declared 'execute' tool but file contains no Commands/bash section at all, unlike sibling agents (frontend/backend/scaffolder/infrastructure). | -3 | +| 20 | .github/agents/presenter.agent.md | [R11] Declared 'search' tool has no corresponding search-related instruction in the body. | -3 | +| 21 | .github/agents/presenter.agent.md | [R12] No section defines the format of the agent's own output/response. | -10 | +| 22 | .github/agents/backend.agent.md | [R09] No `` blocks anywhere in the file. | -15 | +| 23 | .github/agents/backend.agent.md | [R10] Frontmatter has name/description/tools only; no model field. | -5 | +| 24 | .github/agents/backend.agent.md | [R11] Declared 'search' tool has no corresponding search-related instruction anywhere in the body. | -3 | +| 25 | .github/agents/backend.agent.md | [R12] No section defines the format of the agent's own output/response; body is patterns/router examples/file tables only. | -10 | +| 26 | .github/agents/scaffolder.agent.md | [R09] No `` blocks anywhere in the file. | -15 | +| 27 | .github/agents/scaffolder.agent.md | [R10] Frontmatter has name/description/tools only; no model field. | -5 | +| 28 | .github/agents/scaffolder.agent.md | [R11] Declared 'search' tool has no corresponding search-related instruction anywhere in the body. | -3 | +| 29 | .github/agents/infrastructure.agent.md | [R09] No `` blocks anywhere in the file. | -15 | +| 30 | .github/agents/infrastructure.agent.md | [R10] Frontmatter has name/description/tools only; no model field. | -5 | +| 31 | .github/agents/infrastructure.agent.md | [R11] Declared 'search' tool has no corresponding search-related instruction anywhere in the body. | -3 | +| 32 | .github/agents/infrastructure.agent.md | [R12] No section defines the format of the agent's own output/response; body is deployment workflows/tables only. | -10 | +| 33 | .github/plugins/deep-wiki/commands/generate.md | [R18] Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS. | -5 | +| 34 | .github/plugins/deep-wiki/commands/agents.md | [R18] Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS. | -5 | +| 35 | .github/plugins/deep-wiki/commands/changelog.md | [R18] Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS. | -5 | +| 36 | .github/plugins/deep-wiki/commands/changelog.md | [R17] No instruction for the edge case of an empty/shallow git history — process assumes commits exist. | -5 | +| 37 | .github/plugins/deep-wiki/commands/deploy.md | [R18] Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS. | -5 | +| 38 | .github/plugins/deep-wiki/commands/build.md | [R18] Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS. | -5 | +| 39 | .github/plugins/deep-wiki/commands/build.md | [R17] Prerequisites section only states wiki markdown "should already exist" with no actual check-and-respond instruction, unlike sibling deploy.md. | -5 | +| 40 | .github/plugins/deep-wiki/commands/ask.md | [R15] Command's entire purpose is answering "$ARGUMENTS" as a question, but there is no instruction for an empty/missing question. | -10 | +| 41 | .github/plugins/deep-wiki/commands/ask.md | [R18] Frontmatter has only a description field; no argument-hint despite the command being fully argument-driven. | -5 | +| 42 | .github/plugins/deep-wiki/commands/ask.md | [vague-quantifier] 2 hits: 'relevant to the question' (line27), '[Relevant snippet...]' (line48). | -4 | +| 43 | .github/plugins/azure-sdk-dotnet/skills/azure-mgmt-arizeaiobservabilityeval-dotnet/SKILL.md | [vague-quantifier] "Close clients properly" (line 201). | -2 | +| 44 | .github/plugins/azure-sdk-python/skills/azure-identity-py/SKILL.md | [R05] Body is ~533 lines (frontmatter closes at line 11 of 544 total), exceeding the 500-line threshold. | -10 | +| 45 | .github/plugins/azure-sdk-python/skills/azure-storage-blob-py/SKILL.md | [vague-quantifier] "Set appropriate content types for web-served blobs" (line 257). | -2 | +| 46 | .github/plugins/azure-sdk-python/skills/azure-monitor-opentelemetry-exporter-py/SKILL.md | [vague-quantifier] "Set export intervals appropriate for your workload" (line 238). | -2 | +| 47 | .github/plugins/azure-sdk-python/skills/azure-eventgrid-py/SKILL.md | [vague-quantifier] "Set appropriate event types for routing and filtering" (line 195). | -2 | +| 48 | .github/plugins/azure-sdk-python/skills/azure-storage-queue-py/SKILL.md | [vague-quantifier] "Set appropriate visibility timeout based on processing time" (line 234). | -2 | +| 49 | .github/plugins/azure-sdk-python/skills/azure-ai-voicelive-py/SKILL.md | [R04] Description is ~517 characters, in the 500-800 char penalty band. | -5 | +| 50 | .github/plugins/azure-sdk-python/skills/azure-monitor-ingestion-py/SKILL.md | [vague-quantifier] "SDK handles batching, but send reasonable chunks" (line 229). | -2 | +| 51 | .github/plugins/azure-sdk-python/skills/azure-eventhub-py/SKILL.md | [vague-quantifier] "Set appropriate consumer groups for different applications" (line 252). | -2 | +| 52 | .github/plugins/azure-sdk-python/skills/azure-search-documents-py/SKILL.md | [R05] Body ~543 lines (554 total), exceeding 500-line threshold; caused largely by a duplicated "Additional Azure AI Search Patterns" section repeating earlier content near-verbatim. | -10 | +| 53 | .github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md | [R07] No scope note distinguishing this skill from sibling azure-cosmos-db-py, which covers the same azure-cosmos package with overlapping trigger phrases. | -3 | +| 54 | .github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md | [vague-quantifier] "appropriate scopes" without specifying which scopes for which scenario. | -2 | +| 55 | .github/plugins/azure-sdk-python/skills/azure-keyvault-py/SKILL.md | [vague-quantifier] "Cache secrets appropriately" without concrete guidance on TTL or strategy. | -2 | +| 56 | .github/plugins/azure-sdk-python/skills/azure-ai-contentsafety-py/SKILL.md | [vague-quantifier] "severity thresholds appropriate for your use case" without concrete guidance. | -2 | +| 57 | .github/plugins/azure-sdk-python/skills/azure-mgmt-botservice-py/SKILL.md | [vague-quantifier] "Configure proper CORS" without specifying the actual policy. | -2 | +| 58 | .github/plugins/azure-sdk-python/skills/azure-speech-to-text-rest-py/SKILL.md | [vague-quantifier] Code-comment docstring "Transcribe with proper error handling". | -2 | +| 59 | .github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py/SKILL.md | [vague-quantifier] "SAS tokens with appropriate permissions" without full specification. | -2 | +| 60 | .github/plugins/azure-sdk-python/skills/azure-monitor-query-py/SKILL.md | [vague-quantifier] "appropriate granularity" without concrete guidance. | -2 | +| 61 | .github/plugins/azure-sdk-python/skills/azure-ai-language-conversations-py/SKILL.md | [vague-quantifier] "Handle exceptions properly" without specifying which exceptions or how. | -2 | +| 62 | .github/plugins/azure-sdk-python/skills/azure-mgmt-fabric-py/SKILL.md | [vague-quantifier] "scale up as needed" without concrete triggers. | -2 | +| 63 | .github/plugins/azure-sdk-python/skills/azure-mgmt-fabric-py/SKILL.md | [vague-quantifier] "Handle LRO properly" without specifying the actual handling steps. | -2 | +| 64 | .github/plugins/azure-sdk-python/skills/azure-ai-projects-py/SKILL.md | [vague-quantifier] Code sample comment "Add tools as needed". | -2 | +| 65 | .github/plugins/azure-sdk-python/skills/azure-cosmos-db-py/SKILL.md | [R07] No cross-reference/scope note distinguishing this skill from sibling azure-cosmos-py, which covers the same package with overlapping trigger phrases. | -3 | +| 66 | .github/plugins/azure-sdk-java/skills/azure-ai-voicelive-java/SKILL.md | [vague-quantifier] "Close sessions properly when conversation ends" (line 221). | -2 | +| 67 | .github/plugins/azure-sdk-java/skills/azure-communication-common-java/SKILL.md | [vague-quantifier] "// Parse raw ID to appropriate type" (line 173), a code comment. | -2 | +| 68 | .github/plugins/azure-sdk-java/skills/azure-security-keyvault-secrets-java/SKILL.md | [R07] No mention/link to sibling azure-security-keyvault-keys-java skill despite both operating on the same vault. | -3 | +| 69 | .github/plugins/azure-sdk-java/skills/azure-ai-contentsafety-java/SKILL.md | [vague-quantifier] "Cache blocklist results where appropriate" (line 287). | -2 | +| 70 | .github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md | [R05] Body ~422 lines (13-434 of file), in the 400-500 line penalty band. | -5 | +| 71 | .github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md | [vague-quantifier] "TokenCredential with appropriate permissions" (line 61) does not name required permissions. | -2 | +| 72 | .github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md | [vague-quantifier] "Set appropriate timeouts" (line 417) is vague about actual timeout values. | -2 | +| 73 | .github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md | [vague-quantifier] "Cache results ... cache when appropriate" (line 421) does not specify caching criteria. | -2 | +| 74 | .github/plugins/azure-sdk-java/skills/azure-communication-callingserver-java/SKILL.md | [R04] Frontmatter description gives only one concrete trigger condition ("maintaining legacy code") rather than a list of specific invocation phrases like sibling skills use. | -15 | +| 75 | .github/plugins/azure-sdk-java/skills/azure-communication-callautomation-java/SKILL.md | [R07] Code examples import CommunicationUserIdentifier/PhoneNumberIdentifier from com.azure.communication.common (lines 69-70) but the skill never links azure-communication-common-java. | -3 | +| 76 | .github/plugins/azure-sdk-java/skills/azure-messaging-webpubsub-java/SKILL.md | [vague-quantifier] "Set appropriate token expiration for security" (line 306) does not specify a recommended value/range. | -2 | +| 77 | .github/plugins/azure-sdk-java/skills/azure-communication-chat-java/SKILL.md | [R07] Client Creation section uses CommunicationTokenCredential (lines 31, 37), documented in azure-communication-common-java, which is never referenced. | -3 | +| 78 | .github/plugins/azure-sdk-java/skills/azure-appconfiguration-java/SKILL.md | [R05] Body ~476 lines (12-487 of file), in the 400-500 line penalty band. | -5 | +| 79 | .github/plugins/azure-sdk-java/skills/azure-security-keyvault-keys-java/SKILL.md | [R07] No mention/link to sibling azure-security-keyvault-secrets-java skill despite both operating on the same vault. | -3 | +| 80 | .github/plugins/azure-sdk-java/skills/azure-monitor-opentelemetry-exporter-java/SKILL.md | [vague-quantifier] "Add relevant attributes — Include contextual data for debugging" (line 273) does not specify which attributes are relevant. | -2 | +| 81 | .github/plugins/azure-sdk-java/skills/azure-ai-agents-persistent-java/SKILL.md | [vague-quantifier] "Poll with appropriate delays" (line 130) pairs a vague qualifier with a concrete number in the same sentence; the heading itself remains vague. | -2 | +| 82 | .github/plugins/azure-sdk-java/skills/azure-compute-batch-java/SKILL.md | [vague-quantifier] "Handle LRO properly — Pool resize, delete operations are long-running" (line 380). | -2 | +| 83 | .github/skills/debugview/SKILL.md | [R04] Frontmatter description is roughly 775 characters (500-800 range). | -5 | +| 84 | .github/skills/cloud-solution-architect/SKILL.md | [R06] Complex architectural concepts (44 patterns, WAF pillars, mission-critical design) are covered entirely with reference tables; the only code-shaped block is a generic ADR template, not an implementation example. | -5 | +| 85 | .github/skills/cloud-solution-architect/SKILL.md | [vague-quantifier] 1 occurrence ('relevant'). | -2 | +| 86 | .github/skills/skill-creator/SKILL.md | [R05] Body is ~1310 lines, well over the 500-line threshold (and over the skill's own '<500 lines' rule it prescribes for other skills). | -10 | +| 87 | .github/skills/skill-creator/SKILL.md | [vague-quantifier] 15 occurrences found (appropriate x5, as needed x2, several, significantly, sufficient, typically, etc.); capped at -20. | -20 | +| 88 | .github/skills/applicationinsights-web-ts/SKILL.md | [R04] Frontmatter description is roughly 524 characters (500-800 range). | -5 | +| 89 | .github/skills/applicationinsights-web-ts/SKILL.md | [R05] SKILL.md body is 457 lines (400-500 range). | -5 | +| 90 | .github/skills/kql/SKILL.md | [R04] Frontmatter description is roughly 797 characters (500-800 range, just under the -10 threshold). | -5 | +| 91 | .github/skills/kql/SKILL.md | [R05] SKILL.md body is 439 lines (400-500 range). | -5 | +| 92 | .github/skills/copilot-sdk/SKILL.md | [R05] SKILL.md body is ~901 lines, well over the 500-line threshold. | -10 | +| 93 | .github/skills/copilot-sdk/SKILL.md | [vague-quantifier] 1 occurrence ('effectively'). | -2 | +| 94 | .github/skills/mcp-builder/SKILL.md | [R06] Core "Implement Tools" section is described narratively with zero inline code snippets; every concrete example lives in a separate ./reference/*.md file. | -5 | +| 95 | .github/skills/mcp-builder/SKILL.md | [vague-quantifier] 5 occurrences (relevant x2, as needed x2, effectively). | -10 | +| 96 | .github/skills/entra-agent-id/SKILL.md | [R04] Frontmatter description is roughly 715 characters (500-800 range). | -5 | +| 97 | .github/skills/microsoft-docs/SKILL.md | [vague-quantifier] 1 occurrence ('relevant'). | -2 | +| 98 | .github/skills/frontend-design-review/SKILL.md | [R04] Frontmatter description is roughly 595 characters (500-800 range). | -5 | +| 99 | .github/skills/frontend-design-review/SKILL.md | [vague-quantifier] 1 occurrence ('context-appropriate'). | -2 | +| 100 | .github/skills/github-issue-creator/SKILL.md | [vague-quantifier] 2 occurrences ('relevant' x2). | -4 | + +## Cross-Component + +- **Broken references** (also listed under Bugs): `azure-cosmos-py/SKILL.md` links to a nonexistent `scripts/setup_cosmos_container.py`; `azure-ai-projects-py/SKILL.md` points readers to a nonexistent `azure-ai-agents-python` skill; `azure-monitor-ingestion-java/SKILL.md` links to `../query/SKILL.md` instead of the real `../azure-monitor-query-java/SKILL.md`. +- **Orphaned/overlapping sibling skills**: `azure-cosmos-py` and `azure-cosmos-db-py` both cover the `azure-cosmos` Python package with overlapping trigger phrases ("Cosmos DB", "NoSQL") and no scope note disambiguating them — a routing agent cannot deterministically pick one. +- **Missing cross-links between logically related Java skills**: `azure-security-keyvault-secrets-java` and `azure-security-keyvault-keys-java` operate on the same vault but never reference each other; `azure-communication-callautomation-java` and `azure-communication-chat-java` both import identifier/credential types documented in `azure-communication-common-java` without linking to it. +- **No manifest/disk contradictions found**: the three `plugin.json` manifests checked (`azure-sdk-typescript`, `microsoft-365-agents-toolkit`, `microsoft-foundry`) all point to paths that exist on disk, and `azure-skills/hooks/hooks.json`'s two referenced scripts (`track-telemetry.sh`/`.ps1`) are both present. +- **Systemic template gap across agent families**: all 9 agents audited (`.github/agents/*.agent.md` and `.github/plugins/deep-wiki/agents/*.md`) independently omit `` blocks, and the 6 `.agent.md` files additionally omit a declared `model` tier — the uniformity across two otherwise-unrelated agent families suggests a shared authoring template gap rather than 9 independent oversights. + +## Recommendation +- **BLOCKED — do not submit PRs. File private security report.** A Critical-severity finding (`eval` on caller-supplied command strings in `retry-az-create.sh`) requires private disclosure before any public PR activity against this repo. Hold the 3 NL bug fixes and the 4 Medium/Low security fixes above until the security disclosure is filed and acknowledged; do not open public PRs referencing any of the findings in this report in the meantime. diff --git a/auditor/disclosures-pending/microsoft-skills.md b/auditor/disclosures-pending/microsoft-skills.md new file mode 100644 index 000000000..f0f85dc9a --- /dev/null +++ b/auditor/disclosures-pending/microsoft-skills.md @@ -0,0 +1,31 @@ + + +## Security Findings in Executable Artifacts + +While auditing NL programming artifacts in this repository, our scanner detected potential security issues in executable files. + +### Findings + +| # | Severity | File | Line | Pattern | Description | +|---|----------|------|------|---------|-------------| +| 1 | Critical | .github/plugins/azure-skills/skills/python-appservice-deploy/scripts/retry-az-create.sh | 36 | `eval "$VAR ..."` | `eval` executes caller-supplied `$SHOW_CMD`/`$CREATE_CMD` strings, passed in as `$1`/`$2` and documented as "single shell-quoted strings." Generic az-CLI retry wrapper by design, but any unsanitized data reaching these positional args gets full shell execution, not just an `az` invocation. | + +### About This Report + +These findings come from [NLPM](https://github.com/xiaolai/nlpm)'s security scanner, which checks executable surfaces (hooks, scripts, MCP configs, dependencies) against known-dangerous patterns. + +We may be wrong — false positives happen. If any finding is intentional or already mitigated, please close this issue. If a finding is genuine and you'd like a fix PR, let us know. + +Full audit report: https://github.com/xiaolai/nlpm/blob/main/auditor/audits/microsoft-skills.md diff --git a/auditor/findings.jsonl b/auditor/findings.jsonl index a7a68334f..eef04b395 100644 --- a/auditor/findings.jsonl +++ b/auditor/findings.jsonl @@ -5281,6 +5281,117 @@ {"event":"finding","timestamp":"2026-07-20T12:52:16Z","audit_run_id":"29743382398","repo":"laolaoshiren/claude-code-skills-zh","commit_sha":"6034db4b6df3242803d8e16a4fd6fa4d80001d70","fingerprint":"sha256:fa5e9803f2ff3c1a834b85059c9727fc819a7d7316103668c27e40df2e83e529","category":"security","rule_id":"SEC-temp-file-write","file":"scripts/test_juejin_post.js","line":99,"severity":"low","confidence":"high","evidence":"draftScreenshot = path.join(os.tmpdir(), 'juejin_draft.png')","penalty":null,"pattern":"file-write-outside-repo","description":"Draft/publish screenshots are written to the OS temp directory, outside the repo tree","false_positive":false,"suggested_fix":"Write to a dedicated gitignored .tmp/ directory under the repo instead of os.tmpdir()"} {"event":"finding","timestamp":"2026-07-20T12:52:16Z","audit_run_id":"29743382398","repo":"laolaoshiren/claude-code-skills-zh","commit_sha":"6034db4b6df3242803d8e16a4fd6fa4d80001d70","fingerprint":"sha256:29631582352ec175acb7616f5c1d28395e17b81f944057febf3dec55b5f52a42","category":"security","rule_id":"SEC-network-call","file":"scripts/sync_readme_to_site.py","line":507,"severity":"medium","confidence":"high","evidence":"subprocess.run([\"gh\", \"api\", \"graphql\", \"-f\", f\"query={query}\"], ...) inside fetch_github_stars()","penalty":null,"pattern":"network-call","description":"Invokes gh CLI to perform an external GraphQL network call fetching GitHub star counts for every curated repo URL in README.md","false_positive":false,"suggested_fix":"No fix needed; this is a read-only, non-credentialed (uses gh's own auth) query intrinsic to the script's stated purpose"} {"event":"finding","timestamp":"2026-07-20T12:52:16Z","audit_run_id":"29743382398","repo":"laolaoshiren/claude-code-skills-zh","commit_sha":"6034db4b6df3242803d8e16a4fd6fa4d80001d70","fingerprint":"sha256:005071722d9410b31c590cc01d9a7bc5de806b1ff2423273acc32c9818b50237","category":"cross_component","rule_id":"CC-orphan-component","file":"README.md","line":null,"severity":"info","confidence":"high","evidence":"all 20 skills/*/SKILL.md directories appear in README.md's skills table with matching relative links; scripts/test_sync_readme_to_site.py::test_original_skill_sets_and_promo_counts_are_consistent already asserts this at test time","penalty":null,"pattern":"none","description":"No broken references or orphaned skill directories found; README, docs/index.html, and PROMO.md skill counts are cross-checked by an existing repo test","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:5c5ff7e7cab35590e07516d99bec2f32303535f2db08b120514d1d75db19d570","category":"bug","rule_id":"BUG-broken-reference","file":".github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md","line":null,"severity":"high","confidence":"high","evidence":"ls on azure-cosmos-py/ shows only SKILL.md and references/; no scripts/ dir exists, yet the Reference Files table links to scripts/setup_cosmos_container.py","penalty":null,"pattern":"","description":"SKILL.md's Reference Files table links to scripts/setup_cosmos_container.py, but no scripts/ directory exists in this skill folder.","false_positive":false,"suggested_fix":"Add the missing scripts/setup_cosmos_container.py file, or remove that row from the Reference Files table."} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:daa7d7e391bf561f5270a37d2f26cb452873380be4876390f95e03a5cfd7a0de","category":"bug","rule_id":"BUG-broken-reference","file":".github/plugins/azure-sdk-python/skills/azure-ai-projects-py/SKILL.md","line":null,"severity":"high","confidence":"high","evidence":"frontmatter description references an 'azure-ai-agents-python' skill; find/grep across target-repo shows no such directory anywhere","penalty":null,"pattern":"","description":"The description directs readers to a sibling skill 'azure-ai-agents-python' that does not exist in the repo.","false_positive":false,"suggested_fix":"Create the referenced skill, correct the name to an actually-existing skill/package, or remove the sentence."} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:50bc5e40fc47366168d53d0dc4cd63e098482f169daff3a86575cc4619ba6880","category":"bug","rule_id":"BUG-broken-reference","file":".github/plugins/azure-sdk-java/skills/azure-monitor-ingestion-java/SKILL.md","line":227,"severity":"medium","confidence":"high","evidence":"Line 227 links to '../query/SKILL.md' which resolves to skills/query/SKILL.md; the actual directory is skills/azure-monitor-query-java/","penalty":null,"pattern":"","description":"The 'Querying Uploaded Logs' section links to a sibling skill using a relative path that does not match any real directory.","false_positive":false,"suggested_fix":"Change '../query/SKILL.md' to '../azure-monitor-query-java/SKILL.md'."} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:bf9e17c6642b3660d47a905f2c48191107705953560bb21d2af2585bfa3fc992","category":"security","rule_id":"SEC-eval-interpolated-vars","file":".github/plugins/azure-skills/skills/python-appservice-deploy/scripts/retry-az-create.sh","line":36,"severity":"critical","confidence":"medium","evidence":"","penalty":null,"pattern":"eval \"$VAR ...\"","description":"eval executes caller-supplied $SHOW_CMD/$CREATE_CMD strings passed as $1/$2; any unsanitized data reaching these args gets full shell execution.","false_positive":false,"suggested_fix":"Require callers to pass argv arrays instead of shell-quoted strings; replace eval with direct execution of a constructed argv array."} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:5bf7d7f087cbc8b65d7c5ea6c8a1e57f68211906feb4e7d5e90d814439ffaa8f","category":"security","rule_id":"SEC-shell-to-python-injection","file":".github/plugins/azure-skills/skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh","line":104,"severity":"medium","confidence":"medium","evidence":"","penalty":null,"pattern":"python3 -c \"...${VAR}...\" unescaped interpolation","description":"MODEL_NAME/MODEL_VERSION and API JSON responses are interpolated directly into an embedded Python source string executed via python3 -c without escaping.","false_positive":false,"suggested_fix":"Pass values via environment variables or stdin instead of string-interpolating into the -c source."} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:7780f0cb54e39098642fdbccf5c1429d82ba6d63b206cb4e490d9d01c5cab9a8","category":"security","rule_id":"SEC-shell-to-python-injection","file":".github/plugins/azure-skills/skills/azure-quotas/scripts/check-quota.sh","line":71,"severity":"medium","confidence":"medium","evidence":"","penalty":null,"pattern":"python3 -c \"...${VAR}...\" unescaped interpolation","description":"$USAGES_JSON (az CLI output) is interpolated directly into json.loads('''$USAGES_JSON''') without escaping.","false_positive":false,"suggested_fix":"Pipe $USAGES_JSON to the Python process via stdin (json.load(sys.stdin)) instead of interpolating it into the source string."} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:826b56c96e4845ec32fcea26f137f0a449c1ae5108e09ae8327451929ea5fecc","category":"security","rule_id":"SEC-telemetry-network-call","file":".github/plugins/azure-skills/hooks/scripts/track-telemetry.sh","line":360,"severity":"low","confidence":"medium","evidence":"","penalty":null,"pattern":"npx -y @azure/mcp@latest ... publish telemetry","description":"Every tracked tool/skill invocation shells out via npx to an unpinned MCP package and publishes client/session/skill/tool metadata to a remote endpoint; opt-out via AZURE_MCP_COLLECT_TELEMETRY=false but undocumented elsewhere.","false_positive":false,"suggested_fix":"Document the telemetry call, what it sends, and the opt-out flag prominently in the plugin's user-facing README."} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:dee68d4aef5d7c0d7f798cee37e19cdbc29f12524efd8eb527a89da676f250e6","category":"security","rule_id":"SEC-unpinned-mcp-server","file":".vscode/mcp.json","line":13,"severity":"low","confidence":"medium","evidence":"","penalty":null,"pattern":"npx @latest","description":"Multiple MCP servers (chrome-devtools-mcp@latest, @upstash/context7-mcp@latest, @playwright/mcp@latest) are launched unpinned via npx.","false_positive":false,"suggested_fix":"Pin MCP server packages to exact versions instead of @latest to avoid unreviewed supply-chain changes landing silently."} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:b1e663ba3ea176dc78e63c681266f5cba05c1f52f832f2fcf8c5ea156cd19750","category":"nl_quality","rule_id":"R09","file":".github/plugins/deep-wiki/agents/wiki-researcher.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"Description has zero blocks.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:87ffd5c9c356dda43185f08d8a564117359453ddbfeb2be3e085a69c5bdfcde9","category":"nl_quality","rule_id":"R11","file":".github/plugins/deep-wiki/agents/wiki-researcher.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"No tools/allowed-tools field in frontmatter (only name/description/model present).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:77d9cbb51caf8279839001b0c71bea124c3b5128e9a760b6b6f7622a3b2b9cfa","category":"nl_quality","rule_id":"R01","file":".github/plugins/deep-wiki/agents/wiki-researcher.md","line":38,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"1 vague quantifier hit: 'relevant files' (line 38).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:4a3c1dd8a9d5a4c978e7ede4e185d32ebf4dba6781c12ae32e2e50a44ca040ed","category":"nl_quality","rule_id":"R09","file":".github/plugins/deep-wiki/agents/wiki-architect.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"Description has zero blocks.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:fed84aae4243d4838110c938040bdf9514756c94a14d0f1e1f2bd88623aafdfd","category":"nl_quality","rule_id":"R11","file":".github/plugins/deep-wiki/agents/wiki-architect.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"No tools/allowed-tools field in frontmatter (only name/description/model present).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:d07a813c2edbf4a6a82812c0a2e5dac5c564827a5335ef3761cd5e35973f2e4b","category":"nl_quality","rule_id":"R09","file":".github/plugins/deep-wiki/agents/wiki-writer.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"Description has zero blocks.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:b5b0bef0f3fdac071738e6137118e6ef53cb3ef3a8a221f72e4c48e99b4ff23f","category":"nl_quality","rule_id":"R11","file":".github/plugins/deep-wiki/agents/wiki-writer.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"No tools/allowed-tools field in frontmatter (only name/description/model present).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:9def7f81d5cdfae66afb08ab6f7f34730ad101e8ca336514728b06ffc68465ea","category":"nl_quality","rule_id":"R01","file":".github/plugins/deep-wiki/agents/wiki-writer.md","line":38,"severity":"low","confidence":"high","evidence":"","penalty":-6,"pattern":"","description":"3 vague quantifier hits: 'relevant file' (line38), 'relevant files' (line47), 'as appropriate' (line54).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:717a749347214f54503750a646e8c5d8e7aef89c2130f56b698d0319169f6c5b","category":"nl_quality","rule_id":"R09","file":".github/agents/frontend.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"No blocks anywhere in the file.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:a5c8cbc36524f2874d1ace592a27d2fff56a0a9bcfa8fd0dca99ab38bc037546","category":"nl_quality","rule_id":"R10","file":".github/agents/frontend.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter has name/description/tools only; no model field.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:c246c6a4eaae0178930340fa777add5bdc5446def14a1da902dc90038f1d899c","category":"nl_quality","rule_id":"R11","file":".github/agents/frontend.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Declared 'search' tool has no corresponding search-related instruction anywhere in the body.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:049437501395c3db9d22aa5a190fd921e629bde959217641687898d02f4f0d3c","category":"nl_quality","rule_id":"R12","file":".github/agents/frontend.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"No section defines the format of the agent's own output/response; body is patterns/rules/file-location tables only.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:3fa56c92d89f4658830944ce872a565aeebfd6fd77115a9e4c0aef526a91ffbf","category":"nl_quality","rule_id":"R09","file":".github/agents/planner.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"No blocks anywhere in the file.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:2fd4b4ab277c61d07eb56675cbabb2c5c9e20119745c4d01f7279bfc564416de","category":"nl_quality","rule_id":"R10","file":".github/agents/planner.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter has name/description/tools/handoffs only; no model field.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:1fd2356031b2a68edc2299988490441f2fe911af28d53793a83e23731cc9e9c6","category":"nl_quality","rule_id":"R11","file":".github/agents/planner.agent.md","line":null,"severity":"low","confidence":"high","evidence":"tools: [\"read\",\"search\",\"web\"] in frontmatter; body's 'Explore the Codebase' section only mentions searching/reading local files, no web usage anywhere.","penalty":-3,"pattern":"","description":"Declared 'web' tool but body never references external web content, URLs, or internet search — all references are to local files.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:57a50fc02bd680903e1304caf1a29dd8c0ac99664c9bc74d2d8ba84d013aa818","category":"nl_quality","rule_id":"R01","file":".github/agents/planner.agent.md","line":30,"severity":"low","confidence":"high","evidence":"","penalty":-4,"pattern":"","description":"2 vague quantifier hits: 'relevant files' (line30), 'appropriate specialist agent' (line89).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:1fc2d1c3aefc78b585c33ade74f2dfcaf20593b87425fe64ed3b420dde715759","category":"nl_quality","rule_id":"R09","file":".github/agents/presenter.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"No blocks anywhere in the file.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:12ac9c3a9a81bac0f01bf0c858baf830155709a44bbcc551d9b853567e8a5052","category":"nl_quality","rule_id":"R10","file":".github/agents/presenter.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter has name/description/tools only; no model field.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:5386dabde6c76a41819cbe0301edae4ef5aab5069ec9ba1e4ec4f8dea39dd856","category":"nl_quality","rule_id":"R11","file":".github/agents/presenter.agent.md","line":null,"severity":"low","confidence":"high","evidence":"tools: [\"read\",\"edit\",\"search\",\"execute\"] in frontmatter; full-file read shows no bash code fence or 'Commands' heading anywhere.","penalty":-3,"pattern":"","description":"Declared 'execute' tool but file contains no Commands/bash section at all, unlike sibling agents.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:5386dabde6c76a41819cbe0301edae4ef5aab5069ec9ba1e4ec4f8dea39dd856","category":"nl_quality","rule_id":"R11","file":".github/agents/presenter.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Declared 'search' tool has no corresponding search-related instruction in the body.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:def5d6ebea34cd697ba8ea447ea1b0e5c19322b35128b0e57bb9dd0ecbfc54bb","category":"nl_quality","rule_id":"R12","file":".github/agents/presenter.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"No section defines the format of the agent's own output/response.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:37b415adf6489cc870e57779a83126cf99fe696bd2996b24c0f5b5a2b0101887","category":"nl_quality","rule_id":"R09","file":".github/agents/backend.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"No blocks anywhere in the file.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:c6413e968521e750be77dbe8336554b9f060c0c271ffc808ecab6d513c8e8f9d","category":"nl_quality","rule_id":"R10","file":".github/agents/backend.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter has name/description/tools only; no model field.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:5f125c736acadcfa720b215afec091b5128d1950441cac24e5dc5911fbf748e1","category":"nl_quality","rule_id":"R11","file":".github/agents/backend.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Declared 'search' tool has no corresponding search-related instruction anywhere in the body.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:53d54e34021ac311766831328ee5afe3f4c6ab68996e471e0f5c532127205d84","category":"nl_quality","rule_id":"R12","file":".github/agents/backend.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"No section defines the format of the agent's own output/response; body is patterns/router examples/file tables only.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:74840cfc0d8c6b590a47601e4187ab2b3511fd14fd73ede06eb2ef2db77aebf2","category":"nl_quality","rule_id":"R09","file":".github/agents/scaffolder.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"No blocks anywhere in the file.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:1718b00c2209577d48019b50677cde1346dd09d8da4a9f027007de5e1a2505a1","category":"nl_quality","rule_id":"R10","file":".github/agents/scaffolder.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter has name/description/tools only; no model field.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:83d15376f63b40f6708f7f59ff889761aed1e028ef5e2f6af8612eabfad9946d","category":"nl_quality","rule_id":"R11","file":".github/agents/scaffolder.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Declared 'search' tool has no corresponding search-related instruction anywhere in the body.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:b97157ff82b1001855f30f311c0c3e6f76c0b766eb9db33b3fa5b973ffd92578","category":"nl_quality","rule_id":"R09","file":".github/agents/infrastructure.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-15,"pattern":"","description":"No blocks anywhere in the file.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:da50388842b032d52c71ba8d82452ebc7483eae6a3079c6e1244238520a03c15","category":"nl_quality","rule_id":"R10","file":".github/agents/infrastructure.agent.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter has name/description/tools only; no model field.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:214ce650573d0ea573af813c1957e1c36e0430ed57ae88a84f9dfce0d51f7b36","category":"nl_quality","rule_id":"R11","file":".github/agents/infrastructure.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Declared 'search' tool has no corresponding search-related instruction anywhere in the body.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:b28495c440226e699b7482d4456a87d855ccd66d60c5327796f7d11653de2527","category":"nl_quality","rule_id":"R12","file":".github/agents/infrastructure.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"No section defines the format of the agent's own output/response; body is deployment workflows/tables only.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:429d1d717197864174b74a2617444430abdb0d4f17d112413311e5f57c12db6a","category":"nl_quality","rule_id":"R18","file":".github/plugins/deep-wiki/commands/generate.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token.","penalty":-5,"pattern":"","description":"Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:f49f38fb609109fdeb649717ed11060a493c499d4992dc7d681376e6ec0584da","category":"nl_quality","rule_id":"R18","file":".github/plugins/deep-wiki/commands/agents.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token.","penalty":-5,"pattern":"","description":"Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:16d24fecb49d6f64b64dc4512fad1cd5fb16abfd3a31f0862c30ee4c008d1cc7","category":"nl_quality","rule_id":"R18","file":".github/plugins/deep-wiki/commands/changelog.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token.","penalty":-5,"pattern":"","description":"Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:35c922459e06f0f71370e5d5799bea038a8472a1bdf0f8814ec9414245ed2a68","category":"nl_quality","rule_id":"R17","file":".github/plugins/deep-wiki/commands/changelog.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"No instruction for the edge case of an empty/shallow git history — process assumes commits exist.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:252ae9788a0afab34fa680a0f4aa0543218fc44d01f718e0af6c57e304716cd3","category":"nl_quality","rule_id":"R18","file":".github/plugins/deep-wiki/commands/deploy.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token.","penalty":-5,"pattern":"","description":"Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:48071f13c1995104bb9781f3cfdff419d19dc449eedfaa51bfde3eaf5711de9b","category":"nl_quality","rule_id":"R18","file":".github/plugins/deep-wiki/commands/build.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token.","penalty":-5,"pattern":"","description":"Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:5ba5239a315450abb0cec43dc7cdff81218f231f99aca7e4a37f5f44bdd0d77c","category":"nl_quality","rule_id":"R17","file":".github/plugins/deep-wiki/commands/build.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Prerequisites section only states wiki markdown 'should already exist' with no actual check-and-respond instruction, unlike sibling deploy.md.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:5f37d172ee9a8a4440d4a40e51ae69b3cf1507785f1e0a28eb08de7a6b319826","category":"nl_quality","rule_id":"R15","file":".github/plugins/deep-wiki/commands/ask.md","line":null,"severity":"low","confidence":"high","evidence":"body's '## Question' section is literally the bare '$ARGUMENTS' token with no empty-check or fallback prompt anywhere in the file.","penalty":-10,"pattern":"","description":"Command's entire purpose is answering '$ARGUMENTS' as a question, but there is no instruction for what to do if no question is supplied.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:a7783b08d07a785d17829fcf14e542371b053860e760c2d06d9db2a78456ada2","category":"nl_quality","rule_id":"R18","file":".github/plugins/deep-wiki/commands/ask.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter block contains only 'description:'.","penalty":-5,"pattern":"","description":"Frontmatter has only a description field; no argument-hint despite the command being fully argument-driven.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:e984d1dd962be258c0de9f5e5fb4603c0ef94ae642b8d8c732291ba60fd063a5","category":"nl_quality","rule_id":"R01","file":".github/plugins/deep-wiki/commands/ask.md","line":27,"severity":"low","confidence":"high","evidence":"","penalty":-4,"pattern":"","description":"2 vague quantifier hits: 'relevant to the question' (line27), '[Relevant snippet...]' (line48).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:3a11ae4e81e3da48b6268b18ac06f059c5b6568607298e038ed655a1c290363c","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-dotnet/skills/azure-mgmt-arizeaiobservabilityeval-dotnet/SKILL.md","line":201,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 201: 'Close clients properly' uses vague quantifier 'properly' instead of a concrete instruction.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:f72997d3a0a335646af47899dfe33ec9c482b3a08bff2617edbdc63f91f464f5","category":"nl_quality","rule_id":"R05","file":".github/plugins/azure-sdk-python/skills/azure-identity-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"File is 544 total lines; frontmatter closes at line 11, leaving 533 lines of body content.","penalty":-10,"pattern":"","description":"Body exceeds 500 lines (533 lines of content).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:b46e8db1daa44dbf7afb3c962f30f2c38ba5c0e2d7abcf0745f2536a5d9f5801","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-storage-blob-py/SKILL.md","line":257,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 257: 'Set appropriate content types for web-served blobs' uses vague quantifier 'appropriate'.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:99a8bd4c57669efb98704d58ae4d9218311fde60f544412eb2d59a1b452eaa65","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-monitor-opentelemetry-exporter-py/SKILL.md","line":238,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 238: 'Set export intervals appropriate for your workload' uses vague quantifier 'appropriate'.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:92c78b54151f764c5863a70a43742ae444c627f4f97c7b986fd478b39169bca1","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-eventgrid-py/SKILL.md","line":195,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 195: 'Set appropriate event types for routing and filtering' uses vague quantifier 'appropriate'.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:ffc412a56381bfa3d47f29dcb54e17221981b047408e2effa2c3ffa27bf7048f","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-storage-queue-py/SKILL.md","line":234,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 234: 'Set appropriate visibility timeout based on processing time' uses vague quantifier 'appropriate'.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:68bea94f878408597928073604878487eca2d35558135cf91810e53d78a4c70f","category":"nl_quality","rule_id":"R04","file":".github/plugins/azure-sdk-python/skills/azure-ai-voicelive-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"Description field measured at 517 characters, falling in the 500-800 char band.","penalty":-5,"pattern":"","description":"Description is 517 characters, in the 500-800 char penalty band.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:e041bf43706a34be8baa8ca3d0110f5328c4aa72667a446a06bd4358ac7e5a57","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-monitor-ingestion-py/SKILL.md","line":229,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 229: 'SDK handles batching, but send reasonable chunks' uses vague quantifier 'reasonable'.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:c7fe81187c3d095ccf178b59ff6674ddd1d70011e7bddd11b61bc421d5fa1f4e","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-eventhub-py/SKILL.md","line":252,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 252: 'Set appropriate consumer groups for different applications' uses vague quantifier 'appropriate'.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:4cd9c591c923e45d1fdac12faf3ef97099c4ed0f13e74ab77774b5b36d040cdb","category":"nl_quality","rule_id":"R05","file":".github/plugins/azure-sdk-python/skills/azure-search-documents-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"File is 554 total lines; body ~543 lines, overage largely caused by a duplicated 'Additional Azure AI Search Patterns' section repeating earlier content near-verbatim.","penalty":-10,"pattern":"","description":"Body exceeds 500 lines (543 lines), driven by a duplicated second section repeating earlier content.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:33f41f9f35404863738307534b6097c5264c398092955d4bd6b2f9874a21ade4","category":"nl_quality","rule_id":"R07","file":".github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"No scope note distinguishing this skill from sibling azure-cosmos-db-py, which covers the same azure-cosmos package with overlapping trigger phrases.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:f232204b2b6d2bd61240ec5b539b398dd5135a6c6ab88f65696d1aa946f01885","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #4 says 'appropriate scopes' without specifying which scopes for which scenario.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:9312338f15f26cbc09e45f09ee72d1028dd061be61bc90fed5389a6b81b2f62c","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-keyvault-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #9 says 'Cache secrets appropriately' without concrete guidance on TTL or strategy.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:786027f2053e1b79c423e4250984f9422447ead7ff7e57c19f4bd23201e3745c","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-ai-contentsafety-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #4 says 'severity thresholds appropriate for your use case' without concrete guidance.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:7a8c9f13c32542a3abb9d0ce83cfe4bd734774c34480ccabc6e59dd5a647a3cd","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-mgmt-botservice-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #9 says 'Configure proper CORS' without specifying the actual policy.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:fea4acf0faaaf439087aab4fc9e8cfbeb7410c369e304f1e7694383a832cc020","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-speech-to-text-rest-py/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-2,"pattern":"","description":"Error-handling example's docstring says 'Transcribe with proper error handling' — an unspecific qualifier inside a code comment.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:a05874080ce5fdb26899218887467ed6aed84c64da27e9ae67bbf6d42ef7f799","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Storage Requirements says 'SAS tokens with appropriate permissions' without full specification.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:1b72ca3f842d7b77b9bb1c90a56c412f6e5be6027e5c74982813a5a318395309","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-monitor-query-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #6 says 'appropriate granularity' without concrete guidance.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:c8fcdb50ff7f3e48b1e63cd88ce600bfdbb876351862fd775df229887f50b8a4","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-ai-language-conversations-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"System Prompt section says 'Handle exceptions properly' without specifying which exceptions or how.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:30043850264eaac8df43780fd5c5265716e123115c11c8f468b1d929ed17c968","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-mgmt-fabric-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #5 says 'scale up as needed' without concrete triggers.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:30043850264eaac8df43780fd5c5265716e123115c11c8f468b1d929ed17c968","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-mgmt-fabric-py/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Best Practices #8 says 'Handle LRO properly' without specifying the actual handling steps.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:d7ed56adcaafd6eb969ea3aa7b1b26f18ae0e617e75ebb0bdd312204f4e2e06f","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-python/skills/azure-ai-projects-py/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-2,"pattern":"","description":"Code sample comment 'Add tools as needed' is an unspecific qualifier.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:d0fb0d11516ab1be89ec0dfc390309268b8a92bd9fbaf6fe171a5bc3573036d2","category":"nl_quality","rule_id":"R07","file":".github/plugins/azure-sdk-python/skills/azure-cosmos-db-py/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"No cross-reference/scope note distinguishing this skill from sibling azure-cosmos-py, which covers the same package with overlapping trigger phrases.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:968fee3cd69f0e85fe573252896a73dbc2580ee7521f5251cb4cfa96285282f6","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-ai-voicelive-java/SKILL.md","line":221,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 221: 'Close sessions properly when conversation ends' uses vague qualifier 'properly'.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:dad9736f35fbf7c126160b3433da79fcc00b3b2585e23a9f132b4c8b58d3f0f1","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-communication-common-java/SKILL.md","line":173,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 173: '// Parse raw ID to appropriate type' is a code comment using 'appropriate' instead of naming concrete types.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:cdc11855aa5c152084a1ca06e35133de177ab4bf84a27636398ae98fedd0b81a","category":"nl_quality","rule_id":"R07","file":".github/plugins/azure-sdk-java/skills/azure-security-keyvault-secrets-java/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"No mention/link to sibling azure-security-keyvault-keys-java skill despite both operating on the same vault.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:636b8023307f81a95f77425f3e213dfd4e2f6de19047340bd0e0b93f3b4be064","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-ai-contentsafety-java/SKILL.md","line":287,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 287: 'Cache blocklist results where appropriate' does not specify when caching is appropriate.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:88063e657d71e1bb2e6bd2abe54c4b6d76248fafe4fdfb4558519ca5d81ec80d","category":"nl_quality","rule_id":"R05","file":".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"Body (lines 13-434) is approximately 422 lines, within the 400-500 line penalty band.","penalty":-5,"pattern":"","description":"Body length (422 lines) in the 400-500 penalty band.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:f8783a72c724a321fa3268cd622fd6ab0e66f3dcea9cc5c459d5220a706db368","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md","line":61,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 61: 'TokenCredential with appropriate permissions' does not name the required permissions.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:b0c80614b3d4bca195a42a6af4174e62683bc852e2e88b714b45eb895a0516e9","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md","line":417,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 417: 'Set appropriate timeouts' is vague about the actual timeout values.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:b35c620c78fdc84dacbb7e9b828085bf64e206cf3daef24dda1965c8e0fa768d","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md","line":421,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 421: 'Cache results ... cache when appropriate' does not specify caching criteria.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:aab61271516cde0c426fc17470ee6c345f841c03c61635d4c2dacfccd39fb548","category":"nl_quality","rule_id":"R04","file":".github/plugins/azure-sdk-java/skills/azure-communication-callingserver-java/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-15,"pattern":"","description":"Frontmatter description gives only one concrete trigger condition ('maintaining legacy code') rather than a list of specific invocation phrases like sibling skills use.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:a7ccbfe9d968bb65248d6eb61d0514cd2dcd32271c6be7035c33954be6595236","category":"nl_quality","rule_id":"R07","file":".github/plugins/azure-sdk-java/skills/azure-communication-callautomation-java/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Code examples import CommunicationUserIdentifier/PhoneNumberIdentifier from com.azure.communication.common but the skill never links azure-communication-common-java.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:50c5a2ee1077576544eacb34166699abf6e6db2b9015f29cc483118a02d79c98","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-messaging-webpubsub-java/SKILL.md","line":306,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 306: 'Set appropriate token expiration for security' does not specify a recommended value or range.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:eef658a21b4038f4fd624fd2960c12716c1cc1271ca97ee1d96bb1744cb91bcc","category":"nl_quality","rule_id":"R07","file":".github/plugins/azure-sdk-java/skills/azure-communication-chat-java/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"Client Creation section uses CommunicationTokenCredential, documented in azure-communication-common-java, which is never referenced.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:68f2e1066828c91099abddbdebb3590a647417bc0baa2c46511fcdf65982e7e5","category":"nl_quality","rule_id":"R05","file":".github/plugins/azure-sdk-java/skills/azure-appconfiguration-java/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"Body (lines 12-487) is approximately 476 lines, within the 400-500 line penalty band.","penalty":-5,"pattern":"","description":"Body length (476 lines) in the 400-500 penalty band.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:18b807ebb11e484cdc27bc91f9be9a32f1db215eae80253a764092f7f1424cfa","category":"nl_quality","rule_id":"R07","file":".github/plugins/azure-sdk-java/skills/azure-security-keyvault-keys-java/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-3,"pattern":"","description":"No mention/link to sibling azure-security-keyvault-secrets-java skill despite both operating on the same vault.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:2afe228314ea9a5de087bfcd1242ec67ced97ac24fcb9cfa4f943ff32f81ff68","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-monitor-opentelemetry-exporter-java/SKILL.md","line":273,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 273: 'Add relevant attributes — Include contextual data for debugging' does not specify which attributes are relevant.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:2cbb368ea5935abcec7a2eb252e95da2ba2756365c7fb5884aef682b9ccd0e55","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-ai-agents-persistent-java/SKILL.md","line":130,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 130: 'Poll with appropriate delays' pairs a vague qualifier with a concrete number in the same sentence; the heading itself remains vague.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:b3c2cab06eb172b0ead2fa3e63fc3674a8c485eaa85bfc8a132471c95833770b","category":"nl_quality","rule_id":"R01","file":".github/plugins/azure-sdk-java/skills/azure-compute-batch-java/SKILL.md","line":380,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"Line 380: 'Handle LRO properly — Pool resize, delete operations are long-running' uses 'properly' instead of describing the expected pattern.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:7e9e6a5ebfa50964b0d1eca91a7ba8703d362a2e3fafed2fc9e7f6f9f301b795","category":"nl_quality","rule_id":"R04","file":".github/skills/debugview/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter description is roughly 775 characters (500-800 range).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:d3d67973bde7997be49515097b1209adea7be448996953c8e55864cf5e4ce2b2","category":"nl_quality","rule_id":"R06","file":".github/skills/cloud-solution-architect/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Complex architectural concepts (44 patterns, WAF pillars, mission-critical design) are covered entirely with reference tables; the only code-shaped block is a generic ADR template, not an implementation example.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:36672736bc23e52b15d8c55b14fcb7657e37c7f20bacd7b20c7c5f79c7534d56","category":"nl_quality","rule_id":"R01","file":".github/skills/cloud-solution-architect/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"1 vague quantifier occurrence ('relevant').","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:a913148cce9d944c2b63f7cb601173bba95e5074e78324686c2e552fdf7a5a91","category":"nl_quality","rule_id":"R05","file":".github/skills/skill-creator/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"SKILL.md body is ~1310 lines, well over the 500-line threshold.","penalty":-10,"pattern":"","description":"Body is 1310 lines — over 2.5x the skill's own mandated 500-line ceiling.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:261118cba3e255c4dd9c950658ff0c3a27beefb337924709f73149264dd72a4f","category":"nl_quality","rule_id":"R01","file":".github/skills/skill-creator/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"15 vague-quantifier occurrences found (appropriate x5, as needed x2, several, significantly, sufficient, typically, etc.); capped at -20.","penalty":-20,"pattern":"","description":"Heavy vague-quantifier usage, capped at -20.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:08cb255ba33fd3ff1a57848fca8b5d59055b0fcbeb1f49d843104483ab2ecf8d","category":"nl_quality","rule_id":"R04","file":".github/skills/applicationinsights-web-ts/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter description is roughly 524 characters (500-800 range).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:5bd40ce1863d83a1c1526137213609e2e954dd81fb8c17d7290e22863289faa6","category":"nl_quality","rule_id":"R05","file":".github/skills/applicationinsights-web-ts/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"SKILL.md body is 457 lines (400-500 range).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:5ffeaeb62e22b56404b358b348eabff9c3bbee069c014256d541e629754eec35","category":"nl_quality","rule_id":"R04","file":".github/skills/kql/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter description is roughly 797 characters (500-800 range, just under the -10 threshold).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:6c4b5d55328d70a007169a643522254e7dd931a6d8e6ce6ed9b18d662fd6d7dc","category":"nl_quality","rule_id":"R05","file":".github/skills/kql/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-5,"pattern":"","description":"SKILL.md body is 439 lines (400-500 range).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:7fa6d5949a11285d754a074ed9f9c2429d96b11aae2a73af77a6c9276caef665","category":"nl_quality","rule_id":"R05","file":".github/skills/copilot-sdk/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"SKILL.md body is ~901 lines, well over the 500-line threshold.","penalty":-10,"pattern":"","description":"Body is 901 lines, far over the 500-line guidance.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:0a06ddc30d2c140383f1aa4ccedb781f8a373b61d746d7ad69d82d49e275854a","category":"nl_quality","rule_id":"R01","file":".github/skills/copilot-sdk/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"1 vague quantifier occurrence ('effectively').","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:948a3ea4227f94ef180e18f3b34db426bd0abcf2ff701a26987b9f9e57804158","category":"nl_quality","rule_id":"R06","file":".github/skills/mcp-builder/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Core 'Implement Tools' section is described narratively with zero inline code snippets; every concrete example lives in a separate ./reference/*.md file.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:961bbada0f73a0a6bb78b6df10dff7b37d63a40568321df57f3137c9e0b0ee24","category":"nl_quality","rule_id":"R01","file":".github/skills/mcp-builder/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-10,"pattern":"","description":"5 vague-quantifier occurrences (relevant x2, as needed x2, effectively).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:f1cd580fa22a3bd866c3e9e476bd0b7999310750b4676290599e645a856c5946","category":"nl_quality","rule_id":"R04","file":".github/skills/entra-agent-id/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter description is roughly 715 characters (500-800 range).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:22304c83818e7c485eb7e5e6711735551697ffbd508e39c1ad43480cb6d140e5","category":"nl_quality","rule_id":"R01","file":".github/skills/microsoft-docs/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"1 vague quantifier occurrence ('relevant').","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:e72c78d96d251ea26ffa42e5910be933fbfa4d5dd64873fc87ad5f1d544d79a4","category":"nl_quality","rule_id":"R04","file":".github/skills/frontend-design-review/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-5,"pattern":"","description":"Frontmatter description is roughly 595 characters (500-800 range).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:45ad12093dc6f39e9cd6ec18c8f342e83dde4e56a4a2fdd6fe74583ba1e24e56","category":"nl_quality","rule_id":"R01","file":".github/skills/frontend-design-review/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-2,"pattern":"","description":"1 vague quantifier occurrence ('context-appropriate').","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:01d99ff0b3221364af5e03f4dee8eec7b2fb8dd42b36cfdae3637810d2f46775","category":"nl_quality","rule_id":"R01","file":".github/skills/github-issue-creator/SKILL.md","line":null,"severity":"low","confidence":"high","evidence":"","penalty":-4,"pattern":"","description":"2 vague quantifier occurrences ('relevant' x2).","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:c1d10be90e15aa38626be28f77534d6ddde587178a2fda3614002d238036086f","category":"cross_component","rule_id":"CC-orphan-component","file":".github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":null,"pattern":"","description":"Overlapping coverage with sibling azure-cosmos-db-py skill for the same azure-cosmos package; no scope note disambiguates the two for routing.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:b7f176f5653fff43063a2cc4781577465f5dd079c551bc6f29155b190e186912","category":"cross_component","rule_id":"CC-orphan-component","file":".github/plugins/azure-sdk-java/skills/azure-security-keyvault-secrets-java/SKILL.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":null,"pattern":"","description":"No cross-link to sibling azure-security-keyvault-keys-java skill despite both operating on the same Key Vault resource.","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:46Z","audit_run_id":"30983052751","repo":"microsoft/skills","commit_sha":"1f28ae4c5e5edc2cbe10b3756a20524fc92cee07","fingerprint":"sha256:31d9c137427e0086fb8c3e2e3c64693b8e2454a4ad742e3cc84d617bac9ababd","category":"cross_component","rule_id":"CC-terminology-drift","file":".github/agents/frontend.agent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":null,"pattern":"","description":"This agent and its 5 siblings (backend/planner/presenter/scaffolder/infrastructure) plus the 3 deep-wiki agents all independently omit blocks and model declaration, indicating a shared template gap rather than isolated defects.","false_positive":false,"suggested_fix":""} {"event":"finding","timestamp":"2026-08-05T07:03:41Z","audit_run_id":"30983032406","repo":"Shubhamsaboo/awesome-llm-apps","commit_sha":"779e9f9bcf87fa8cd95870a438b70b84e47d3173","fingerprint":"sha256:881283f9ce3d21011a260342b383b03f4c27455c5f0c9caed189fd5474a597b8","category":"bug","rule_id":"BUG-broken-reference","file":"generative_ui_agents/ai-mcp-app-builder/apps/mcp-use-server/.agent/skills/chatgpt-app-builder/SKILL.md","line":4,"severity":"medium","confidence":"high","evidence":"ls .agent/skills/ shows chatgpt-app-builder, mcp-apps-builder, mcp-builder — no mcp-app-builder directory exists anywhere in the repo","penalty":null,"pattern":"deprecated-skill-pointer","description":"Deprecation notice points to a replacement skill named mcp-app-builder (singular) that does not exist; the real replacement is mcp-apps-builder (plural)","false_positive":false,"suggested_fix":"Update the deprecation notice to reference mcp-apps-builder (plural) to match the actual directory name"} {"event":"finding","timestamp":"2026-08-05T07:03:41Z","audit_run_id":"30983032406","repo":"Shubhamsaboo/awesome-llm-apps","commit_sha":"779e9f9bcf87fa8cd95870a438b70b84e47d3173","fingerprint":"sha256:f34ed29dd9fc02122cfc33ed25712512f0e1c5837159f06f8d06fb0e745134bb","category":"bug","rule_id":"BUG-broken-reference","file":"generative_ui_agents/ai-mcp-app-builder/apps/mcp-use-server/.agent/skills/mcp-builder/SKILL.md","line":4,"severity":"medium","confidence":"high","evidence":"ls .agent/skills/ shows chatgpt-app-builder, mcp-apps-builder, mcp-builder — no mcp-app-builder directory exists anywhere in the repo","penalty":null,"pattern":"deprecated-skill-pointer","description":"Deprecation notice points to a replacement skill named mcp-app-builder (singular) that does not exist; the real replacement is mcp-apps-builder (plural)","false_positive":false,"suggested_fix":"Update the deprecation notice to reference mcp-apps-builder (plural) to match the actual directory name"} {"event":"finding","timestamp":"2026-08-05T07:03:41Z","audit_run_id":"30983032406","repo":"Shubhamsaboo/awesome-llm-apps","commit_sha":"779e9f9bcf87fa8cd95870a438b70b84e47d3173","fingerprint":"sha256:7c0cdbbd5a1e0c51cbe02b597cb8a4a72adc993246f18766b894fef8ea83c1c9","category":"security","rule_id":"SEC-curl-pipe-sh","file":"generative_ui_agents/generative-ui-starter-project/Dockerfile","line":31,"severity":"critical","confidence":"high","evidence":"curl -fsSL https://deb.nodesource.com/setup_20.x | bash - executed with no checksum/signature verification","penalty":null,"pattern":"curl-pipe-sh","description":"Remote NodeSource setup script fetched over HTTPS and piped directly into bash","false_positive":false,"suggested_fix":"Download the script, verify its checksum/signature, then execute, or use a pinned apt/deb package instead"} diff --git a/auditor/logs/events.jsonl b/auditor/logs/events.jsonl index b0e4f524f..0879a39c9 100644 --- a/auditor/logs/events.jsonl +++ b/auditor/logs/events.jsonl @@ -3761,9 +3761,14 @@ {"timestamp":"2026-08-05T02:07:56Z","workflow":"discover","event":"search_complete","run_id":"30968348211","run_number":39,"data":{"candidates":161,"new":57,"worthy":6,"oversized":18}} {"timestamp":"2026-08-05T04:36:41Z","workflow":"classify","event":"classifications_emitted","run_id":"30975581065","run_number":107,"data":{"classifications":0,"invalid":0,"no_dissent":true}} {"timestamp":"2026-08-05T05:14:52Z","workflow":"track","event":"status_check","run_id":"30977076136","run_number":653,"data":{"contributed":57,"tracked":37,"case_study_ready":42,"rule_adopted":2}} +{"timestamp":"2026-08-05T07:18:46Z","workflow":"audit","event":"scorer_drift_check","run_id":"30983052751","run_number":748,"data":{"repo":"microsoft/skills","sidecar":"auditor/audits/microsoft-skills.findings.jsonl","drifts":0,"exit_code":0,"total_findings":111,"missing_confidence":0}} +{"timestamp":"2026-08-05T07:18:49Z","workflow":"audit","event":"findings_aggregated","run_id":"30983052751","run_number":748,"data":{"repo":"microsoft/skills","findings":111,"invalid_lines":0,"self_false_positives":0}} +{"timestamp":"2026-08-05T07:18:49Z","workflow":"audit","event":"repo_report_rendered","run_id":"30983052751","run_number":748,"data":{"repo":"microsoft/skills","html":"auditor/reports/microsoft-skills.html"}} +{"timestamp":"2026-08-05T07:18:50Z","workflow":"audit","event":"audit_complete","run_id":"30983052751","run_number":748,"data":{"repo":"microsoft/skills","score":94,"artifacts":226,"strategy":"progressive"}} {"timestamp":"2026-08-05T07:03:41Z","workflow":"audit","event":"scorer_drift_check","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","sidecar":"auditor/audits/Shubhamsaboo-awesome-llm-apps.findings.jsonl","drifts":0,"exit_code":0,"total_findings":23,"missing_confidence":0}} {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"findings_aggregated","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","findings":23,"invalid_lines":0,"self_false_positives":0}} {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"repo_report_rendered","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","html":"auditor/reports/Shubhamsaboo-awesome-llm-apps.html"}} {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"audit_complete","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","score":96,"artifacts":11,"strategy":"single"}} {"timestamp":"2026-08-05T07:03:59Z","workflow":"audit","event":"manual_disclosure_pending","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","queue_path":"auditor/disclosures-pending/Shubhamsaboo-awesome-llm-apps.md","gh_error":"GraphQL: Resource not accessible by integration (createIssue)"}} +{"timestamp":"2026-08-05T07:20:34Z","workflow":"audit","event":"manual_disclosure_pending","run_id":"30983052751","run_number":748,"data":{"repo":"microsoft/skills","queue_path":"auditor/disclosures-pending/microsoft-skills.md","gh_error":"GraphQL: Resource not accessible by integration (createIssue)"}} {"timestamp":"2026-08-05T09:09:12Z","workflow":"track","event":"status_check","run_id":"30991292365","run_number":654,"data":{"contributed":57,"tracked":37,"case_study_ready":42,"rule_adopted":2}} diff --git a/auditor/registry/repos.json b/auditor/registry/repos.json index 83f8cf0fb..ee9125817 100644 --- a/auditor/registry/repos.json +++ b/auditor/registry/repos.json @@ -9756,10 +9756,13 @@ "stars": 2861, "artifacts": 226, "description": "Skills, MCP servers, Custom Agents, Agents.md for SDKs to ground Coding Agents", - "status": "discovered", - "score": null, + "status": "audited", + "score": 94, "audit_issue": 761, - "prs": [] + "prs": [], + "strategy": "progressive", + "security": "BLOCKED", + "commit_sha_at_audit": "1f28ae4c5e5edc2cbe10b3756a20524fc92cee07" }, "phuryn/pm-skills": { "discovered": "2026-08-05T02:07:37Z", diff --git a/auditor/reports/microsoft-skills.html b/auditor/reports/microsoft-skills.html new file mode 100644 index 000000000..0e5aae853 --- /dev/null +++ b/auditor/reports/microsoft-skills.html @@ -0,0 +1,104 @@ + + + + + NLPM Report — microsoft/skills + + + +
+
+

NLPM Report

+

microsoft/skills · 2026-08-05T07:18:49Z

+
+
+
—
+
+
+
+ + + +
+
+

Per-file scores

+
+ + + + + + + + + + +
PathTypeScoreFindings
+
+
+ +
+

Score trend

+

Average score per snapshot, oldest → newest.

+
+
+ +
+

Cross-component references

+

Artifacts and their references. Broken references in red.

+
+
+ +
+

Vocabulary noun-verb map

+

+ Verbs (rounded rectangles), nouns (circles). Two scopes shown as compound containers. + Cross-scope homonyms have a doubled outline. Deferred-pending-warrant terms appear dashed. + Click a node for details. +

+
+ + + +
+
+ +
+ +
+

Vocabulary drift candidates

+

Registry-free advisory: clusters of likely-synonymous terms detected by `vocab-drift-scanner`.

+
+
+ +
+

Findings

+

All violations grouped by rule. Severity badges sort within each rule.

+
+
+
+ +
+

+ Generated by /nlpm:report. + Graph visualizations powered by AntV G6 (vendored at ./vendor/g6.min.js). + Open this file directly via file:// — no server needed. +

+
+ + + + + + diff --git a/auditor/reports/microsoft-skills.json b/auditor/reports/microsoft-skills.json new file mode 100644 index 000000000..e3fe2532d --- /dev/null +++ b/auditor/reports/microsoft-skills.json @@ -0,0 +1,2068 @@ +{ + "project": "microsoft/skills", + "score_threshold": 70, + "r51_enabled": false, + "summary": { + "total_files": 68, + "average_score": 94, + "pass_count": 0, + "fail_count": 0 + }, + "files": [ + { + "path": ".github/agents/backend.agent.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R09", + "severity": "low", + "line": null, + "message": "No blocks anywhere in the file." + }, + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "Frontmatter has name/description/tools only; no model field." + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "Declared 'search' tool has no corresponding search-related instruction anywhere in the body." + }, + { + "rule": "R12", + "severity": "low", + "line": null, + "message": "No section defines the format of the agent's own output/response; body is patterns/router examples/file tables only." + } + ] + }, + { + "path": ".github/agents/frontend.agent.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R09", + "severity": "low", + "line": null, + "message": "No blocks anywhere in the file." + }, + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "Frontmatter has name/description/tools only; no model field." + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "Declared 'search' tool has no corresponding search-related instruction anywhere in the body." + }, + { + "rule": "R12", + "severity": "low", + "line": null, + "message": "No section defines the format of the agent's own output/response; body is patterns/rules/file-location tables only." + }, + { + "rule": "CC-terminology-drift", + "severity": "low", + "line": null, + "message": "This agent and its 5 siblings (backend/planner/presenter/scaffolder/infrastructure) plus the 3 deep-wiki agents all independently omit blocks and model declaration, indicating a shared template gap rather than isolated defects." + } + ] + }, + { + "path": ".github/agents/infrastructure.agent.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R09", + "severity": "low", + "line": null, + "message": "No blocks anywhere in the file." + }, + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "Frontmatter has name/description/tools only; no model field." + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "Declared 'search' tool has no corresponding search-related instruction anywhere in the body." + }, + { + "rule": "R12", + "severity": "low", + "line": null, + "message": "No section defines the format of the agent's own output/response; body is deployment workflows/tables only." + } + ] + }, + { + "path": ".github/agents/planner.agent.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R09", + "severity": "low", + "line": null, + "message": "No blocks anywhere in the file." + }, + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "Frontmatter has name/description/tools/handoffs only; no model field." + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "Declared 'web' tool but body never references external web content, URLs, or internet search — all references are to local files." + }, + { + "rule": "R01", + "severity": "low", + "line": 30, + "message": "2 vague quantifier hits: 'relevant files' (line30), 'appropriate specialist agent' (line89)." + } + ] + }, + { + "path": ".github/agents/presenter.agent.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R09", + "severity": "low", + "line": null, + "message": "No blocks anywhere in the file." + }, + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "Frontmatter has name/description/tools only; no model field." + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "Declared 'execute' tool but file contains no Commands/bash section at all, unlike sibling agents." + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "Declared 'search' tool has no corresponding search-related instruction in the body." + }, + { + "rule": "R12", + "severity": "low", + "line": null, + "message": "No section defines the format of the agent's own output/response." + } + ] + }, + { + "path": ".github/agents/scaffolder.agent.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R09", + "severity": "low", + "line": null, + "message": "No blocks anywhere in the file." + }, + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "Frontmatter has name/description/tools only; no model field." + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "Declared 'search' tool has no corresponding search-related instruction anywhere in the body." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-dotnet/skills/azure-mgmt-arizeaiobservabilityeval-dotnet/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 201, + "message": "Line 201: 'Close clients properly' uses vague quantifier 'properly' instead of a concrete instruction." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-ai-agents-persistent-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 130, + "message": "Line 130: 'Poll with appropriate delays' pairs a vague qualifier with a concrete number in the same sentence; the heading itself remains vague." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-ai-contentsafety-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 287, + "message": "Line 287: 'Cache blocklist results where appropriate' does not specify when caching is appropriate." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-ai-voicelive-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 221, + "message": "Line 221: 'Close sessions properly when conversation ends' uses vague qualifier 'properly'." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-appconfiguration-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R05", + "severity": "low", + "line": null, + "message": "Body length (476 lines) in the 400-500 penalty band." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-communication-callautomation-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R07", + "severity": "low", + "line": null, + "message": "Code examples import CommunicationUserIdentifier/PhoneNumberIdentifier from com.azure.communication.common but the skill never links azure-communication-common-java." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-communication-callingserver-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R04", + "severity": "low", + "line": null, + "message": "Frontmatter description gives only one concrete trigger condition ('maintaining legacy code') rather than a list of specific invocation phrases like sibling skills use." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-communication-chat-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R07", + "severity": "low", + "line": null, + "message": "Client Creation section uses CommunicationTokenCredential, documented in azure-communication-common-java, which is never referenced." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-communication-common-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 173, + "message": "Line 173: '// Parse raw ID to appropriate type' is a code comment using 'appropriate' instead of naming concrete types." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-compute-batch-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 380, + "message": "Line 380: 'Handle LRO properly — Pool resize, delete operations are long-running' uses 'properly' instead of describing the expected pattern." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-messaging-webpubsub-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 306, + "message": "Line 306: 'Set appropriate token expiration for security' does not specify a recommended value or range." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-monitor-ingestion-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "BUG-broken-reference", + "severity": "medium", + "line": 227, + "message": "The 'Querying Uploaded Logs' section links to a sibling skill using a relative path that does not match any real directory." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-monitor-opentelemetry-exporter-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 273, + "message": "Line 273: 'Add relevant attributes — Include contextual data for debugging' does not specify which attributes are relevant." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R05", + "severity": "low", + "line": null, + "message": "Body length (422 lines) in the 400-500 penalty band." + }, + { + "rule": "R01", + "severity": "low", + "line": 61, + "message": "Line 61: 'TokenCredential with appropriate permissions' does not name the required permissions." + }, + { + "rule": "R01", + "severity": "low", + "line": 417, + "message": "Line 417: 'Set appropriate timeouts' is vague about the actual timeout values." + }, + { + "rule": "R01", + "severity": "low", + "line": 421, + "message": "Line 421: 'Cache results ... cache when appropriate' does not specify caching criteria." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-security-keyvault-keys-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R07", + "severity": "low", + "line": null, + "message": "No mention/link to sibling azure-security-keyvault-secrets-java skill despite both operating on the same vault." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-java/skills/azure-security-keyvault-secrets-java/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R07", + "severity": "low", + "line": null, + "message": "No mention/link to sibling azure-security-keyvault-keys-java skill despite both operating on the same vault." + }, + { + "rule": "CC-orphan-component", + "severity": "low", + "line": null, + "message": "No cross-link to sibling azure-security-keyvault-keys-java skill despite both operating on the same Key Vault resource." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-ai-contentsafety-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "Best Practices #4 says 'severity thresholds appropriate for your use case' without concrete guidance." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-ai-language-conversations-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "System Prompt section says 'Handle exceptions properly' without specifying which exceptions or how." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-ai-projects-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "BUG-broken-reference", + "severity": "high", + "line": null, + "message": "The description directs readers to a sibling skill 'azure-ai-agents-python' that does not exist in the repo." + }, + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "Code sample comment 'Add tools as needed' is an unspecific qualifier." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "Storage Requirements says 'SAS tokens with appropriate permissions' without full specification." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-ai-voicelive-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R04", + "severity": "low", + "line": null, + "message": "Description is 517 characters, in the 500-800 char penalty band." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-cosmos-db-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R07", + "severity": "low", + "line": null, + "message": "No cross-reference/scope note distinguishing this skill from sibling azure-cosmos-py, which covers the same package with overlapping trigger phrases." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "BUG-broken-reference", + "severity": "high", + "line": null, + "message": "SKILL.md's Reference Files table links to scripts/setup_cosmos_container.py, but no scripts/ directory exists in this skill folder." + }, + { + "rule": "R07", + "severity": "low", + "line": null, + "message": "No scope note distinguishing this skill from sibling azure-cosmos-db-py, which covers the same azure-cosmos package with overlapping trigger phrases." + }, + { + "rule": "CC-orphan-component", + "severity": "low", + "line": null, + "message": "Overlapping coverage with sibling azure-cosmos-db-py skill for the same azure-cosmos package; no scope note disambiguates the two for routing." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-eventgrid-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 195, + "message": "Line 195: 'Set appropriate event types for routing and filtering' uses vague quantifier 'appropriate'." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-eventhub-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 252, + "message": "Line 252: 'Set appropriate consumer groups for different applications' uses vague quantifier 'appropriate'." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-identity-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R05", + "severity": "low", + "line": null, + "message": "Body exceeds 500 lines (533 lines of content)." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-keyvault-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "Best Practices #9 says 'Cache secrets appropriately' without concrete guidance on TTL or strategy." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "Best Practices #4 says 'appropriate scopes' without specifying which scopes for which scenario." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-mgmt-botservice-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "Best Practices #9 says 'Configure proper CORS' without specifying the actual policy." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-mgmt-fabric-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "Best Practices #5 says 'scale up as needed' without concrete triggers." + }, + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "Best Practices #8 says 'Handle LRO properly' without specifying the actual handling steps." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-monitor-ingestion-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 229, + "message": "Line 229: 'SDK handles batching, but send reasonable chunks' uses vague quantifier 'reasonable'." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-monitor-opentelemetry-exporter-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 238, + "message": "Line 238: 'Set export intervals appropriate for your workload' uses vague quantifier 'appropriate'." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-monitor-query-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "Best Practices #6 says 'appropriate granularity' without concrete guidance." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-search-documents-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R05", + "severity": "low", + "line": null, + "message": "Body exceeds 500 lines (543 lines), driven by a duplicated second section repeating earlier content." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-speech-to-text-rest-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "Error-handling example's docstring says 'Transcribe with proper error handling' — an unspecific qualifier inside a code comment." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-storage-blob-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 257, + "message": "Line 257: 'Set appropriate content types for web-served blobs' uses vague quantifier 'appropriate'." + } + ] + }, + { + "path": ".github/plugins/azure-sdk-python/skills/azure-storage-queue-py/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 234, + "message": "Line 234: 'Set appropriate visibility timeout based on processing time' uses vague quantifier 'appropriate'." + } + ] + }, + { + "path": ".github/plugins/azure-skills/hooks/scripts/track-telemetry.sh", + "type": "hook-config", + "score": null, + "findings": [ + { + "rule": "SEC-telemetry-network-call", + "severity": "low", + "line": 360, + "message": "Every tracked tool/skill invocation shells out via npx to an unpinned MCP package and publishes client/session/skill/tool metadata to a remote endpoint; opt-out via AZURE_MCP_COLLECT_TELEMETRY=false but undocumented elsewhere." + } + ] + }, + { + "path": ".github/plugins/azure-skills/skills/azure-quotas/scripts/check-quota.sh", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "SEC-shell-to-python-injection", + "severity": "medium", + "line": 71, + "message": "$USAGES_JSON (az CLI output) is interpolated directly into json.loads('''$USAGES_JSON''') without escaping." + } + ] + }, + { + "path": ".github/plugins/azure-skills/skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "SEC-shell-to-python-injection", + "severity": "medium", + "line": 104, + "message": "MODEL_NAME/MODEL_VERSION and API JSON responses are interpolated directly into an embedded Python source string executed via python3 -c without escaping." + } + ] + }, + { + "path": ".github/plugins/azure-skills/skills/python-appservice-deploy/scripts/retry-az-create.sh", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "SEC-eval-interpolated-vars", + "severity": "critical", + "line": 36, + "message": "eval executes caller-supplied $SHOW_CMD/$CREATE_CMD strings passed as $1/$2; any unsanitized data reaching these args gets full shell execution." + } + ] + }, + { + "path": ".github/plugins/deep-wiki/agents/wiki-architect.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R09", + "severity": "low", + "line": null, + "message": "Description has zero blocks." + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "No tools/allowed-tools field in frontmatter (only name/description/model present)." + } + ] + }, + { + "path": ".github/plugins/deep-wiki/agents/wiki-researcher.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R09", + "severity": "low", + "line": null, + "message": "Description has zero blocks." + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "No tools/allowed-tools field in frontmatter (only name/description/model present)." + }, + { + "rule": "R01", + "severity": "low", + "line": 38, + "message": "1 vague quantifier hit: 'relevant files' (line 38)." + } + ] + }, + { + "path": ".github/plugins/deep-wiki/agents/wiki-writer.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R09", + "severity": "low", + "line": null, + "message": "Description has zero blocks." + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "No tools/allowed-tools field in frontmatter (only name/description/model present)." + }, + { + "rule": "R01", + "severity": "low", + "line": 38, + "message": "3 vague quantifier hits: 'relevant file' (line38), 'relevant files' (line47), 'as appropriate' (line54)." + } + ] + }, + { + "path": ".github/plugins/deep-wiki/commands/agents.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R18", + "severity": "low", + "line": null, + "message": "Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS." + } + ] + }, + { + "path": ".github/plugins/deep-wiki/commands/ask.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R15", + "severity": "low", + "line": null, + "message": "Command's entire purpose is answering '$ARGUMENTS' as a question, but there is no instruction for what to do if no question is supplied." + }, + { + "rule": "R18", + "severity": "low", + "line": null, + "message": "Frontmatter has only a description field; no argument-hint despite the command being fully argument-driven." + }, + { + "rule": "R01", + "severity": "low", + "line": 27, + "message": "2 vague quantifier hits: 'relevant to the question' (line27), '[Relevant snippet...]' (line48)." + } + ] + }, + { + "path": ".github/plugins/deep-wiki/commands/build.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R18", + "severity": "low", + "line": null, + "message": "Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS." + }, + { + "rule": "R17", + "severity": "low", + "line": null, + "message": "Prerequisites section only states wiki markdown 'should already exist' with no actual check-and-respond instruction, unlike sibling deploy.md." + } + ] + }, + { + "path": ".github/plugins/deep-wiki/commands/changelog.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R18", + "severity": "low", + "line": null, + "message": "Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS." + }, + { + "rule": "R17", + "severity": "low", + "line": null, + "message": "No instruction for the edge case of an empty/shallow git history — process assumes commits exist." + } + ] + }, + { + "path": ".github/plugins/deep-wiki/commands/deploy.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R18", + "severity": "low", + "line": null, + "message": "Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS." + } + ] + }, + { + "path": ".github/plugins/deep-wiki/commands/generate.md", + "type": "?", + "score": null, + "findings": [ + { + "rule": "R18", + "severity": "low", + "line": null, + "message": "Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS." + } + ] + }, + { + "path": ".github/skills/applicationinsights-web-ts/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R04", + "severity": "low", + "line": null, + "message": "Frontmatter description is roughly 524 characters (500-800 range)." + }, + { + "rule": "R05", + "severity": "low", + "line": null, + "message": "SKILL.md body is 457 lines (400-500 range)." + } + ] + }, + { + "path": ".github/skills/cloud-solution-architect/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R06", + "severity": "low", + "line": null, + "message": "Complex architectural concepts (44 patterns, WAF pillars, mission-critical design) are covered entirely with reference tables; the only code-shaped block is a generic ADR template, not an implementation example." + }, + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "1 vague quantifier occurrence ('relevant')." + } + ] + }, + { + "path": ".github/skills/copilot-sdk/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R05", + "severity": "low", + "line": null, + "message": "Body is 901 lines, far over the 500-line guidance." + }, + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "1 vague quantifier occurrence ('effectively')." + } + ] + }, + { + "path": ".github/skills/debugview/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R04", + "severity": "low", + "line": null, + "message": "Frontmatter description is roughly 775 characters (500-800 range)." + } + ] + }, + { + "path": ".github/skills/entra-agent-id/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R04", + "severity": "low", + "line": null, + "message": "Frontmatter description is roughly 715 characters (500-800 range)." + } + ] + }, + { + "path": ".github/skills/frontend-design-review/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R04", + "severity": "low", + "line": null, + "message": "Frontmatter description is roughly 595 characters (500-800 range)." + }, + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "1 vague quantifier occurrence ('context-appropriate')." + } + ] + }, + { + "path": ".github/skills/github-issue-creator/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "2 vague quantifier occurrences ('relevant' x2)." + } + ] + }, + { + "path": ".github/skills/kql/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R04", + "severity": "low", + "line": null, + "message": "Frontmatter description is roughly 797 characters (500-800 range, just under the -10 threshold)." + }, + { + "rule": "R05", + "severity": "low", + "line": null, + "message": "SKILL.md body is 439 lines (400-500 range)." + } + ] + }, + { + "path": ".github/skills/mcp-builder/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R06", + "severity": "low", + "line": null, + "message": "Core 'Implement Tools' section is described narratively with zero inline code snippets; every concrete example lives in a separate ./reference/*.md file." + }, + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "5 vague-quantifier occurrences (relevant x2, as needed x2, effectively)." + } + ] + }, + { + "path": ".github/skills/microsoft-docs/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "1 vague quantifier occurrence ('relevant')." + } + ] + }, + { + "path": ".github/skills/skill-creator/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R05", + "severity": "low", + "line": null, + "message": "Body is 1310 lines — over 2.5x the skill's own mandated 500-line ceiling." + }, + { + "rule": "R01", + "severity": "low", + "line": null, + "message": "Heavy vague-quantifier usage, capped at -20." + } + ] + }, + { + "path": ".vscode/mcp.json", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-unpinned-mcp-server", + "severity": "low", + "line": 13, + "message": "Multiple MCP servers (chrome-devtools-mcp@latest, @upstash/context7-mcp@latest, @playwright/mcp@latest) are launched unpinned via npx." + } + ] + } + ], + "history": [ + { + "timestamp": "2026-08-05T07:16:03Z", + "average_score": 94, + "kind": "initial_audit" + } + ], + "cross_component": { + "nodes": [], + "edges": [] + }, + "vocabulary": null, + "vocab_drift": { + "candidates": [] + }, + "findings": [ + { + "rule": "BUG-broken-reference", + "severity": "high", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md", + "line": null, + "message": "SKILL.md's Reference Files table links to scripts/setup_cosmos_container.py, but no scripts/ directory exists in this skill folder. — ls on azure-cosmos-py/ shows only SKILL.md and references/; no scripts/ dir exists, yet the Reference Files table links to scripts/setup_cosmos_container.py" + }, + { + "rule": "BUG-broken-reference", + "severity": "high", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-ai-projects-py/SKILL.md", + "line": null, + "message": "The description directs readers to a sibling skill 'azure-ai-agents-python' that does not exist in the repo. — frontmatter description references an 'azure-ai-agents-python' skill; find/grep across target-repo shows no such directory anywhere" + }, + { + "rule": "BUG-broken-reference", + "severity": "medium", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-monitor-ingestion-java/SKILL.md", + "line": 227, + "message": "The 'Querying Uploaded Logs' section links to a sibling skill using a relative path that does not match any real directory. — Line 227 links to '../query/SKILL.md' which resolves to skills/query/SKILL.md; the actual directory is skills/azure-monitor-query-java/" + }, + { + "rule": "SEC-eval-interpolated-vars", + "severity": "critical", + "confidence": "medium", + "file": ".github/plugins/azure-skills/skills/python-appservice-deploy/scripts/retry-az-create.sh", + "line": 36, + "message": "eval executes caller-supplied $SHOW_CMD/$CREATE_CMD strings passed as $1/$2; any unsanitized data reaching these args gets full shell execution." + }, + { + "rule": "SEC-shell-to-python-injection", + "severity": "medium", + "confidence": "medium", + "file": ".github/plugins/azure-skills/skills/microsoft-foundry/models/deploy-model/capacity/scripts/discover_and_rank.sh", + "line": 104, + "message": "MODEL_NAME/MODEL_VERSION and API JSON responses are interpolated directly into an embedded Python source string executed via python3 -c without escaping." + }, + { + "rule": "SEC-shell-to-python-injection", + "severity": "medium", + "confidence": "medium", + "file": ".github/plugins/azure-skills/skills/azure-quotas/scripts/check-quota.sh", + "line": 71, + "message": "$USAGES_JSON (az CLI output) is interpolated directly into json.loads('''$USAGES_JSON''') without escaping." + }, + { + "rule": "SEC-telemetry-network-call", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/azure-skills/hooks/scripts/track-telemetry.sh", + "line": 360, + "message": "Every tracked tool/skill invocation shells out via npx to an unpinned MCP package and publishes client/session/skill/tool metadata to a remote endpoint; opt-out via AZURE_MCP_COLLECT_TELEMETRY=false but undocumented elsewhere." + }, + { + "rule": "SEC-unpinned-mcp-server", + "severity": "low", + "confidence": "medium", + "file": ".vscode/mcp.json", + "line": 13, + "message": "Multiple MCP servers (chrome-devtools-mcp@latest, @upstash/context7-mcp@latest, @playwright/mcp@latest) are launched unpinned via npx." + }, + { + "rule": "R09", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/agents/wiki-researcher.md", + "line": null, + "message": "Description has zero blocks." + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/agents/wiki-researcher.md", + "line": null, + "message": "No tools/allowed-tools field in frontmatter (only name/description/model present)." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/agents/wiki-researcher.md", + "line": 38, + "message": "1 vague quantifier hit: 'relevant files' (line 38)." + }, + { + "rule": "R09", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/agents/wiki-architect.md", + "line": null, + "message": "Description has zero blocks." + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/agents/wiki-architect.md", + "line": null, + "message": "No tools/allowed-tools field in frontmatter (only name/description/model present)." + }, + { + "rule": "R09", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/agents/wiki-writer.md", + "line": null, + "message": "Description has zero blocks." + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/agents/wiki-writer.md", + "line": null, + "message": "No tools/allowed-tools field in frontmatter (only name/description/model present)." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/agents/wiki-writer.md", + "line": 38, + "message": "3 vague quantifier hits: 'relevant file' (line38), 'relevant files' (line47), 'as appropriate' (line54)." + }, + { + "rule": "R09", + "severity": "low", + "confidence": "high", + "file": ".github/agents/frontend.agent.md", + "line": null, + "message": "No blocks anywhere in the file." + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": ".github/agents/frontend.agent.md", + "line": null, + "message": "Frontmatter has name/description/tools only; no model field." + }, + { + "rule": "R11", + "severity": "low", + "confidence": "medium", + "file": ".github/agents/frontend.agent.md", + "line": null, + "message": "Declared 'search' tool has no corresponding search-related instruction anywhere in the body." + }, + { + "rule": "R12", + "severity": "low", + "confidence": "medium", + "file": ".github/agents/frontend.agent.md", + "line": null, + "message": "No section defines the format of the agent's own output/response; body is patterns/rules/file-location tables only." + }, + { + "rule": "R09", + "severity": "low", + "confidence": "high", + "file": ".github/agents/planner.agent.md", + "line": null, + "message": "No blocks anywhere in the file." + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": ".github/agents/planner.agent.md", + "line": null, + "message": "Frontmatter has name/description/tools/handoffs only; no model field." + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": ".github/agents/planner.agent.md", + "line": null, + "message": "Declared 'web' tool but body never references external web content, URLs, or internet search — all references are to local files. — tools: [\"read\",\"search\",\"web\"] in frontmatter; body's 'Explore the Codebase' section only mentions searching/reading local files, no web usage anywhere." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/agents/planner.agent.md", + "line": 30, + "message": "2 vague quantifier hits: 'relevant files' (line30), 'appropriate specialist agent' (line89)." + }, + { + "rule": "R09", + "severity": "low", + "confidence": "high", + "file": ".github/agents/presenter.agent.md", + "line": null, + "message": "No blocks anywhere in the file." + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": ".github/agents/presenter.agent.md", + "line": null, + "message": "Frontmatter has name/description/tools only; no model field." + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": ".github/agents/presenter.agent.md", + "line": null, + "message": "Declared 'execute' tool but file contains no Commands/bash section at all, unlike sibling agents. — tools: [\"read\",\"edit\",\"search\",\"execute\"] in frontmatter; full-file read shows no bash code fence or 'Commands' heading anywhere." + }, + { + "rule": "R11", + "severity": "low", + "confidence": "medium", + "file": ".github/agents/presenter.agent.md", + "line": null, + "message": "Declared 'search' tool has no corresponding search-related instruction in the body." + }, + { + "rule": "R12", + "severity": "low", + "confidence": "medium", + "file": ".github/agents/presenter.agent.md", + "line": null, + "message": "No section defines the format of the agent's own output/response." + }, + { + "rule": "R09", + "severity": "low", + "confidence": "high", + "file": ".github/agents/backend.agent.md", + "line": null, + "message": "No blocks anywhere in the file." + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": ".github/agents/backend.agent.md", + "line": null, + "message": "Frontmatter has name/description/tools only; no model field." + }, + { + "rule": "R11", + "severity": "low", + "confidence": "medium", + "file": ".github/agents/backend.agent.md", + "line": null, + "message": "Declared 'search' tool has no corresponding search-related instruction anywhere in the body." + }, + { + "rule": "R12", + "severity": "low", + "confidence": "medium", + "file": ".github/agents/backend.agent.md", + "line": null, + "message": "No section defines the format of the agent's own output/response; body is patterns/router examples/file tables only." + }, + { + "rule": "R09", + "severity": "low", + "confidence": "high", + "file": ".github/agents/scaffolder.agent.md", + "line": null, + "message": "No blocks anywhere in the file." + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": ".github/agents/scaffolder.agent.md", + "line": null, + "message": "Frontmatter has name/description/tools only; no model field." + }, + { + "rule": "R11", + "severity": "low", + "confidence": "medium", + "file": ".github/agents/scaffolder.agent.md", + "line": null, + "message": "Declared 'search' tool has no corresponding search-related instruction anywhere in the body." + }, + { + "rule": "R09", + "severity": "low", + "confidence": "high", + "file": ".github/agents/infrastructure.agent.md", + "line": null, + "message": "No blocks anywhere in the file." + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": ".github/agents/infrastructure.agent.md", + "line": null, + "message": "Frontmatter has name/description/tools only; no model field." + }, + { + "rule": "R11", + "severity": "low", + "confidence": "medium", + "file": ".github/agents/infrastructure.agent.md", + "line": null, + "message": "Declared 'search' tool has no corresponding search-related instruction anywhere in the body." + }, + { + "rule": "R12", + "severity": "low", + "confidence": "medium", + "file": ".github/agents/infrastructure.agent.md", + "line": null, + "message": "No section defines the format of the agent's own output/response; body is deployment workflows/tables only." + }, + { + "rule": "R18", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/commands/generate.md", + "line": null, + "message": "Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS. — frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token." + }, + { + "rule": "R18", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/commands/agents.md", + "line": null, + "message": "Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS. — frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token." + }, + { + "rule": "R18", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/commands/changelog.md", + "line": null, + "message": "Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS. — frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token." + }, + { + "rule": "R17", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/deep-wiki/commands/changelog.md", + "line": null, + "message": "No instruction for the edge case of an empty/shallow git history — process assumes commits exist." + }, + { + "rule": "R18", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/commands/deploy.md", + "line": null, + "message": "Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS. — frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token." + }, + { + "rule": "R18", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/commands/build.md", + "line": null, + "message": "Frontmatter has only a description field; no argument-hint despite body appending $ARGUMENTS. — frontmatter block contains only 'description:'; body ends with bare '$ARGUMENTS' token." + }, + { + "rule": "R17", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/deep-wiki/commands/build.md", + "line": null, + "message": "Prerequisites section only states wiki markdown 'should already exist' with no actual check-and-respond instruction, unlike sibling deploy.md." + }, + { + "rule": "R15", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/commands/ask.md", + "line": null, + "message": "Command's entire purpose is answering '$ARGUMENTS' as a question, but there is no instruction for what to do if no question is supplied. — body's '## Question' section is literally the bare '$ARGUMENTS' token with no empty-check or fallback prompt anywhere in the file." + }, + { + "rule": "R18", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/commands/ask.md", + "line": null, + "message": "Frontmatter has only a description field; no argument-hint despite the command being fully argument-driven. — frontmatter block contains only 'description:'." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/deep-wiki/commands/ask.md", + "line": 27, + "message": "2 vague quantifier hits: 'relevant to the question' (line27), '[Relevant snippet...]' (line48)." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-dotnet/skills/azure-mgmt-arizeaiobservabilityeval-dotnet/SKILL.md", + "line": 201, + "message": "Line 201: 'Close clients properly' uses vague quantifier 'properly' instead of a concrete instruction." + }, + { + "rule": "R05", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-identity-py/SKILL.md", + "line": null, + "message": "Body exceeds 500 lines (533 lines of content). — File is 544 total lines; frontmatter closes at line 11, leaving 533 lines of body content." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-storage-blob-py/SKILL.md", + "line": 257, + "message": "Line 257: 'Set appropriate content types for web-served blobs' uses vague quantifier 'appropriate'." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-monitor-opentelemetry-exporter-py/SKILL.md", + "line": 238, + "message": "Line 238: 'Set export intervals appropriate for your workload' uses vague quantifier 'appropriate'." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-eventgrid-py/SKILL.md", + "line": 195, + "message": "Line 195: 'Set appropriate event types for routing and filtering' uses vague quantifier 'appropriate'." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-storage-queue-py/SKILL.md", + "line": 234, + "message": "Line 234: 'Set appropriate visibility timeout based on processing time' uses vague quantifier 'appropriate'." + }, + { + "rule": "R04", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-ai-voicelive-py/SKILL.md", + "line": null, + "message": "Description is 517 characters, in the 500-800 char penalty band. — Description field measured at 517 characters, falling in the 500-800 char band." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-monitor-ingestion-py/SKILL.md", + "line": 229, + "message": "Line 229: 'SDK handles batching, but send reasonable chunks' uses vague quantifier 'reasonable'." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-eventhub-py/SKILL.md", + "line": 252, + "message": "Line 252: 'Set appropriate consumer groups for different applications' uses vague quantifier 'appropriate'." + }, + { + "rule": "R05", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-search-documents-py/SKILL.md", + "line": null, + "message": "Body exceeds 500 lines (543 lines), driven by a duplicated second section repeating earlier content. — File is 554 total lines; body ~543 lines, overage largely caused by a duplicated 'Additional Azure AI Search Patterns' section repeating earlier content near-verbatim." + }, + { + "rule": "R07", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md", + "line": null, + "message": "No scope note distinguishing this skill from sibling azure-cosmos-db-py, which covers the same azure-cosmos package with overlapping trigger phrases." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md", + "line": null, + "message": "Best Practices #4 says 'appropriate scopes' without specifying which scopes for which scenario." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-keyvault-py/SKILL.md", + "line": null, + "message": "Best Practices #9 says 'Cache secrets appropriately' without concrete guidance on TTL or strategy." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-ai-contentsafety-py/SKILL.md", + "line": null, + "message": "Best Practices #4 says 'severity thresholds appropriate for your use case' without concrete guidance." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-mgmt-botservice-py/SKILL.md", + "line": null, + "message": "Best Practices #9 says 'Configure proper CORS' without specifying the actual policy." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/azure-sdk-python/skills/azure-speech-to-text-rest-py/SKILL.md", + "line": null, + "message": "Error-handling example's docstring says 'Transcribe with proper error handling' — an unspecific qualifier inside a code comment." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-ai-translation-document-py/SKILL.md", + "line": null, + "message": "Storage Requirements says 'SAS tokens with appropriate permissions' without full specification." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-monitor-query-py/SKILL.md", + "line": null, + "message": "Best Practices #6 says 'appropriate granularity' without concrete guidance." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-ai-language-conversations-py/SKILL.md", + "line": null, + "message": "System Prompt section says 'Handle exceptions properly' without specifying which exceptions or how." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-mgmt-fabric-py/SKILL.md", + "line": null, + "message": "Best Practices #5 says 'scale up as needed' without concrete triggers." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-python/skills/azure-mgmt-fabric-py/SKILL.md", + "line": null, + "message": "Best Practices #8 says 'Handle LRO properly' without specifying the actual handling steps." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/azure-sdk-python/skills/azure-ai-projects-py/SKILL.md", + "line": null, + "message": "Code sample comment 'Add tools as needed' is an unspecific qualifier." + }, + { + "rule": "R07", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/azure-sdk-python/skills/azure-cosmos-db-py/SKILL.md", + "line": null, + "message": "No cross-reference/scope note distinguishing this skill from sibling azure-cosmos-py, which covers the same package with overlapping trigger phrases." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-ai-voicelive-java/SKILL.md", + "line": 221, + "message": "Line 221: 'Close sessions properly when conversation ends' uses vague qualifier 'properly'." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-communication-common-java/SKILL.md", + "line": 173, + "message": "Line 173: '// Parse raw ID to appropriate type' is a code comment using 'appropriate' instead of naming concrete types." + }, + { + "rule": "R07", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/azure-sdk-java/skills/azure-security-keyvault-secrets-java/SKILL.md", + "line": null, + "message": "No mention/link to sibling azure-security-keyvault-keys-java skill despite both operating on the same vault." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-ai-contentsafety-java/SKILL.md", + "line": 287, + "message": "Line 287: 'Cache blocklist results where appropriate' does not specify when caching is appropriate." + }, + { + "rule": "R05", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md", + "line": null, + "message": "Body length (422 lines) in the 400-500 penalty band. — Body (lines 13-434) is approximately 422 lines, within the 400-500 line penalty band." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md", + "line": 61, + "message": "Line 61: 'TokenCredential with appropriate permissions' does not name the required permissions." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md", + "line": 417, + "message": "Line 417: 'Set appropriate timeouts' is vague about the actual timeout values." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md", + "line": 421, + "message": "Line 421: 'Cache results ... cache when appropriate' does not specify caching criteria." + }, + { + "rule": "R04", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/azure-sdk-java/skills/azure-communication-callingserver-java/SKILL.md", + "line": null, + "message": "Frontmatter description gives only one concrete trigger condition ('maintaining legacy code') rather than a list of specific invocation phrases like sibling skills use." + }, + { + "rule": "R07", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/azure-sdk-java/skills/azure-communication-callautomation-java/SKILL.md", + "line": null, + "message": "Code examples import CommunicationUserIdentifier/PhoneNumberIdentifier from com.azure.communication.common but the skill never links azure-communication-common-java." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-messaging-webpubsub-java/SKILL.md", + "line": 306, + "message": "Line 306: 'Set appropriate token expiration for security' does not specify a recommended value or range." + }, + { + "rule": "R07", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/azure-sdk-java/skills/azure-communication-chat-java/SKILL.md", + "line": null, + "message": "Client Creation section uses CommunicationTokenCredential, documented in azure-communication-common-java, which is never referenced." + }, + { + "rule": "R05", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-appconfiguration-java/SKILL.md", + "line": null, + "message": "Body length (476 lines) in the 400-500 penalty band. — Body (lines 12-487) is approximately 476 lines, within the 400-500 line penalty band." + }, + { + "rule": "R07", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/azure-sdk-java/skills/azure-security-keyvault-keys-java/SKILL.md", + "line": null, + "message": "No mention/link to sibling azure-security-keyvault-secrets-java skill despite both operating on the same vault." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-monitor-opentelemetry-exporter-java/SKILL.md", + "line": 273, + "message": "Line 273: 'Add relevant attributes — Include contextual data for debugging' does not specify which attributes are relevant." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-ai-agents-persistent-java/SKILL.md", + "line": 130, + "message": "Line 130: 'Poll with appropriate delays' pairs a vague qualifier with a concrete number in the same sentence; the heading itself remains vague." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/plugins/azure-sdk-java/skills/azure-compute-batch-java/SKILL.md", + "line": 380, + "message": "Line 380: 'Handle LRO properly — Pool resize, delete operations are long-running' uses 'properly' instead of describing the expected pattern." + }, + { + "rule": "R04", + "severity": "low", + "confidence": "medium", + "file": ".github/skills/debugview/SKILL.md", + "line": null, + "message": "Frontmatter description is roughly 775 characters (500-800 range)." + }, + { + "rule": "R06", + "severity": "low", + "confidence": "medium", + "file": ".github/skills/cloud-solution-architect/SKILL.md", + "line": null, + "message": "Complex architectural concepts (44 patterns, WAF pillars, mission-critical design) are covered entirely with reference tables; the only code-shaped block is a generic ADR template, not an implementation example." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/skills/cloud-solution-architect/SKILL.md", + "line": null, + "message": "1 vague quantifier occurrence ('relevant')." + }, + { + "rule": "R05", + "severity": "low", + "confidence": "high", + "file": ".github/skills/skill-creator/SKILL.md", + "line": null, + "message": "Body is 1310 lines — over 2.5x the skill's own mandated 500-line ceiling. — SKILL.md body is ~1310 lines, well over the 500-line threshold." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/skills/skill-creator/SKILL.md", + "line": null, + "message": "Heavy vague-quantifier usage, capped at -20. — 15 vague-quantifier occurrences found (appropriate x5, as needed x2, several, significantly, sufficient, typically, etc.); capped at -20." + }, + { + "rule": "R04", + "severity": "low", + "confidence": "medium", + "file": ".github/skills/applicationinsights-web-ts/SKILL.md", + "line": null, + "message": "Frontmatter description is roughly 524 characters (500-800 range)." + }, + { + "rule": "R05", + "severity": "low", + "confidence": "high", + "file": ".github/skills/applicationinsights-web-ts/SKILL.md", + "line": null, + "message": "SKILL.md body is 457 lines (400-500 range)." + }, + { + "rule": "R04", + "severity": "low", + "confidence": "medium", + "file": ".github/skills/kql/SKILL.md", + "line": null, + "message": "Frontmatter description is roughly 797 characters (500-800 range, just under the -10 threshold)." + }, + { + "rule": "R05", + "severity": "low", + "confidence": "high", + "file": ".github/skills/kql/SKILL.md", + "line": null, + "message": "SKILL.md body is 439 lines (400-500 range)." + }, + { + "rule": "R05", + "severity": "low", + "confidence": "high", + "file": ".github/skills/copilot-sdk/SKILL.md", + "line": null, + "message": "Body is 901 lines, far over the 500-line guidance. — SKILL.md body is ~901 lines, well over the 500-line threshold." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/skills/copilot-sdk/SKILL.md", + "line": null, + "message": "1 vague quantifier occurrence ('effectively')." + }, + { + "rule": "R06", + "severity": "low", + "confidence": "medium", + "file": ".github/skills/mcp-builder/SKILL.md", + "line": null, + "message": "Core 'Implement Tools' section is described narratively with zero inline code snippets; every concrete example lives in a separate ./reference/*.md file." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/skills/mcp-builder/SKILL.md", + "line": null, + "message": "5 vague-quantifier occurrences (relevant x2, as needed x2, effectively)." + }, + { + "rule": "R04", + "severity": "low", + "confidence": "medium", + "file": ".github/skills/entra-agent-id/SKILL.md", + "line": null, + "message": "Frontmatter description is roughly 715 characters (500-800 range)." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/skills/microsoft-docs/SKILL.md", + "line": null, + "message": "1 vague quantifier occurrence ('relevant')." + }, + { + "rule": "R04", + "severity": "low", + "confidence": "medium", + "file": ".github/skills/frontend-design-review/SKILL.md", + "line": null, + "message": "Frontmatter description is roughly 595 characters (500-800 range)." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/skills/frontend-design-review/SKILL.md", + "line": null, + "message": "1 vague quantifier occurrence ('context-appropriate')." + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": ".github/skills/github-issue-creator/SKILL.md", + "line": null, + "message": "2 vague quantifier occurrences ('relevant' x2)." + }, + { + "rule": "CC-orphan-component", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md", + "line": null, + "message": "Overlapping coverage with sibling azure-cosmos-db-py skill for the same azure-cosmos package; no scope note disambiguates the two for routing." + }, + { + "rule": "CC-orphan-component", + "severity": "low", + "confidence": "medium", + "file": ".github/plugins/azure-sdk-java/skills/azure-security-keyvault-secrets-java/SKILL.md", + "line": null, + "message": "No cross-link to sibling azure-security-keyvault-keys-java skill despite both operating on the same Key Vault resource." + }, + { + "rule": "CC-terminology-drift", + "severity": "low", + "confidence": "medium", + "file": ".github/agents/frontend.agent.md", + "line": null, + "message": "This agent and its 5 siblings (backend/planner/presenter/scaffolder/infrastructure) plus the 3 deep-wiki agents all independently omit blocks and model declaration, indicating a shared template gap rather than isolated defects." + } + ], + "repo_meta": { + "status": "discovered", + "stars": 2861, + "security": "BLOCKED", + "audit_report_path": "auditor/audits/microsoft-skills.md" + }, + "generated_at": "2026-08-05T07:18:49Z", + "schema_version": 1 +}