From 41e6254da8f0b553286b50509d9e6bc3f21099a6 Mon Sep 17 00:00:00 2001 From: "nlpm-auditor[bot]" Date: Wed, 5 Aug 2026 07:18:59 +0000 Subject: [PATCH 1/2] audit: indranilbanerjee/digital-marketing-pro (91/100, security:BLOCKED, progressive, 202 artifacts) --- ...erjee-digital-marketing-pro.findings.jsonl | 127 + .../indranilbanerjee-digital-marketing-pro.md | 300 +++ auditor/findings.jsonl | 127 + auditor/logs/events.jsonl | 4 + auditor/registry/repos.json | 9 +- ...ndranilbanerjee-digital-marketing-pro.html | 104 + ...ndranilbanerjee-digital-marketing-pro.json | 2362 +++++++++++++++++ 7 files changed, 3030 insertions(+), 3 deletions(-) create mode 100644 auditor/audits/indranilbanerjee-digital-marketing-pro.findings.jsonl create mode 100644 auditor/audits/indranilbanerjee-digital-marketing-pro.md create mode 100644 auditor/reports/indranilbanerjee-digital-marketing-pro.html create mode 100644 auditor/reports/indranilbanerjee-digital-marketing-pro.json diff --git a/auditor/audits/indranilbanerjee-digital-marketing-pro.findings.jsonl b/auditor/audits/indranilbanerjee-digital-marketing-pro.findings.jsonl new file mode 100644 index 000000000..c8650ae3b --- /dev/null +++ b/auditor/audits/indranilbanerjee-digital-marketing-pro.findings.jsonl @@ -0,0 +1,127 @@ +{"category":"bug","rule_id":"BUG-undeclared-tool","file":"commands/backlink-gap.md","line":null,"severity":"medium","confidence":"high","evidence":"body runs scripts/backlink_gap.py via Bash (line 33) and writes PLAN.md via Write (line 38); frontmatter declares no allowed-tools field","penalty":null,"pattern":"undeclared-tool-use","description":"Command invokes Bash and Write with no allowed-tools declared in frontmatter","false_positive":false,"suggested_fix":"Add allowed-tools: Bash, Write to frontmatter"} +{"category":"bug","rule_id":"BUG-undeclared-tool","file":"commands/competitor-analysis.md","line":139,"severity":"medium","confidence":"high","evidence":"body instructs dispatching seven parallel Task tool calls (line 139); frontmatter declares no allowed-tools field","penalty":null,"pattern":"undeclared-tool-use","description":"Command invokes Task tool with no allowed-tools declared in frontmatter","false_positive":false,"suggested_fix":"Add allowed-tools: Task to frontmatter"} +{"category":"bug","rule_id":"BUG-undeclared-tool","file":"commands/seo-audit.md","line":166,"severity":"medium","confidence":"high","evidence":"Execution discipline section runs scripts/link-profile-analyzer.py via Bash (lines 163-166); frontmatter declares no allowed-tools field","penalty":null,"pattern":"undeclared-tool-use","description":"Command invokes Bash with no allowed-tools declared in frontmatter","false_positive":false,"suggested_fix":"Add allowed-tools: Bash to frontmatter"} +{"category":"security","rule_id":"SEC-file-write-outside-repo","file":"scripts/output-publisher.py","line":77,"severity":"high","confidence":"high","evidence":"get_visible_publish_dir() resolves to ~/Documents/DigitalMarketingPro/{brand}; _publish_file() copies artifacts there via shutil.copy2() at line 118","penalty":null,"pattern":"file-write-outside-repo","description":"Writes published artifacts outside the repo/plugin sandbox into the user's home directory","false_positive":false,"suggested_fix":"Document the publish directory explicitly in README/skill docs and confirm the destination is user-configurable, not hardcoded"} +{"category":"security","rule_id":"SEC-file-write-outside-repo","file":"scripts/sync_model_registry.sh","line":52,"severity":"high","confidence":"high","evidence":"dest path computed via ../ traversal from REPO_ROOT to a sibling checkout outside the repo root; written by embedded python json.dump at line 93","penalty":null,"pattern":"file-write-outside-repo","description":"Writes model_registry.json to a sibling directory outside the repo root via relative traversal","false_positive":false,"suggested_fix":"Make the sibling-repo destination an explicit, validated CLI argument rather than an implicit ../ traversal"} +{"category":"security","rule_id":"SEC-env-var-access","file":"scripts/ai-visibility-checker.py","line":164,"severity":"medium","confidence":"high","evidence":"os.environ.get(\"OPENAI_API_KEY\") read to authenticate outbound OpenAI API call","penalty":null,"pattern":"env-var-access","description":"Reads OPENAI_API_KEY from environment to authenticate an outbound API call","false_positive":false,"suggested_fix":"Document required env vars in script docstring/README"} +{"category":"security","rule_id":"SEC-network-call","file":"scripts/ai-visibility-checker.py","line":173,"severity":"medium","confidence":"high","evidence":"sends user-supplied query text to OpenAI chat completions API endpoint","penalty":null,"pattern":"network-call","description":"Sends user-supplied query text to the OpenAI chat completions API","false_positive":false,"suggested_fix":"Document outbound API destination and confirm query text does not include secrets"} +{"category":"security","rule_id":"SEC-env-var-access","file":"scripts/ai-visibility-checker.py","line":204,"severity":"medium","confidence":"high","evidence":"os.environ.get(\"ANTHROPIC_API_KEY\") read to authenticate outbound Anthropic API call","penalty":null,"pattern":"env-var-access","description":"Reads ANTHROPIC_API_KEY from environment to authenticate an outbound API call","false_positive":false,"suggested_fix":"Document required env vars in script docstring/README"} +{"category":"security","rule_id":"SEC-network-call","file":"scripts/ai-visibility-checker.py","line":213,"severity":"medium","confidence":"high","evidence":"sends user-supplied query text to Anthropic messages API endpoint","penalty":null,"pattern":"network-call","description":"Sends user-supplied query text to the Anthropic messages API","false_positive":false,"suggested_fix":"Document outbound API destination and confirm query text does not include secrets"} +{"category":"security","rule_id":"SEC-network-call","file":"scripts/brand-voice-scorer.py","line":73,"severity":"medium","confidence":"high","evidence":"nltk.download() call with no gating flag","penalty":null,"pattern":"network-call","description":"nltk.download() silently fetches tokenizer/tagger corpus data from NLTK's remote server on first run","false_positive":false,"suggested_fix":"Pre-bundle the NLTK corpus or gate the download behind an explicit --allow-network-fetch flag with a printed warning"} +{"category":"security","rule_id":"SEC-network-call","file":"scripts/competitor-scraper.py","line":75,"severity":"medium","confidence":"high","evidence":"fetches robots.txt from a host derived from the user-supplied --url argument","penalty":null,"pattern":"network-call","description":"Fetches robots.txt from an arbitrary, caller-supplied destination","false_positive":false,"suggested_fix":"Add a scheme allow-list and reject file://, localhost, and private-IP targets"} +{"category":"security","rule_id":"SEC-network-call","file":"scripts/competitor-scraper.py","line":168,"severity":"medium","confidence":"high","evidence":"fetches full page content from the user-supplied --url argument","penalty":null,"pattern":"network-call","description":"Fetches page content from an arbitrary, caller-supplied destination","false_positive":false,"suggested_fix":"Add a scheme allow-list and reject file://, localhost, and private-IP targets"} +{"category":"security","rule_id":"SEC-env-var-access","file":"scripts/connector_executor.py","line":269,"severity":"medium","confidence":"high","evidence":"loads entire os.environ as the default credential source (SLACK_BOT_TOKEN, HUBSPOT_PRIVATE_APP_TOKEN, KLAVIYO_PRIVATE_KEY, SENDGRID_API_KEY, BREVO_API_KEY, CUSTOMERIO_APP_API_KEY, MAILCHIMP_API_KEY, AHREFS_API_KEY, etc.)","penalty":null,"pattern":"env-var-access","description":"Loads the entire environment dict as the credential source instead of an explicit named allow-list","false_positive":false,"suggested_fix":"Read only the specific env-var names required per connector instead of the full environment"} +{"category":"security","rule_id":"SEC-network-call","file":"scripts/connector_executor.py","line":331,"severity":"medium","confidence":"high","evidence":"fires outbound HTTP requests via urllib to hardcoded per-connector vendor endpoints (e.g. api.hubapi.com, a.klaviyo.com) with injected credentials","penalty":null,"pattern":"network-call","description":"Sends injected credentials to hardcoded external vendor endpoints","false_positive":false,"suggested_fix":"Confirm TLS is enforced and credentials are never included in error/log output"} +{"category":"security","rule_id":"SEC-env-var-access","file":"scripts/credential-manager.py","line":173,"severity":"medium","confidence":"high","evidence":"os.environ.get(v) reads arbitrary env-var names loaded from a stored profile JSON (validate-profile action); boolean presence check only","penalty":null,"pattern":"env-var-access","description":"Iterates arbitrary env-var names from a stored profile to check credential presence","false_positive":false,"suggested_fix":"Validate profile env-var names against an allow-list before calling os.environ.get()"} +{"category":"security","rule_id":"SEC-postinstall-script","file":"scripts/embed-c2pa.py","line":104,"severity":"medium","confidence":"high","evidence":"subprocess.check_call runs pip install --quiet c2pa-python>=0.32 at runtime if the module is missing","penalty":null,"pattern":"runtime-package-install","description":"Auto-installs a third-party package at runtime when missing","false_positive":false,"suggested_fix":"Move c2pa-python to a declared requirements.txt dependency instead of auto-installing"} +{"category":"security","rule_id":"SEC-env-var-access","file":"scripts/crm-sync.py","line":367,"severity":"medium","confidence":"high","evidence":"os.environ.get(env_var) reads SALESFORCE_ACCESS_TOKEN, HUBSPOT_ACCESS_TOKEN, ZOHO_REFRESH_TOKEN, PIPEDRIVE_API_TOKEN; boolean presence check only, no value exfiltration","penalty":null,"pattern":"env-var-access","description":"Reads CRM token env vars to report connection status (presence check only)","false_positive":false,"suggested_fix":"Add inline comment noting only presence (not value) is read, to make intent auditable"} +{"category":"security","rule_id":"SEC-env-var-access","file":"scripts/memory-manager.py","line":360,"severity":"medium","confidence":"high","evidence":"os.environ.get(env_var) reads PINECONE_API_KEY, QDRANT_API_KEY, SUPERMEMORY_API_KEY, GRAPHITI_API_KEY; boolean presence check only, no value exfiltration","penalty":null,"pattern":"env-var-access","description":"Reads memory-service API key env vars to report connection status (presence check only)","false_positive":false,"suggested_fix":"Add inline comment noting only presence (not value) is read, to make intent auditable"} +{"category":"security","rule_id":"SEC-env-var-access","file":"scripts/refresh_models.py","line":53,"severity":"medium","confidence":"high","evidence":"reads ANTHROPIC_API_KEY and sends it as x-api-key header to hardcoded https://api.anthropic.com/v1/models (line 57)","penalty":null,"pattern":"env-var-access+network-call","description":"Sends ANTHROPIC_API_KEY to a hardcoded external endpoint","false_positive":false,"suggested_fix":"Document all outbound provider hosts in the script header"} +{"category":"security","rule_id":"SEC-env-var-access","file":"scripts/refresh_models.py","line":66,"severity":"medium","confidence":"high","evidence":"reads OPENAI_API_KEY and sends it as a Bearer token to hardcoded https://api.openai.com/v1/models (line 70)","penalty":null,"pattern":"env-var-access+network-call","description":"Sends OPENAI_API_KEY to a hardcoded external endpoint","false_positive":false,"suggested_fix":"Document all outbound provider hosts in the script header"} +{"category":"security","rule_id":"SEC-env-var-access","file":"scripts/refresh_models.py","line":79,"severity":"medium","confidence":"high","evidence":"reads GEMINI_API_KEY and appends it as a ?key= query param to hardcoded generativelanguage.googleapis.com (line 83)","penalty":null,"pattern":"env-var-access+network-call","description":"Sends GEMINI_API_KEY as a URL query parameter to a hardcoded external endpoint","false_positive":false,"suggested_fix":"Prefer sending API keys via headers rather than URL query parameters to avoid key leakage into logs/proxies"} +{"category":"security","rule_id":"SEC-env-var-access","file":"scripts/refresh_models.py","line":96,"severity":"medium","confidence":"high","evidence":"reads EVOLINK_API_KEY and sends it as a Bearer token to hardcoded https://direct.evolink.ai/v1/models (line 100), a lesser-known third-party host","penalty":null,"pattern":"env-var-access+network-call","description":"Sends EVOLINK_API_KEY to a hardcoded, lesser-known third-party endpoint","false_positive":false,"suggested_fix":"Make the EVOLINK provider opt-in via a flag since it is a non-major vendor; document the host explicitly"} +{"category":"security","rule_id":"SEC-network-call","file":"scripts/tech-seo-auditor.py","line":134,"severity":"medium","confidence":"high","evidence":"opener.open() fetches an arbitrary caller-supplied URL (from --url/--urls/--file) with manual redirect-following and no destination allow-list","penalty":null,"pattern":"network-call-ssrf","description":"Unrestricted URL fetch of caller-supplied targets with no private-IP/localhost block-list","false_positive":false,"suggested_fix":"Add a private-IP/localhost block-list before opening the connection"} +{"category":"security","rule_id":"SEC-postinstall-script","file":"scripts/setup.py","line":274,"severity":"medium","confidence":"high","evidence":"subprocess.check_call() invokes pip install at runtime for LITE_DEPS/FULL_DEPS package lists","penalty":null,"pattern":"runtime-package-install","description":"Runtime pip install of dependency lists during setup script execution","false_positive":false,"suggested_fix":"Prefer requirements.txt + documented pip install -r requirements.txt setup step"} +{"category":"security","rule_id":"SEC-network-call","file":"scripts/setup.py","line":285,"severity":"medium","confidence":"high","evidence":"nltk.download() fetches NLTK corpus data packages from NLTK's remote distribution servers at runtime","penalty":null,"pattern":"network-call","description":"Runtime network fetch of NLTK corpus data during setup","false_positive":false,"suggested_fix":"Pre-bundle NLTK corpus data or gate the download behind an explicit flag"} +{"category":"security","rule_id":"SEC-unpinned-semver","file":"scripts/requirements.txt","line":10,"severity":"low","confidence":"high","evidence":"nltk>=3.8, textstat>=0.7, beautifulsoup4>=4.12, requests>=2.31 (lines 10-15) use >= range pins instead of exact == pins","penalty":null,"pattern":"unpinned-dependency","description":"Multiple dependencies pinned with >= range instead of exact version, risking non-reproducible builds","false_positive":false,"suggested_fix":"Pin exact versions or adopt a lockfile"} +{"category":"nl_quality","rule_id":"R10","file":"agents/analytics-analyst.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/analytics-analyst.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R01","file":"agents/analytics-analyst.md","line":27,"severity":"low","confidence":"high","evidence":"\"recommend the appropriate measurement method\" (line 27); \"whether the sample size is sufficient for confidence\" (line 28)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"appropriate\", \"sufficient\") used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace with measurable selection criteria"} +{"category":"nl_quality","rule_id":"R10","file":"agents/cro-specialist.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/cro-specialist.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/influencer-manager.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/influencer-manager.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/content-creator.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/content-creator.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R01","file":"agents/content-creator.md","line":75,"severity":"low","confidence":"high","evidence":"\"ensure audience-appropriate reading level\" (line 75)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with a measurable reading-level target (e.g. Flesch score range)"} +{"category":"nl_quality","rule_id":"R10","file":"agents/intelligence-curator.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/intelligence-curator.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/journey-orchestrator.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/journey-orchestrator.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/media-buyer.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/media-buyer.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R01","file":"agents/media-buyer.md","line":26,"severity":"low","confidence":"high","evidence":"\"content category blocklists where appropriate\" (line 26)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit blocklist criteria"} +{"category":"nl_quality","rule_id":"R10","file":"agents/marketing-scientist.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/marketing-scientist.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/growth-engineer.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/growth-engineer.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/social-media-manager.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/social-media-manager.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/marketing-strategist.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/marketing-strategist.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R01","file":"agents/marketing-strategist.md","line":97,"severity":"low","confidence":"high","evidence":"\"recommend the appropriate specialist agents\" (line 97)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit agent-selection criteria"} +{"category":"nl_quality","rule_id":"R09","file":"agents/quality-assurance.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/brand-guardian.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/brand-guardian.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R01","file":"agents/brand-guardian.md","line":14,"severity":"low","confidence":"high","evidence":"\"ensuring channel-appropriate voice adaptation\" (line 14); \"clear, conspicuous, and platform-appropriate\" (line 30)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"appropriate\" x2) used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit per-channel/per-platform criteria"} +{"category":"nl_quality","rule_id":"R10","file":"agents/pr-outreach.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/pr-outreach.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R01","file":"agents/pr-outreach.md","line":30,"severity":"low","confidence":"high","evidence":"\"a clear reason why this story is relevant to them specifically\" (line 30)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit relevance criteria"} +{"category":"nl_quality","rule_id":"R10","file":"agents/competitive-intel.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/competitive-intel.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/crm-manager.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/crm-manager.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/memory-manager.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/memory-manager.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R01","file":"agents/memory-manager.md","line":33,"severity":"low","confidence":"high","evidence":"\"Recommend the appropriate memory layer based on query type\" (line 33)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit memory-layer selection criteria"} +{"category":"nl_quality","rule_id":"R10","file":"agents/agency-operations.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/agency-operations.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/localization-specialist.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/localization-specialist.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/performance-monitor-agent.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/performance-monitor-agent.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R01","file":"agents/performance-monitor-agent.md","line":24,"severity":"low","confidence":"high","evidence":"\"Without sufficient data, note the observation as 'insufficient baseline'\" (line 24)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"sufficient\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit minimum sample size"} +{"category":"nl_quality","rule_id":"R10","file":"agents/execution-coordinator.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/execution-coordinator.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R11","file":"agents/execution-coordinator.md","line":5,"severity":"low","confidence":"high","evidence":"tools: Read, Write, Edit, Grep, Glob, Bash, WebFetch (line 5); body only describes remote CMS/platform publishing via MCP and script calls, no local file editing described","penalty":-3,"pattern":"unused_tool","description":"Edit tool declared but never referenced or invoked in the agent body","false_positive":false,"suggested_fix":"Remove Edit from the declared tools list, or add a body section that legitimately uses it"} +{"category":"nl_quality","rule_id":"R10","file":"agents/market-intelligence.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/market-intelligence.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R01","file":"agents/market-intelligence.md","line":15,"severity":"low","confidence":"high","evidence":"\"moments worth joining (brand-relevant, authentic fit)\" (line 15)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit brand-fit criteria"} +{"category":"nl_quality","rule_id":"R10","file":"agents/seo-specialist.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/seo-specialist.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R10","file":"agents/email-specialist.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"category":"nl_quality","rule_id":"R09","file":"agents/email-specialist.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"category":"nl_quality","rule_id":"R01","file":"skills/send-report/SKILL.md","line":12,"severity":"low","confidence":"high","evidence":"\"with appropriate approval gates\" (line 12); \"Apply the appropriate template depth\" (line 47); \"appropriate permissions\" (line 51)","penalty":-6,"pattern":"vague_quantifier","description":"3 vague quantifiers (\"appropriate\" x3) used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"category":"nl_quality","rule_id":"R01","file":"skills/programmatic-seo/SKILL.md","line":47,"severity":"low","confidence":"high","evidence":"\"Word count per page | <300 | Flag for review (may lack sufficient value)\" (line 47)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"sufficient\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit word-count threshold"} +{"category":"nl_quality","rule_id":"R01","file":"skills/executive-dashboard/SKILL.md","line":27,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 27)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/marketing-automation/SKILL.md","line":57,"severity":"low","confidence":"high","evidence":"\"infer reasonable defaults\" (line 57); \"stage-appropriate messaging\" (line 101); \"fire correctly\" (line 108); \"MAP appropriate for the business size\" (line 156)","penalty":-8,"pattern":"vague_quantifier","description":"4 vague quantifiers (\"reasonable\", \"appropriate\" x2, \"correctly\") used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"category":"nl_quality","rule_id":"R01","file":"skills/import-template/SKILL.md","line":26,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 26)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/analytics-insights/SKILL.md","line":142,"severity":"low","confidence":"high","evidence":"\"Is the tracking code still firing correctly?\" (line 142)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"correctly\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit verification check (e.g. expected event payload)"} +{"category":"nl_quality","rule_id":"R01","file":"skills/eval-content/SKILL.md","line":26,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files (especially messaging.md ... visual-identity.md)\" (line 26)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/prompt-test/SKILL.md","line":28,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files (voice-and-tone rules, messaging hierarchy, channel style guides)\" (line 28)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/entity-audit/SKILL.md","line":27,"severity":"low","confidence":"high","evidence":"\"For each relevant directory, verify the listing exists and check data consistency\" (line 27)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit directory list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/pr-pitch/SKILL.md","line":26,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 26)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/qbr-plan/SKILL.md","line":29,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 29)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/webinar-plan/SKILL.md","line":30,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 30)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/language-audit/SKILL.md","line":24,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files for market-specific content rules\" (line 24); \"present and correctly localized\" (line 29)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"relevant\", \"correctly\") used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"category":"nl_quality","rule_id":"R01","file":"skills/client-proposal/SKILL.md","line":29,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 29); \"Pull relevant industry performance data\" (line 30); \"Frame placeholders for relevant case studies\" (line 35)","penalty":-6,"pattern":"vague_quantifier","description":"3 vague quantifiers (\"relevant\" x3) used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"category":"nl_quality","rule_id":"R01","file":"skills/eval-config/SKILL.md","line":40,"severity":"low","confidence":"high","evidence":"\"Analyze the brand's industry, audience, content strategy, and compliance requirements to suggest appropriate settings\" (line 40)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit settings-selection criteria"} +{"category":"nl_quality","rule_id":"R01","file":"skills/lead-import/SKILL.md","line":44,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 44); \"verify field values, scoring data, source attribution, and assignment all transferred correctly\" (line 54)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"relevant\", \"correctly\") used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"category":"nl_quality","rule_id":"R01","file":"skills/martech-audit/SKILL.md","line":28,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 28)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/live-dashboard/SKILL.md","line":12,"severity":"low","confidence":"high","evidence":"\"Auto-selects appropriate metrics, dimensions, and chart types\" (line 12); \"Select the appropriate metric hierarchy and page structure\" (line 36)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"appropriate\" x2) used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit selection criteria"} +{"category":"nl_quality","rule_id":"R01","file":"skills/funnel-audit/SKILL.md","line":26,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 26)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/add-integration/SKILL.md","line":27,"severity":"low","confidence":"high","evidence":"\"add the credentials to the appropriate credential profile\" (line 27); \"add the new integration's credential mapping to the appropriate profile\" (line 29)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"appropriate\" x2) used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit profile-selection criteria"} +{"category":"nl_quality","rule_id":"R01","file":"skills/seo-audit/SKILL.md","line":36,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 36)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/journey-design/SKILL.md","line":21,"severity":"low","confidence":"high","evidence":"\"the system designs based on objective-appropriate defaults\" (line 21)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"objective-appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit per-objective default table"} +{"category":"nl_quality","rule_id":"R01","file":"skills/local-seo-audit/SKILL.md","line":27,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 27)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/cro/SKILL.md","line":124,"severity":"low","confidence":"high","evidence":"\"unless running a multivariate test with sufficient traffic\" (line 124)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"sufficient\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit minimum traffic/sample-size threshold"} +{"category":"nl_quality","rule_id":"R01","file":"skills/team-assign/SKILL.md","line":42,"severity":"low","confidence":"high","evidence":"\"send an assignment notification ... with task details, priority, due date, and any relevant brand context\" (line 42)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit brand-context fields to include"} +{"category":"nl_quality","rule_id":"R01","file":"skills/campaign-plan/SKILL.md","line":26,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 26)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/aeo-audit/SKILL.md","line":33,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 33)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/campaign-orchestrator/SKILL.md","line":120,"severity":"low","confidence":"high","evidence":"\"Budget and schedules set correctly in all platforms\" (line 120); \"Recommend channels with more flexible policies where appropriate\" (line 183)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"correctly\", \"appropriate\") used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"category":"nl_quality","rule_id":"R11","file":"skills/launch-campaign/SKILL.md","line":12,"severity":"low","confidence":"high","evidence":"allowed-tools: Read Bash Glob Grep (line 12); body only describes Read (plan.json) and Bash (python/curl invocations), no Glob usage described","penalty":-3,"pattern":"unused_tool","description":"Glob declared in allowed-tools but never referenced or invoked in the skill body","false_positive":false,"suggested_fix":"Remove Glob from allowed-tools, or add a body step that legitimately uses it"} +{"category":"nl_quality","rule_id":"R11","file":"skills/launch-campaign/SKILL.md","line":12,"severity":"low","confidence":"high","evidence":"allowed-tools: Read Bash Glob Grep (line 12); no grep/search operation described anywhere in the Process section","penalty":-3,"pattern":"unused_tool","description":"Grep declared in allowed-tools but never referenced or invoked in the skill body","false_positive":false,"suggested_fix":"Remove Grep from allowed-tools, or add a body step that legitimately uses it"} +{"category":"nl_quality","rule_id":"R01","file":"skills/performance-report/SKILL.md","line":28,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 28)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/pipeline-update/SKILL.md","line":43,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 43)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"category":"nl_quality","rule_id":"R01","file":"skills/review-response/SKILL.md","line":28,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 28); \"take responsibility where appropriate\" (line 31); \"highlight relevant brand strengths\" (line 33); \"naturally incorporate relevant keywords\" (line 38)","penalty":-8,"pattern":"vague_quantifier","description":"4 vague quantifiers (\"relevant\" x3, \"appropriate\") used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"category":"nl_quality","rule_id":"R11","file":"commands/email-sequence.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field","penalty":-5,"pattern":"missing_allowed_tools","description":"No allowed-tools field declared in command frontmatter","false_positive":false,"suggested_fix":"Add an allowed-tools frontmatter field listing the tools the command body actually uses"} +{"category":"nl_quality","rule_id":"R14","file":"commands/email-sequence.md","line":46,"severity":"medium","confidence":"medium","evidence":"## Sequence Design section (lines 46-98) covers architecture, per-email blueprint, segmentation/branching, and deliverability checklist as ### headers/bullets, not a numbered process list","penalty":-10,"pattern":"no_numbered_steps","description":"Multi-stage command body presented as unordered headers/bullets instead of numbered steps","false_positive":false,"suggested_fix":"Convert the Sequence Design section into an explicit numbered step list"} +{"category":"nl_quality","rule_id":"R01","file":"commands/email-sequence.md","line":93,"severity":"low","confidence":"high","evidence":"\"Link density appropriate (not too many links)\" (line 93)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit max-link-count threshold"} +{"category":"nl_quality","rule_id":"R11","file":"commands/cowork-setup.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter only has description, argument-hint, disable-model-invocation (lines 1-5), no allowed-tools field","penalty":-5,"pattern":"missing_allowed_tools","description":"No allowed-tools field declared in command frontmatter","false_positive":false,"suggested_fix":"Add an allowed-tools frontmatter field listing the tools the command body actually uses"} +{"category":"nl_quality","rule_id":"R15","file":"commands/check.md","line":3,"severity":"medium","confidence":"medium","evidence":"argument-hint requires (line 3); no \"if not provided\" guidance anywhere in the body","penalty":-10,"pattern":"no_empty_input_handling","description":"No handling specified for missing/empty required argument","false_positive":false,"suggested_fix":"Add explicit fallback/error behavior for when the argument is omitted"} +{"category":"nl_quality","rule_id":"R11","file":"commands/backlink-gap.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field","penalty":-5,"pattern":"missing_allowed_tools","description":"No allowed-tools field declared in command frontmatter","false_positive":false,"suggested_fix":"Add an allowed-tools frontmatter field listing the tools the command body actually uses"} +{"category":"nl_quality","rule_id":"R15","file":"commands/backlink-gap.md","line":21,"severity":"medium","confidence":"medium","evidence":"## Inputs section (lines 21-26) has no missing-input guidance, unlike sibling commands","penalty":-10,"pattern":"no_empty_input_handling","description":"Required domain/competitor arguments have no fallback for missing input","false_positive":false,"suggested_fix":"Add an explicit \"if not provided, ask the user\" fallback matching sibling commands"} +{"category":"nl_quality","rule_id":"R11","file":"commands/competitor-analysis.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field","penalty":-5,"pattern":"missing_allowed_tools","description":"No allowed-tools field declared in command frontmatter","false_positive":false,"suggested_fix":"Add an allowed-tools frontmatter field listing the tools the command body actually uses"} +{"category":"nl_quality","rule_id":"R15","file":"commands/execute-action.md","line":3,"severity":"medium","confidence":"medium","evidence":"argument-hint shows --action unbracketed (required) at line 3; no omission-handling text in body","penalty":-10,"pattern":"no_empty_input_handling","description":"No handling specified for when the required --action flag is omitted","false_positive":false,"suggested_fix":"Add explicit fallback/error behavior for when --action is omitted"} +{"category":"nl_quality","rule_id":"R11","file":"commands/brand-setup.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field","penalty":-5,"pattern":"missing_allowed_tools","description":"No allowed-tools field declared in command frontmatter","false_positive":false,"suggested_fix":"Add an allowed-tools frontmatter field listing the tools the command body actually uses"} +{"category":"nl_quality","rule_id":"R11","file":"commands/seo-audit.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field","penalty":-5,"pattern":"missing_allowed_tools","description":"No allowed-tools field declared in command frontmatter","false_positive":false,"suggested_fix":"Add an allowed-tools frontmatter field listing the tools the command body actually uses"} diff --git a/auditor/audits/indranilbanerjee-digital-marketing-pro.md b/auditor/audits/indranilbanerjee-digital-marketing-pro.md new file mode 100644 index 000000000..fba90db4b --- /dev/null +++ b/auditor/audits/indranilbanerjee-digital-marketing-pro.md @@ -0,0 +1,300 @@ +# NLPM Audit: indranilbanerjee/digital-marketing-pro +**Date**: 2026-04-06 | **Artifacts**: 202 | **Strategy**: progressive +**NL Score**: 91/100 +**Security**: BLOCKED +**Bugs**: 3 | **Quality Issues**: 101 | **Security Findings**: 23 + +This pass scored 100 of the repo's 202 artifacts (24 agents, 65 skills, 9 commands, `hooks/hooks.json`, `.claude-plugin/plugin.json`) and ran a detailed security scan of all 87 executable scripts plus `package.json` / `scripts/requirements.txt`. `hooks/hooks.json` currently ships zero active hooks (all prior hooks were intentionally disabled and documented in-file — see `hooks/hooks-reference.example.json`). + +## NL Score Summary +| File | Type | Score | Top Issue | +|------|------|-------|-----------| +| commands/backlink-gap.md | command | 75 | Bash + Write used without `allowed-tools` declared | +| agents/analytics-analyst.md | agent | 76 | Zero `` blocks | +| agents/brand-guardian.md | agent | 76 | Zero `` blocks | +| agents/execution-coordinator.md | agent | 77 | Zero `` blocks | +| agents/content-creator.md | agent | 78 | Zero `` blocks | +| agents/media-buyer.md | agent | 78 | Zero `` blocks | +| agents/marketing-strategist.md | agent | 78 | Zero `` blocks | +| agents/pr-outreach.md | agent | 78 | Zero `` blocks | +| agents/memory-manager.md | agent | 78 | Zero `` blocks | +| agents/performance-monitor-agent.md | agent | 78 | Zero `` blocks | +| agents/market-intelligence.md | agent | 78 | Zero `` blocks | +| agents/cro-specialist.md | agent | 80 | Zero `` blocks | +| agents/influencer-manager.md | agent | 80 | Zero `` blocks | +| agents/intelligence-curator.md | agent | 80 | Zero `` blocks | +| agents/journey-orchestrator.md | agent | 80 | Zero `` blocks | +| agents/marketing-scientist.md | agent | 80 | Zero `` blocks | +| agents/growth-engineer.md | agent | 80 | Zero `` blocks | +| agents/social-media-manager.md | agent | 80 | Zero `` blocks | +| agents/competitive-intel.md | agent | 80 | Zero `` blocks | +| agents/crm-manager.md | agent | 80 | Zero `` blocks | +| agents/agency-operations.md | agent | 80 | Zero `` blocks | +| agents/localization-specialist.md | agent | 80 | Zero `` blocks | +| agents/seo-specialist.md | agent | 80 | Zero `` blocks | +| agents/email-specialist.md | agent | 80 | Zero `` blocks | +| commands/email-sequence.md | command | 83 | Multi-step sequence design not numbered | +| agents/quality-assurance.md | agent | 85 | Zero `` blocks | +| commands/competitor-analysis.md | command | 85 | `Task` tool used without `allowed-tools` declaration | +| commands/seo-audit.md | command | 85 | `Bash` used without `allowed-tools` declared | +| commands/check.md | command | 90 | No empty-input handling for required argument | +| commands/execute-action.md | command | 90 | No empty-input handling for required `--action` flag | +| skills/marketing-automation/SKILL.md | skill | 92 | 4 vague quantifiers ("reasonable"/"appropriate"/"correctly") | +| skills/review-response/SKILL.md | skill | 92 | 4 vague quantifiers ("relevant"/"appropriate") | +| skills/send-report/SKILL.md | skill | 94 | 3 vague quantifiers ("appropriate") | +| skills/client-proposal/SKILL.md | skill | 94 | 3 vague quantifiers ("relevant") | +| skills/launch-campaign/SKILL.md | skill | 94 | 2 unused declared tools (Glob, Grep) | +| commands/cowork-setup.md | command | 95 | Missing `allowed-tools` frontmatter field | +| commands/brand-setup.md | command | 95 | Missing `allowed-tools` frontmatter field | +| skills/language-audit/SKILL.md | skill | 96 | 2 vague quantifiers ("relevant"/"correctly") | +| skills/lead-import/SKILL.md | skill | 96 | 2 vague quantifiers ("relevant"/"correctly") | +| skills/live-dashboard/SKILL.md | skill | 96 | 2 vague quantifiers ("appropriate") | +| skills/add-integration/SKILL.md | skill | 96 | 2 vague quantifiers ("appropriate") | +| skills/campaign-orchestrator/SKILL.md | skill | 96 | 2 vague quantifiers ("correctly"/"appropriate") | +| skills/programmatic-seo/SKILL.md | skill | 98 | 1 vague quantifier ("sufficient") | +| skills/executive-dashboard/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/import-template/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/analytics-insights/SKILL.md | skill | 98 | 1 vague quantifier ("correctly") | +| skills/eval-content/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/prompt-test/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/entity-audit/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/pr-pitch/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/qbr-plan/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/webinar-plan/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/eval-config/SKILL.md | skill | 98 | 1 vague quantifier ("appropriate") | +| skills/martech-audit/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/funnel-audit/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/seo-audit/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/journey-design/SKILL.md | skill | 98 | 1 vague quantifier ("objective-appropriate") | +| skills/local-seo-audit/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/cro/SKILL.md | skill | 98 | 1 vague quantifier ("sufficient") | +| skills/team-assign/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/campaign-plan/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/aeo-audit/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/performance-report/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/pipeline-update/SKILL.md | skill | 98 | 1 vague quantifier ("relevant") | +| skills/what-if/SKILL.md | skill | 100 | none | +| skills/budget-tracker/SKILL.md | skill | 100 | none | +| skills/dark-funnel/SKILL.md | skill | 100 | none | +| skills/quality-report/SKILL.md | skill | 100 | none | +| skills/audience-intelligence/SKILL.md | skill | 100 | none | +| skills/c2pa-metadata/SKILL.md | skill | 100 | none | +| skills/recall/SKILL.md | skill | 100 | none | +| skills/intelligence-report/SKILL.md | skill | 100 | none | +| skills/seo-plan/SKILL.md | skill | 100 | none | +| skills/ab-test-plan/SKILL.md | skill | 100 | none | +| skills/focus-group/SKILL.md | skill | 100 | none | +| skills/share-of-voice/SKILL.md | skill | 100 | none | +| skills/autopilot-status/SKILL.md | skill | 100 | none | +| skills/campaign-audit/SKILL.md | skill | 100 | none | +| skills/agency-dashboard/SKILL.md | skill | 100 | none | +| skills/status/SKILL.md | skill | 100 | none | +| skills/influencer-creator/SKILL.md | skill | 100 | none | +| skills/sop-library/SKILL.md | skill | 100 | none | +| skills/search-knowledge/SKILL.md | skill | 100 | none | +| skills/market-weather/SKILL.md | skill | 100 | none | +| skills/simulate/SKILL.md | skill | 100 | none | +| skills/language-config/SKILL.md | skill | 100 | none | +| skills/local-seo/SKILL.md | skill | 100 | none | +| skills/narrative-tracker/SKILL.md | skill | 100 | none | +| skills/client-report/SKILL.md | skill | 100 | none | +| skills/content-repurpose/SKILL.md | skill | 100 | none | +| skills/cohort-analysis/SKILL.md | skill | 100 | none | +| skills/send-notification/SKILL.md | skill | 100 | none | +| skills/redirect-manager/SKILL.md | skill | 100 | none | +| skills/anomaly-scan/SKILL.md | skill | 100 | none | +| skills/four-core-documents/SKILL.md | skill | 100 | none | +| skills/competitor-pages/SKILL.md | skill | 100 | none | +| skills/integrations/SKILL.md | skill | 100 | none | +| commands/doctor.md | command | 100 | none | +| hooks/hooks.json | config | 100 | none | +| .claude-plugin/plugin.json | config | 100 | none | + +## Security Scan +| Severity | Count | +|----------|-------| +| Critical | 0 | +| High | 2 | +| Medium | 20 | +| Low | 1 | + +### Execution Surface Inventory +| Surface | Files | +|---------|-------| +| Hooks | `hooks/hooks.json` (1 file; declares zero active hooks) | +| Scripts | `scripts/*.py` (86) + `scripts/sync_model_registry.sh` (1) = 87 files | +| MCP configs | none found (no `.mcp.json` in repo) | +| Package manifests | `package.json` (root, npm), `scripts/requirements.txt` (pip) | + +### Security Findings +| # | Severity | File | Line | Pattern | Description | +|---|----------|------|------|---------|-------------| +| 1 | High | scripts/output-publisher.py | 77 | file-write-outside-repo | `get_visible_publish_dir()` resolves to `~/Documents/DigitalMarketingPro/{brand}`; `_publish_file()` copies artifacts there via `shutil.copy2()` — a write outside the repo/plugin sandbox into the user's home directory (documented "publish" feature, not attacker-controlled, but matches the HIGH pattern literally) | +| 2 | High | scripts/sync_model_registry.sh | 52 | file-write-outside-repo | Destination path is computed via `../` traversal to a sibling checkout outside the repo root, then written by the embedded Python `json.dump` at line 93; no curl-pipe-sh or unvalidated remote download present, but the write target itself escapes the repo tree | +| 3 | Medium | scripts/ai-visibility-checker.py | 164 | env-var-access | Reads `os.environ.get("OPENAI_API_KEY")` to authenticate outbound OpenAI API calls | +| 4 | Medium | scripts/ai-visibility-checker.py | 173 | network-call | Sends user-supplied query text to the OpenAI chat completions API | +| 5 | Medium | scripts/ai-visibility-checker.py | 204 | env-var-access | Reads `os.environ.get("ANTHROPIC_API_KEY")` to authenticate outbound Anthropic API calls | +| 6 | Medium | scripts/ai-visibility-checker.py | 213 | network-call | Sends user-supplied query text to the Anthropic messages API | +| 7 | Medium | scripts/brand-voice-scorer.py | 73 | network-call | `nltk.download()` silently fetches tokenizer/tagger corpus data from NLTK's remote server on first run | +| 8 | Medium | scripts/competitor-scraper.py | 75 | network-call | Fetches `robots.txt` from a host derived from the user-supplied `--url` argument (destination not hardcoded) | +| 9 | Medium | scripts/competitor-scraper.py | 168 | network-call | Fetches full page content from the user-supplied `--url` argument (arbitrary destination) | +| 10 | Medium | scripts/connector_executor.py | 269 | env-var-access | Loads entire `os.environ` as the default credential source (SLACK_BOT_TOKEN, HUBSPOT_PRIVATE_APP_TOKEN, KLAVIYO_PRIVATE_KEY, SENDGRID_API_KEY, BREVO_API_KEY, CUSTOMERIO_APP_API_KEY, MAILCHIMP_API_KEY, AHREFS_API_KEY, etc.) | +| 11 | Medium | scripts/connector_executor.py | 331 | network-call | Fires outbound HTTP requests via `urllib` to hardcoded per-connector vendor endpoints (e.g. api.hubapi.com, a.klaviyo.com) with injected credentials | +| 12 | Medium | scripts/credential-manager.py | 173 | env-var-access | `os.environ.get(v)` reads arbitrary env-var names from a stored profile JSON to check whether platform credentials are configured (boolean presence check only, no value exfiltration) | +| 13 | Medium | scripts/embed-c2pa.py | 104 | runtime-package-install | `subprocess.check_call` runs `pip install --quiet c2pa-python>=0.32` at runtime if the module is missing | +| 14 | Medium | scripts/crm-sync.py | 367 | env-var-access | `os.environ.get(env_var)` reads secret-sounding CRM token vars (SALESFORCE_ACCESS_TOKEN, HUBSPOT_ACCESS_TOKEN, ZOHO_REFRESH_TOKEN, PIPEDRIVE_API_TOKEN) to report connection status (boolean check only) | +| 15 | Medium | scripts/memory-manager.py | 360 | env-var-access | `os.environ.get(env_var)` reads secret-sounding memory-service API key vars (PINECONE_API_KEY, QDRANT_API_KEY, SUPERMEMORY_API_KEY, GRAPHITI_API_KEY) to report connection status (boolean check only) | +| 16 | Medium | scripts/refresh_models.py | 53 | env-var-access + network-call | Reads `ANTHROPIC_API_KEY` and sends it as an `x-api-key` header to hardcoded `https://api.anthropic.com/v1/models` | +| 17 | Medium | scripts/refresh_models.py | 66 | env-var-access + network-call | Reads `OPENAI_API_KEY` and sends it as a Bearer token to hardcoded `https://api.openai.com/v1/models` | +| 18 | Medium | scripts/refresh_models.py | 79 | env-var-access + network-call | Reads `GEMINI_API_KEY` and appends it as a `?key=` query param to hardcoded `generativelanguage.googleapis.com` | +| 19 | Medium | scripts/refresh_models.py | 96 | env-var-access + network-call | Reads `EVOLINK_API_KEY` and sends it as a Bearer token to hardcoded `https://direct.evolink.ai/v1/models` (lesser-known third-party host) | +| 20 | Medium | scripts/tech-seo-auditor.py | 134 | network-call-ssrf | `opener.open()` fetches an arbitrary caller-supplied URL (from `--url`/`--urls`/`--file`) with manual redirect-following and no destination allow-list — inherent to the tool's stated purpose but unrestricted network egress | +| 21 | Medium | scripts/setup.py | 274 | runtime-package-install | `subprocess.check_call()` invokes `pip install` at runtime for LITE_DEPS/FULL_DEPS package lists | +| 22 | Medium | scripts/setup.py | 285 | network-call | `nltk.download()` fetches NLTK corpus data from NLTK's remote distribution servers at runtime | +| 23 | Low | scripts/requirements.txt | 10 | unpinned-semver | `nltk>=3.8`, `textstat>=0.7`, `beautifulsoup4>=4.12`, `requests>=2.31` all use `>=` range pins instead of exact `==` pins | + +No CRITICAL patterns were found in any of the 87 scripts scanned: no `eval`/`exec` on untrusted input, no curl/wget-piped-to-shell, no reverse shells, no base64-decode-then-exec, no credential exfiltration over the network, and no backdoors. No `subprocess(shell=True)`, `os.system()`, `sudo`, PATH manipulation, or postinstall auto-run scripts were found. No `bash_arg_injection` findings were found in any of the 9 scanned commands (none pass `$ARGUMENTS`/`$1` directly into an unsanitized shell invocation). + +## Bugs (PR-worthy) +| # | File | Issue | Impact | +|---|------|-------|--------| +| 1 | commands/backlink-gap.md | Body instructs running `scripts/backlink_gap.py` (Bash) and writing `PLAN.md` (Write), but frontmatter declares no `allowed-tools` at all | Command may be denied or prompt for unexpected permissions at runtime since neither tool is authorized in frontmatter | +| 2 | commands/competitor-analysis.md | Body instructs dispatching "seven parallel `Task` tool calls" but `Task` is not declared in `allowed-tools` (frontmatter has none) | Same — undeclared tool use breaks the least-privilege contract and risks runtime denial | +| 3 | commands/seo-audit.md | Body instructs running `scripts/link-profile-analyzer.py` via Bash but no `allowed-tools` is declared | Same — undeclared Bash use | + +## Security Fixes (PR-worthy, Medium/Low only) +| # | File | Issue | Suggested Fix | +|---|------|-------|---------------| +| 1 | scripts/ai-visibility-checker.py:164,204 | Reads OpenAI/Anthropic API keys from env for outbound calls | Document required env vars in the script's docstring/README and confirm keys are never logged; no code change required if this is intentional | +| 2 | scripts/brand-voice-scorer.py:73 | `nltk.download()` performs a silent first-run network fetch | Pre-bundle the NLTK corpus in the package or gate the download behind an explicit `--allow-network-fetch` flag with a printed warning | +| 3 | scripts/competitor-scraper.py:75,168 | Fetches arbitrary user-supplied URLs (robots.txt + page content) | Add a scheme allow-list (http/https only) and reject `file://`/`localhost`/private-IP targets to reduce SSRF surface | +| 4 | scripts/connector_executor.py:269 | Loads entire `os.environ` to source credentials rather than an explicit named list | Read only the specific env-var names required per connector instead of the full environment dict | +| 5 | scripts/connector_executor.py:331 | Outbound requests to vendor endpoints with injected credentials | Confirm TLS is enforced and credentials are never included in error/log output | +| 6 | scripts/credential-manager.py:173 | Iterates arbitrary env-var names from a stored profile | Validate profile env-var names against an allow-list before calling `os.environ.get()` | +| 7 | scripts/embed-c2pa.py:104 | Runtime `pip install` of `c2pa-python` when missing | Move to a declared `requirements.txt`/`pyproject.toml` dependency and fail with a clear install instruction instead of auto-installing | +| 8 | scripts/crm-sync.py:367 | Reads CRM token env vars for presence-check only | No behavior change needed; add a comment noting only presence (not value) is read, to make the intent auditable | +| 9 | scripts/memory-manager.py:360 | Reads memory-service API key env vars for presence-check only | Same as above — document intent inline | +| 10 | scripts/refresh_models.py:53,66,79,96 | Reads 4 provider API keys and sends them to 4 hardcoded external hosts (including the lesser-known `direct.evolink.ai`) | Document all 4 outbound hosts in the script header; consider making the EVOLINK provider opt-in via a flag since it's a non-major vendor | +| 11 | scripts/tech-seo-auditor.py:134 | Unrestricted URL fetch (SSRF surface) from caller-supplied targets | Add a private-IP/localhost block-list before opening the connection | +| 12 | scripts/setup.py:274 | Runtime `pip install` of dependency lists | Prefer `requirements.txt` + documented `pip install -r requirements.txt` setup step over an in-script installer | +| 13 | scripts/setup.py:285 | `nltk.download()` network fetch at runtime | Same as brand-voice-scorer.py — pre-bundle or gate behind explicit flag | +| 14 | scripts/requirements.txt:10-15 | `nltk`, `textstat`, `beautifulsoup4`, `requests` pinned with `>=` instead of `==` | Pin exact versions (or use a lockfile) to make builds reproducible and avoid surprise upstream breakage | + +## Quality Issues (informational) +| # | File | Issue | Penalty | +|---|------|-------|---------| +| 1 | agents/analytics-analyst.md | No `model:` field in frontmatter | -5 | +| 2 | agents/analytics-analyst.md | Zero `` blocks in agent body | -15 | +| 3 | agents/analytics-analyst.md | 2 vague quantifiers ("appropriate", "sufficient") | -4 | +| 4 | agents/cro-specialist.md | No `model:` field in frontmatter | -5 | +| 5 | agents/cro-specialist.md | Zero `` blocks | -15 | +| 6 | agents/influencer-manager.md | No `model:` field in frontmatter | -5 | +| 7 | agents/influencer-manager.md | Zero `` blocks | -15 | +| 8 | agents/content-creator.md | No `model:` field in frontmatter | -5 | +| 9 | agents/content-creator.md | Zero `` blocks | -15 | +| 10 | agents/content-creator.md | 1 vague quantifier ("appropriate") | -2 | +| 11 | agents/intelligence-curator.md | No `model:` field in frontmatter | -5 | +| 12 | agents/intelligence-curator.md | Zero `` blocks | -15 | +| 13 | agents/journey-orchestrator.md | No `model:` field in frontmatter | -5 | +| 14 | agents/journey-orchestrator.md | Zero `` blocks | -15 | +| 15 | agents/media-buyer.md | No `model:` field in frontmatter | -5 | +| 16 | agents/media-buyer.md | Zero `` blocks | -15 | +| 17 | agents/media-buyer.md | 1 vague quantifier ("appropriate") | -2 | +| 18 | agents/marketing-scientist.md | No `model:` field in frontmatter | -5 | +| 19 | agents/marketing-scientist.md | Zero `` blocks | -15 | +| 20 | agents/growth-engineer.md | No `model:` field in frontmatter | -5 | +| 21 | agents/growth-engineer.md | Zero `` blocks | -15 | +| 22 | agents/social-media-manager.md | No `model:` field in frontmatter | -5 | +| 23 | agents/social-media-manager.md | Zero `` blocks | -15 | +| 24 | agents/marketing-strategist.md | No `model:` field in frontmatter | -5 | +| 25 | agents/marketing-strategist.md | Zero `` blocks | -15 | +| 26 | agents/marketing-strategist.md | 1 vague quantifier ("appropriate") | -2 | +| 27 | agents/quality-assurance.md | Zero `` blocks | -15 | +| 28 | agents/brand-guardian.md | No `model:` field in frontmatter | -5 | +| 29 | agents/brand-guardian.md | Zero `` blocks | -15 | +| 30 | agents/brand-guardian.md | 2 vague quantifiers ("appropriate" x2) | -4 | +| 31 | agents/pr-outreach.md | No `model:` field in frontmatter | -5 | +| 32 | agents/pr-outreach.md | Zero `` blocks | -15 | +| 33 | agents/pr-outreach.md | 1 vague quantifier ("relevant") | -2 | +| 34 | agents/competitive-intel.md | No `model:` field in frontmatter | -5 | +| 35 | agents/competitive-intel.md | Zero `` blocks | -15 | +| 36 | agents/crm-manager.md | No `model:` field in frontmatter | -5 | +| 37 | agents/crm-manager.md | Zero `` blocks | -15 | +| 38 | agents/memory-manager.md | No `model:` field in frontmatter | -5 | +| 39 | agents/memory-manager.md | Zero `` blocks | -15 | +| 40 | agents/memory-manager.md | 1 vague quantifier ("appropriate") | -2 | +| 41 | agents/agency-operations.md | No `model:` field in frontmatter | -5 | +| 42 | agents/agency-operations.md | Zero `` blocks | -15 | +| 43 | agents/localization-specialist.md | No `model:` field in frontmatter | -5 | +| 44 | agents/localization-specialist.md | Zero `` blocks | -15 | +| 45 | agents/performance-monitor-agent.md | No `model:` field in frontmatter | -5 | +| 46 | agents/performance-monitor-agent.md | Zero `` blocks | -15 | +| 47 | agents/performance-monitor-agent.md | 1 vague quantifier ("sufficient") | -2 | +| 48 | agents/execution-coordinator.md | No `model:` field in frontmatter | -5 | +| 49 | agents/execution-coordinator.md | Zero `` blocks | -15 | +| 50 | agents/execution-coordinator.md | `Edit` declared in `tools:` but never referenced in body | -3 | +| 51 | agents/market-intelligence.md | No `model:` field in frontmatter | -5 | +| 52 | agents/market-intelligence.md | Zero `` blocks | -15 | +| 53 | agents/market-intelligence.md | 1 vague quantifier ("relevant") | -2 | +| 54 | agents/seo-specialist.md | No `model:` field in frontmatter | -5 | +| 55 | agents/seo-specialist.md | Zero `` blocks | -15 | +| 56 | agents/email-specialist.md | No `model:` field in frontmatter | -5 | +| 57 | agents/email-specialist.md | Zero `` blocks | -15 | +| 58 | skills/send-report/SKILL.md | 3 vague quantifiers ("appropriate" x3) | -6 | +| 59 | skills/programmatic-seo/SKILL.md | 1 vague quantifier ("sufficient") | -2 | +| 60 | skills/executive-dashboard/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 61 | skills/marketing-automation/SKILL.md | 4 vague quantifiers ("reasonable", "appropriate", "correctly", "appropriate") | -8 | +| 62 | skills/import-template/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 63 | skills/analytics-insights/SKILL.md | 1 vague quantifier ("correctly") | -2 | +| 64 | skills/eval-content/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 65 | skills/prompt-test/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 66 | skills/entity-audit/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 67 | skills/pr-pitch/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 68 | skills/qbr-plan/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 69 | skills/webinar-plan/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 70 | skills/language-audit/SKILL.md | 2 vague quantifiers ("relevant", "correctly") | -4 | +| 71 | skills/client-proposal/SKILL.md | 3 vague quantifiers ("relevant" x3) | -6 | +| 72 | skills/eval-config/SKILL.md | 1 vague quantifier ("appropriate") | -2 | +| 73 | skills/lead-import/SKILL.md | 2 vague quantifiers ("relevant", "correctly") | -4 | +| 74 | skills/martech-audit/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 75 | skills/live-dashboard/SKILL.md | 2 vague quantifiers ("appropriate" x2) | -4 | +| 76 | skills/funnel-audit/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 77 | skills/add-integration/SKILL.md | 2 vague quantifiers ("appropriate" x2) | -4 | +| 78 | skills/seo-audit/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 79 | skills/journey-design/SKILL.md | 1 vague quantifier ("objective-appropriate") | -2 | +| 80 | skills/local-seo-audit/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 81 | skills/cro/SKILL.md | 1 vague quantifier ("sufficient") | -2 | +| 82 | skills/team-assign/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 83 | skills/campaign-plan/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 84 | skills/aeo-audit/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 85 | skills/campaign-orchestrator/SKILL.md | 2 vague quantifiers ("correctly", "appropriate") | -4 | +| 86 | skills/launch-campaign/SKILL.md | `Glob` declared in `allowed-tools` but never used | -3 | +| 87 | skills/launch-campaign/SKILL.md | `Grep` declared in `allowed-tools` but never used | -3 | +| 88 | skills/performance-report/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 89 | skills/pipeline-update/SKILL.md | 1 vague quantifier ("relevant") | -2 | +| 90 | skills/review-response/SKILL.md | 4 vague quantifiers ("relevant", "appropriate", "relevant", "relevant") | -8 | +| 91 | commands/email-sequence.md | Missing `allowed-tools` frontmatter field | -5 | +| 92 | commands/email-sequence.md | Multi-stage Sequence Design section (architecture, per-email blueprint, branching, deliverability checklist) presented as unordered headers/bullets, not a numbered process | -10 | +| 93 | commands/email-sequence.md | 1 vague quantifier ("appropriate") | -2 | +| 94 | commands/cowork-setup.md | Missing `allowed-tools` frontmatter field | -5 | +| 95 | commands/check.md | No empty-input handling for required `` argument | -10 | +| 96 | commands/backlink-gap.md | Missing `allowed-tools` frontmatter field | -5 | +| 97 | commands/backlink-gap.md | Required domain/competitor arguments have no "if not provided" fallback (unlike sibling commands) | -10 | +| 98 | commands/competitor-analysis.md | Missing `allowed-tools` frontmatter field | -5 | +| 99 | commands/execute-action.md | No empty-input handling for required `--action ` flag | -10 | +| 100 | commands/brand-setup.md | Missing `allowed-tools` frontmatter field | -5 | +| 101 | commands/seo-audit.md | Missing `allowed-tools` frontmatter field | -5 | + +## Cross-Component +No broken references, orphaned components, or contradictions were detected among the 100 scored artifacts — none of the four scoring passes flagged a single `broken_reference` finding (all `[[skill]]` cross-links and `scripts/*.py` references checked resolved to real files on disk). + +`plugin.json`'s description claims "158 skills, 24 agents," which matches the on-disk directory listing exactly (`ls skills/ | wc -l` = 158, `ls agents/ | wc -l` = 24) — no manifest-vs-disk drift. + +`hooks/hooks.json` intentionally ships zero active hooks; the prior hook set (SessionStart, PreToolUse Write/Edit, PreToolUse `mcp_.*`, SessionEnd) is preserved with rationale at `hooks/hooks-reference.example.json` rather than deleted, so no orphaned/dangling hook references exist. + +The systemic pattern across all 24 scored agents is identical: every one is missing both a declared `model:` tier and any `` blocks — this reads as a repo-wide authoring gap (a shared agent template that was never updated) rather than 24 independent oversights, and a single template fix would resolve ~55% of all quality-issue rows in one pass. + +## Recommendation +**BLOCKED — do not submit PRs. File private security report.** + +Two HIGH-severity findings (out-of-repo file writes in `scripts/output-publisher.py` and `scripts/sync_model_registry.sh`) trigger the block per policy, even though neither shows evidence of attacker control — both look like intentional product features (a "publish to my Documents folder" export, and a sibling-checkout registry sync) rather than exploits. A human security reviewer should confirm intent and either clear the block or file a private report with the maintainer before any contribution activity proceeds. The 3 NL bugs (undeclared `Bash`/`Write`/`Task` tool use in `commands/backlink-gap.md`, `commands/competitor-analysis.md`, `commands/seo-audit.md`) and the 14 Medium/Low security fixes are queued and PR-ready once the security block clears — none of them depend on resolving the two HIGH findings first. diff --git a/auditor/findings.jsonl b/auditor/findings.jsonl index a7a68334f..c5c2e2b0f 100644 --- a/auditor/findings.jsonl +++ b/auditor/findings.jsonl @@ -5281,6 +5281,133 @@ {"event":"finding","timestamp":"2026-07-20T12:52:16Z","audit_run_id":"29743382398","repo":"laolaoshiren/claude-code-skills-zh","commit_sha":"6034db4b6df3242803d8e16a4fd6fa4d80001d70","fingerprint":"sha256:fa5e9803f2ff3c1a834b85059c9727fc819a7d7316103668c27e40df2e83e529","category":"security","rule_id":"SEC-temp-file-write","file":"scripts/test_juejin_post.js","line":99,"severity":"low","confidence":"high","evidence":"draftScreenshot = path.join(os.tmpdir(), 'juejin_draft.png')","penalty":null,"pattern":"file-write-outside-repo","description":"Draft/publish screenshots are written to the OS temp directory, outside the repo tree","false_positive":false,"suggested_fix":"Write to a dedicated gitignored .tmp/ directory under the repo instead of os.tmpdir()"} {"event":"finding","timestamp":"2026-07-20T12:52:16Z","audit_run_id":"29743382398","repo":"laolaoshiren/claude-code-skills-zh","commit_sha":"6034db4b6df3242803d8e16a4fd6fa4d80001d70","fingerprint":"sha256:29631582352ec175acb7616f5c1d28395e17b81f944057febf3dec55b5f52a42","category":"security","rule_id":"SEC-network-call","file":"scripts/sync_readme_to_site.py","line":507,"severity":"medium","confidence":"high","evidence":"subprocess.run([\"gh\", \"api\", \"graphql\", \"-f\", f\"query={query}\"], ...) inside fetch_github_stars()","penalty":null,"pattern":"network-call","description":"Invokes gh CLI to perform an external GraphQL network call fetching GitHub star counts for every curated repo URL in README.md","false_positive":false,"suggested_fix":"No fix needed; this is a read-only, non-credentialed (uses gh's own auth) query intrinsic to the script's stated purpose"} {"event":"finding","timestamp":"2026-07-20T12:52:16Z","audit_run_id":"29743382398","repo":"laolaoshiren/claude-code-skills-zh","commit_sha":"6034db4b6df3242803d8e16a4fd6fa4d80001d70","fingerprint":"sha256:005071722d9410b31c590cc01d9a7bc5de806b1ff2423273acc32c9818b50237","category":"cross_component","rule_id":"CC-orphan-component","file":"README.md","line":null,"severity":"info","confidence":"high","evidence":"all 20 skills/*/SKILL.md directories appear in README.md's skills table with matching relative links; scripts/test_sync_readme_to_site.py::test_original_skill_sets_and_promo_counts_are_consistent already asserts this at test time","penalty":null,"pattern":"none","description":"No broken references or orphaned skill directories found; README, docs/index.html, and PROMO.md skill counts are cross-checked by an existing repo test","false_positive":false,"suggested_fix":""} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:e1d178896dff66c6b0a060b238c142fd7c33c26fab62f6d20f787053e052f2ba","category":"bug","rule_id":"BUG-undeclared-tool","file":"commands/backlink-gap.md","line":null,"severity":"medium","confidence":"high","evidence":"body runs scripts/backlink_gap.py via Bash (line 33) and writes PLAN.md via Write (line 38); frontmatter declares no allowed-tools field","penalty":null,"pattern":"undeclared-tool-use","description":"Command invokes Bash and Write with no allowed-tools declared in frontmatter","false_positive":false,"suggested_fix":"Add allowed-tools: Bash, Write to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:0ffff41f60afdafe4296296d53db8b96827c065d52fee1e1a186239a7385b6fc","category":"bug","rule_id":"BUG-undeclared-tool","file":"commands/competitor-analysis.md","line":139,"severity":"medium","confidence":"high","evidence":"body instructs dispatching seven parallel Task tool calls (line 139); frontmatter declares no allowed-tools field","penalty":null,"pattern":"undeclared-tool-use","description":"Command invokes Task tool with no allowed-tools declared in frontmatter","false_positive":false,"suggested_fix":"Add allowed-tools: Task to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:2cf9a0689d6ee3ec6ce668b2a3cef419f16858779101ebbb3a2266830bc940f5","category":"bug","rule_id":"BUG-undeclared-tool","file":"commands/seo-audit.md","line":166,"severity":"medium","confidence":"high","evidence":"Execution discipline section runs scripts/link-profile-analyzer.py via Bash (lines 163-166); frontmatter declares no allowed-tools field","penalty":null,"pattern":"undeclared-tool-use","description":"Command invokes Bash with no allowed-tools declared in frontmatter","false_positive":false,"suggested_fix":"Add allowed-tools: Bash to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:fe68d3f90a9e1d97049da53c3d5baa9180f3d39e7b8fdf84ed78c0a2bceae4bd","category":"security","rule_id":"SEC-file-write-outside-repo","file":"scripts/output-publisher.py","line":77,"severity":"high","confidence":"high","evidence":"get_visible_publish_dir() resolves to ~/Documents/DigitalMarketingPro/{brand}; _publish_file() copies artifacts there via shutil.copy2() at line 118","penalty":null,"pattern":"file-write-outside-repo","description":"Writes published artifacts outside the repo/plugin sandbox into the user's home directory","false_positive":false,"suggested_fix":"Document the publish directory explicitly in README/skill docs and confirm the destination is user-configurable, not hardcoded"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:0ca4a72c5bad89d4f8d0ec874d32a125bd9288361d952dd0786b90a84904c902","category":"security","rule_id":"SEC-file-write-outside-repo","file":"scripts/sync_model_registry.sh","line":52,"severity":"high","confidence":"high","evidence":"dest path computed via ../ traversal from REPO_ROOT to a sibling checkout outside the repo root; written by embedded python json.dump at line 93","penalty":null,"pattern":"file-write-outside-repo","description":"Writes model_registry.json to a sibling directory outside the repo root via relative traversal","false_positive":false,"suggested_fix":"Make the sibling-repo destination an explicit, validated CLI argument rather than an implicit ../ traversal"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:d916d561a2f805621e5c65036f20584be9d872a272e8f574079d71a93345aedf","category":"security","rule_id":"SEC-env-var-access","file":"scripts/ai-visibility-checker.py","line":164,"severity":"medium","confidence":"high","evidence":"os.environ.get(\"OPENAI_API_KEY\") read to authenticate outbound OpenAI API call","penalty":null,"pattern":"env-var-access","description":"Reads OPENAI_API_KEY from environment to authenticate an outbound API call","false_positive":false,"suggested_fix":"Document required env vars in script docstring/README"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:afc01fe44527285cbe7b225d567a77e77a5a38ba6cc64f5c953febdd055333f7","category":"security","rule_id":"SEC-network-call","file":"scripts/ai-visibility-checker.py","line":173,"severity":"medium","confidence":"high","evidence":"sends user-supplied query text to OpenAI chat completions API endpoint","penalty":null,"pattern":"network-call","description":"Sends user-supplied query text to the OpenAI chat completions API","false_positive":false,"suggested_fix":"Document outbound API destination and confirm query text does not include secrets"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:063e34a09577b99213ad9c9c61249a8f249dec2cf611c211e693ccc405116209","category":"security","rule_id":"SEC-env-var-access","file":"scripts/ai-visibility-checker.py","line":204,"severity":"medium","confidence":"high","evidence":"os.environ.get(\"ANTHROPIC_API_KEY\") read to authenticate outbound Anthropic API call","penalty":null,"pattern":"env-var-access","description":"Reads ANTHROPIC_API_KEY from environment to authenticate an outbound API call","false_positive":false,"suggested_fix":"Document required env vars in script docstring/README"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:6c1b6a93e891e392877750863e4d4bf604cca87db4ad5d49ac0a431dec9f091c","category":"security","rule_id":"SEC-network-call","file":"scripts/ai-visibility-checker.py","line":213,"severity":"medium","confidence":"high","evidence":"sends user-supplied query text to Anthropic messages API endpoint","penalty":null,"pattern":"network-call","description":"Sends user-supplied query text to the Anthropic messages API","false_positive":false,"suggested_fix":"Document outbound API destination and confirm query text does not include secrets"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:da1ccad920dd595f5bf75d6fe48af3c646ecc612fd8e7c67a15a06e11580f9c9","category":"security","rule_id":"SEC-network-call","file":"scripts/brand-voice-scorer.py","line":73,"severity":"medium","confidence":"high","evidence":"nltk.download() call with no gating flag","penalty":null,"pattern":"network-call","description":"nltk.download() silently fetches tokenizer/tagger corpus data from NLTK's remote server on first run","false_positive":false,"suggested_fix":"Pre-bundle the NLTK corpus or gate the download behind an explicit --allow-network-fetch flag with a printed warning"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:edbf3c3b094e885403fa95ec9b015222829d5e2ba3d284d9fdcb35f80767c74f","category":"security","rule_id":"SEC-network-call","file":"scripts/competitor-scraper.py","line":75,"severity":"medium","confidence":"high","evidence":"fetches robots.txt from a host derived from the user-supplied --url argument","penalty":null,"pattern":"network-call","description":"Fetches robots.txt from an arbitrary, caller-supplied destination","false_positive":false,"suggested_fix":"Add a scheme allow-list and reject file://, localhost, and private-IP targets"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:ad07366eef2fca3ae6d6462ee55da986f7aa3ad6cd8c4f232157fea33c5b2161","category":"security","rule_id":"SEC-network-call","file":"scripts/competitor-scraper.py","line":168,"severity":"medium","confidence":"high","evidence":"fetches full page content from the user-supplied --url argument","penalty":null,"pattern":"network-call","description":"Fetches page content from an arbitrary, caller-supplied destination","false_positive":false,"suggested_fix":"Add a scheme allow-list and reject file://, localhost, and private-IP targets"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:d4c46cf92a5942860799667c0bd62be0f22e8802a4c058bedd1a80211c493d3d","category":"security","rule_id":"SEC-env-var-access","file":"scripts/connector_executor.py","line":269,"severity":"medium","confidence":"high","evidence":"loads entire os.environ as the default credential source (SLACK_BOT_TOKEN, HUBSPOT_PRIVATE_APP_TOKEN, KLAVIYO_PRIVATE_KEY, SENDGRID_API_KEY, BREVO_API_KEY, CUSTOMERIO_APP_API_KEY, MAILCHIMP_API_KEY, AHREFS_API_KEY, etc.)","penalty":null,"pattern":"env-var-access","description":"Loads the entire environment dict as the credential source instead of an explicit named allow-list","false_positive":false,"suggested_fix":"Read only the specific env-var names required per connector instead of the full environment"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:c29a049dae7429b269f1a3e43df2136f6429aaec2dc63612d4789d817a7170bb","category":"security","rule_id":"SEC-network-call","file":"scripts/connector_executor.py","line":331,"severity":"medium","confidence":"high","evidence":"fires outbound HTTP requests via urllib to hardcoded per-connector vendor endpoints (e.g. api.hubapi.com, a.klaviyo.com) with injected credentials","penalty":null,"pattern":"network-call","description":"Sends injected credentials to hardcoded external vendor endpoints","false_positive":false,"suggested_fix":"Confirm TLS is enforced and credentials are never included in error/log output"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:d3226134dd4ebe4e70a74e566be3acb0e566f83bc423d88a449766950905da53","category":"security","rule_id":"SEC-env-var-access","file":"scripts/credential-manager.py","line":173,"severity":"medium","confidence":"high","evidence":"os.environ.get(v) reads arbitrary env-var names loaded from a stored profile JSON (validate-profile action); boolean presence check only","penalty":null,"pattern":"env-var-access","description":"Iterates arbitrary env-var names from a stored profile to check credential presence","false_positive":false,"suggested_fix":"Validate profile env-var names against an allow-list before calling os.environ.get()"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:33a14cd181eecb070c681a104bb83776ef133e8a32ad7068547f0cc7b5323152","category":"security","rule_id":"SEC-postinstall-script","file":"scripts/embed-c2pa.py","line":104,"severity":"medium","confidence":"high","evidence":"subprocess.check_call runs pip install --quiet c2pa-python>=0.32 at runtime if the module is missing","penalty":null,"pattern":"runtime-package-install","description":"Auto-installs a third-party package at runtime when missing","false_positive":false,"suggested_fix":"Move c2pa-python to a declared requirements.txt dependency instead of auto-installing"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:1b7138044a038090c491380789c893a238b2eaefa8abafc14e7ccb7d4a3c7305","category":"security","rule_id":"SEC-env-var-access","file":"scripts/crm-sync.py","line":367,"severity":"medium","confidence":"high","evidence":"os.environ.get(env_var) reads SALESFORCE_ACCESS_TOKEN, HUBSPOT_ACCESS_TOKEN, ZOHO_REFRESH_TOKEN, PIPEDRIVE_API_TOKEN; boolean presence check only, no value exfiltration","penalty":null,"pattern":"env-var-access","description":"Reads CRM token env vars to report connection status (presence check only)","false_positive":false,"suggested_fix":"Add inline comment noting only presence (not value) is read, to make intent auditable"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:6209ac0cc77198bd598ad3b889123e36d99dea23778c826af9c7633795100b6c","category":"security","rule_id":"SEC-env-var-access","file":"scripts/memory-manager.py","line":360,"severity":"medium","confidence":"high","evidence":"os.environ.get(env_var) reads PINECONE_API_KEY, QDRANT_API_KEY, SUPERMEMORY_API_KEY, GRAPHITI_API_KEY; boolean presence check only, no value exfiltration","penalty":null,"pattern":"env-var-access","description":"Reads memory-service API key env vars to report connection status (presence check only)","false_positive":false,"suggested_fix":"Add inline comment noting only presence (not value) is read, to make intent auditable"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:bce899d00e0c7f504a31019572a7b84ee3ffa362d0f0e4051be1e6f71aa189b4","category":"security","rule_id":"SEC-env-var-access","file":"scripts/refresh_models.py","line":53,"severity":"medium","confidence":"high","evidence":"reads ANTHROPIC_API_KEY and sends it as x-api-key header to hardcoded https://api.anthropic.com/v1/models (line 57)","penalty":null,"pattern":"env-var-access+network-call","description":"Sends ANTHROPIC_API_KEY to a hardcoded external endpoint","false_positive":false,"suggested_fix":"Document all outbound provider hosts in the script header"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:8288de1d0a9a16dd7327f9dc5aa356c628ef568610dbe7ba07a5e83cd1ee7ebe","category":"security","rule_id":"SEC-env-var-access","file":"scripts/refresh_models.py","line":66,"severity":"medium","confidence":"high","evidence":"reads OPENAI_API_KEY and sends it as a Bearer token to hardcoded https://api.openai.com/v1/models (line 70)","penalty":null,"pattern":"env-var-access+network-call","description":"Sends OPENAI_API_KEY to a hardcoded external endpoint","false_positive":false,"suggested_fix":"Document all outbound provider hosts in the script header"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:3fa287fb5a721c57e6dfac51b4164a21d699112307237d123e7d2d9e00e4cdc7","category":"security","rule_id":"SEC-env-var-access","file":"scripts/refresh_models.py","line":79,"severity":"medium","confidence":"high","evidence":"reads GEMINI_API_KEY and appends it as a ?key= query param to hardcoded generativelanguage.googleapis.com (line 83)","penalty":null,"pattern":"env-var-access+network-call","description":"Sends GEMINI_API_KEY as a URL query parameter to a hardcoded external endpoint","false_positive":false,"suggested_fix":"Prefer sending API keys via headers rather than URL query parameters to avoid key leakage into logs/proxies"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:f9e36a6e31e42674863c5d5a4e8b504a707a0de7abab55fc8d4fc42eeebf64a9","category":"security","rule_id":"SEC-env-var-access","file":"scripts/refresh_models.py","line":96,"severity":"medium","confidence":"high","evidence":"reads EVOLINK_API_KEY and sends it as a Bearer token to hardcoded https://direct.evolink.ai/v1/models (line 100), a lesser-known third-party host","penalty":null,"pattern":"env-var-access+network-call","description":"Sends EVOLINK_API_KEY to a hardcoded, lesser-known third-party endpoint","false_positive":false,"suggested_fix":"Make the EVOLINK provider opt-in via a flag since it is a non-major vendor; document the host explicitly"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:9e5d452198432811152f56b9722ac036da2a601d57ae54628c6fae3c14fe8576","category":"security","rule_id":"SEC-network-call","file":"scripts/tech-seo-auditor.py","line":134,"severity":"medium","confidence":"high","evidence":"opener.open() fetches an arbitrary caller-supplied URL (from --url/--urls/--file) with manual redirect-following and no destination allow-list","penalty":null,"pattern":"network-call-ssrf","description":"Unrestricted URL fetch of caller-supplied targets with no private-IP/localhost block-list","false_positive":false,"suggested_fix":"Add a private-IP/localhost block-list before opening the connection"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:94695c87ab50cf5e8905daf3b025fe4ed811a0e7cf5fa4c9197bb8c1d66e934f","category":"security","rule_id":"SEC-postinstall-script","file":"scripts/setup.py","line":274,"severity":"medium","confidence":"high","evidence":"subprocess.check_call() invokes pip install at runtime for LITE_DEPS/FULL_DEPS package lists","penalty":null,"pattern":"runtime-package-install","description":"Runtime pip install of dependency lists during setup script execution","false_positive":false,"suggested_fix":"Prefer requirements.txt + documented pip install -r requirements.txt setup step"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:1cd4baac2804b9f0b0f002bf8065becd38dfea9bad674b1e4ded04704cffe28f","category":"security","rule_id":"SEC-network-call","file":"scripts/setup.py","line":285,"severity":"medium","confidence":"high","evidence":"nltk.download() fetches NLTK corpus data packages from NLTK's remote distribution servers at runtime","penalty":null,"pattern":"network-call","description":"Runtime network fetch of NLTK corpus data during setup","false_positive":false,"suggested_fix":"Pre-bundle NLTK corpus data or gate the download behind an explicit flag"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:b68848e21f0446fd28e27b0de0b1eee655ba80756d74de55c14b16ddd5de7d87","category":"security","rule_id":"SEC-unpinned-semver","file":"scripts/requirements.txt","line":10,"severity":"low","confidence":"high","evidence":"nltk>=3.8, textstat>=0.7, beautifulsoup4>=4.12, requests>=2.31 (lines 10-15) use >= range pins instead of exact == pins","penalty":null,"pattern":"unpinned-dependency","description":"Multiple dependencies pinned with >= range instead of exact version, risking non-reproducible builds","false_positive":false,"suggested_fix":"Pin exact versions or adopt a lockfile"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:d97bf51922cc8967264703cc5e637db2a75c269aead714ad9d744ae8169594d7","category":"nl_quality","rule_id":"R10","file":"agents/analytics-analyst.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:0042ce61989b8b2fe939f704daeee07c148864b2d3325473756fb348b0e315b1","category":"nl_quality","rule_id":"R09","file":"agents/analytics-analyst.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:60f5b77b3aae441f6d4351b236cdf0692f594e0d200f89fbff268e02982017ad","category":"nl_quality","rule_id":"R01","file":"agents/analytics-analyst.md","line":27,"severity":"low","confidence":"high","evidence":"\"recommend the appropriate measurement method\" (line 27); \"whether the sample size is sufficient for confidence\" (line 28)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"appropriate\", \"sufficient\") used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace with measurable selection criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:b7f0059b918545cded21dc4dad404b25191fe5d5e28f5c1f627419c082b1c5f6","category":"nl_quality","rule_id":"R10","file":"agents/cro-specialist.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:9f9c7641e64ec90efcfda05420af2def80a71f7cd175ec45c2d64b42a536e962","category":"nl_quality","rule_id":"R09","file":"agents/cro-specialist.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:ab53765f9ba6b2d6d11015ed87c1ba2c11cddf0d84c90f42c25314312337d57f","category":"nl_quality","rule_id":"R10","file":"agents/influencer-manager.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:c8cd94c7eecddf118ea6be0dcd5bc110c2b46c61c0d3231d5aa6d9c0e39c61e5","category":"nl_quality","rule_id":"R09","file":"agents/influencer-manager.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:b18bcc6f0fb38437dd55d2f12a3f84996be908a31a9a7c6464c5a2ba12e9de64","category":"nl_quality","rule_id":"R10","file":"agents/content-creator.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:7d611ad4be891f7dd42218691edea39865b1dd0c67ebac05d3487446237091a2","category":"nl_quality","rule_id":"R09","file":"agents/content-creator.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:14b721f4a3809f3edb50307965b1905d6f64f5303310a62003a67f1ba244f05a","category":"nl_quality","rule_id":"R01","file":"agents/content-creator.md","line":75,"severity":"low","confidence":"high","evidence":"\"ensure audience-appropriate reading level\" (line 75)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with a measurable reading-level target (e.g. Flesch score range)"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:a93aa65e07e88567ee670214993367e6606389c92922006a0e600c39308dd17d","category":"nl_quality","rule_id":"R10","file":"agents/intelligence-curator.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:a603d2c0a19f13805b8ca766598c80544c0f5e8a99af966a479a8c8d6afab234","category":"nl_quality","rule_id":"R09","file":"agents/intelligence-curator.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:5b109ede918da67cd5cc3485db607bf06dd3544df42876da8d6d855cab309b2b","category":"nl_quality","rule_id":"R10","file":"agents/journey-orchestrator.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:0eb4e48933d9f64d99d300ba51c4ce812adcd63ad172a75b7ea6df8cc5dc47a9","category":"nl_quality","rule_id":"R09","file":"agents/journey-orchestrator.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:266ccd58aae3ff4115fa6b236157b659a5d5e1171881eaf7cad288b793d87b5e","category":"nl_quality","rule_id":"R10","file":"agents/media-buyer.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:47a5f149b27bc01aee9be0aae2c678424e5a9d65c29c12d89fd52e5eb64ff0d0","category":"nl_quality","rule_id":"R09","file":"agents/media-buyer.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:0fc38ddf82ef281332c741459693ba224beefd9fc5d51b61b89b919777bb5194","category":"nl_quality","rule_id":"R01","file":"agents/media-buyer.md","line":26,"severity":"low","confidence":"high","evidence":"\"content category blocklists where appropriate\" (line 26)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit blocklist criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:0b1bb804dd199228b00789e8856be23a2d5195370a5eb81a0f9b93ea6bae0824","category":"nl_quality","rule_id":"R10","file":"agents/marketing-scientist.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:1003f658d50c31d6084631b5e166f5df9620e5905b4ef6d0303e20675b32e638","category":"nl_quality","rule_id":"R09","file":"agents/marketing-scientist.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:190e8d7c9b504a8b22056138ecd09dba26926b5634d457e1818ab0f0ed344674","category":"nl_quality","rule_id":"R10","file":"agents/growth-engineer.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:c9e385348b4ae3d1d2e0b7ba7ebf1f9e8d20da264cd63a89c226429ecfa62410","category":"nl_quality","rule_id":"R09","file":"agents/growth-engineer.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:d7def36add7a805238388ce8f244fa3e33ef47503f09f25bbfcdbf2720586ef7","category":"nl_quality","rule_id":"R10","file":"agents/social-media-manager.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:8ca6b16f95ac3df8510d103b463191428ffebcb95668a165a38d0c0bad601e6b","category":"nl_quality","rule_id":"R09","file":"agents/social-media-manager.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:7294847db80d7bcd0e886e9846a51be5c0575270eb32017ef5ed9ac7549374a4","category":"nl_quality","rule_id":"R10","file":"agents/marketing-strategist.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:06832d0f9fb583b29bc26081e9b78234f6995b8418b5edd4a280bf13fb312742","category":"nl_quality","rule_id":"R09","file":"agents/marketing-strategist.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:efb75651a71686354a3b630d758b026984b86c580aa880a90d1d6a1a6cd3e0b3","category":"nl_quality","rule_id":"R01","file":"agents/marketing-strategist.md","line":97,"severity":"low","confidence":"high","evidence":"\"recommend the appropriate specialist agents\" (line 97)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit agent-selection criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:16d02a3813c71efde86af676df20f1e3169ed4663f1d0881b5f39cb06b524c57","category":"nl_quality","rule_id":"R09","file":"agents/quality-assurance.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:20321499fac532d077cc29289cdbccf349cf3d9e0043c7e9b00e5a682b7e4e2e","category":"nl_quality","rule_id":"R10","file":"agents/brand-guardian.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:30fe7493ac7102efc78d685c2f3f1971f0bbaafb0855207162e633a67af499ba","category":"nl_quality","rule_id":"R09","file":"agents/brand-guardian.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:0fbac743bdcfcfc69b769663bacfdd550f58e6bb1ab4582b935a3624d43301e9","category":"nl_quality","rule_id":"R01","file":"agents/brand-guardian.md","line":14,"severity":"low","confidence":"high","evidence":"\"ensuring channel-appropriate voice adaptation\" (line 14); \"clear, conspicuous, and platform-appropriate\" (line 30)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"appropriate\" x2) used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit per-channel/per-platform criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:e127308b42f241007f44103e3d5b0da3ee7b493b18472ef1158119fae2152bcb","category":"nl_quality","rule_id":"R10","file":"agents/pr-outreach.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:9cd553998373832d49c9006b1a15c8f70398bde43456059e2cc9e0871b527fca","category":"nl_quality","rule_id":"R09","file":"agents/pr-outreach.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:8639dd0f7bf254f470c5ab908b5b332eece520e8f74ef8f41eba561c215cdebb","category":"nl_quality","rule_id":"R01","file":"agents/pr-outreach.md","line":30,"severity":"low","confidence":"high","evidence":"\"a clear reason why this story is relevant to them specifically\" (line 30)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit relevance criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:21e2244534faebd83bbeb5b99a6dc229ef1f8faad8f06c6c18205658447c0f4b","category":"nl_quality","rule_id":"R10","file":"agents/competitive-intel.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:3814b9c669ee9f35ffb4e51ef2ca0f6911e452d63b4df6c8be486def6c65a867","category":"nl_quality","rule_id":"R09","file":"agents/competitive-intel.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:e22f8d7d61a527014c28d678d9f87d08ddd10537fc49b3afbe00eccb0c692db4","category":"nl_quality","rule_id":"R10","file":"agents/crm-manager.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:44f7185b982c4bd12ef54a5b3eee6b8b9d45bbfca3aaf6900211e9ab7bfaa343","category":"nl_quality","rule_id":"R09","file":"agents/crm-manager.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:9ebd585cd5bbb3c817d1a1e18e42e70a2594141265a52037c887b64492119e1e","category":"nl_quality","rule_id":"R10","file":"agents/memory-manager.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:d27f9e3a36d1a5b6bfdec50d0b7ec900f42ff47546d0991d27316898e4415a15","category":"nl_quality","rule_id":"R09","file":"agents/memory-manager.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:69a8cd41fa1f7d9e530143daadf302906df16601646f1768cc0c85e633402dd8","category":"nl_quality","rule_id":"R01","file":"agents/memory-manager.md","line":33,"severity":"low","confidence":"high","evidence":"\"Recommend the appropriate memory layer based on query type\" (line 33)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit memory-layer selection criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:b1b36368c20bfdbe66c7ea6aa886da08289c31d4e97128a3037621475b4ffe19","category":"nl_quality","rule_id":"R10","file":"agents/agency-operations.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:ac6713e0175cd0f8e59887f3214f10f19a7475a669aaaa9852d428c0a9815ef2","category":"nl_quality","rule_id":"R09","file":"agents/agency-operations.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:1a9ad8616fda22dcd984f9494822c0d4389e7f4186901c590e5c9a76e1d8e6be","category":"nl_quality","rule_id":"R10","file":"agents/localization-specialist.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:73fd1f3eeaca95bc91a2bbd5c094a51c73852b0fe9ac259d6d75fe18e47d4811","category":"nl_quality","rule_id":"R09","file":"agents/localization-specialist.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:8ce0db37cb4a37a53176d438d40ec6402f4dee57d0145d90db23b1157f0e0e15","category":"nl_quality","rule_id":"R10","file":"agents/performance-monitor-agent.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:9869ec528b6474d5b401a9d96596cc57417a6c9c94b86d48633f6a4be120cf71","category":"nl_quality","rule_id":"R09","file":"agents/performance-monitor-agent.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:342e0748b056a5577bcfeb340e12489cb804ad6a8ed402715886ad251c75832b","category":"nl_quality","rule_id":"R01","file":"agents/performance-monitor-agent.md","line":24,"severity":"low","confidence":"high","evidence":"\"Without sufficient data, note the observation as 'insufficient baseline'\" (line 24)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"sufficient\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit minimum sample size"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:aabec1fb31b7ec9fc9cf1ae29aa9ef4ec517d90ed473e342cc7d0c1e9b1e4f0f","category":"nl_quality","rule_id":"R10","file":"agents/execution-coordinator.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:3393e354c9bc0cd2ab8cb0eeb51d52d0acd49b32a95acae643db3740b7d3ea32","category":"nl_quality","rule_id":"R09","file":"agents/execution-coordinator.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:4d97192d1b2680a5d11fd8fed88a8705dc88b5a76926cce67a4a4da17ee9498f","category":"nl_quality","rule_id":"R11","file":"agents/execution-coordinator.md","line":5,"severity":"low","confidence":"high","evidence":"tools: Read, Write, Edit, Grep, Glob, Bash, WebFetch (line 5); body only describes remote CMS/platform publishing via MCP and script calls, no local file editing described","penalty":-3,"pattern":"unused_tool","description":"Edit tool declared but never referenced or invoked in the agent body","false_positive":false,"suggested_fix":"Remove Edit from the declared tools list, or add a body section that legitimately uses it"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:4d6d8c560c151da794775f67fb3b938ef0f104dc537a4828e1d340c7163f46e5","category":"nl_quality","rule_id":"R10","file":"agents/market-intelligence.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:dd3a773b584085e403186240e020294f78e7f2e08ca24115b046ef83dfb11c83","category":"nl_quality","rule_id":"R09","file":"agents/market-intelligence.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:cb3966bb83d68470ff325b42672fffc2ac78c03f6ee51d8989b7f284ff3e6a3b","category":"nl_quality","rule_id":"R01","file":"agents/market-intelligence.md","line":15,"severity":"low","confidence":"high","evidence":"\"moments worth joining (brand-relevant, authentic fit)\" (line 15)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit brand-fit criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:5e5688b56fb14eb9df166a711c83ac65d48be2a54a599e8ca7bcf888ae684086","category":"nl_quality","rule_id":"R10","file":"agents/seo-specialist.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:f8653cd2b4088347927d2ca44729f46dfc93ecb261441e8af753fbddd9b521fc","category":"nl_quality","rule_id":"R09","file":"agents/seo-specialist.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:fa384d955d3296f489ee0a187afd9a714099110b6199ef2b9c15b234ca072473","category":"nl_quality","rule_id":"R10","file":"agents/email-specialist.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field","penalty":-5,"pattern":"model_not_declared","description":"No model tier declared in agent frontmatter","false_positive":false,"suggested_fix":"Add model: sonnet (or appropriate tier) to frontmatter"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:d8b04d74064985789318e4d09c33147524acd6f15f3b3eb367709cc2a6ffc5d1","category":"nl_quality","rule_id":"R09","file":"agents/email-specialist.md","line":null,"severity":"medium","confidence":"high","evidence":"no tag present in the file","penalty":-15,"pattern":"missing_examples","description":"Zero blocks in agent body","false_positive":false,"suggested_fix":"Add 2+ blocks with Context + user message + assistant response"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:ceb897c950c048b07a9778983d655155640569c1cc7c09bdbf7d88c45a3d035e","category":"nl_quality","rule_id":"R01","file":"skills/send-report/SKILL.md","line":12,"severity":"low","confidence":"high","evidence":"\"with appropriate approval gates\" (line 12); \"Apply the appropriate template depth\" (line 47); \"appropriate permissions\" (line 51)","penalty":-6,"pattern":"vague_quantifier","description":"3 vague quantifiers (\"appropriate\" x3) used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:3972e93e60297e16af90b92154cc4efb5780e2d1e1f79c217fba3cc228fc1f8e","category":"nl_quality","rule_id":"R01","file":"skills/programmatic-seo/SKILL.md","line":47,"severity":"low","confidence":"high","evidence":"\"Word count per page | <300 | Flag for review (may lack sufficient value)\" (line 47)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"sufficient\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit word-count threshold"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:4020e2f20c9fa64e65621b427beec11c5b472a57aa865138857b1a6929759cb0","category":"nl_quality","rule_id":"R01","file":"skills/executive-dashboard/SKILL.md","line":27,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 27)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:252175ad6b05fe858c55f6dfe16cdfaf5ddb70635482008a2b9dfa94d9372d4d","category":"nl_quality","rule_id":"R01","file":"skills/marketing-automation/SKILL.md","line":57,"severity":"low","confidence":"high","evidence":"\"infer reasonable defaults\" (line 57); \"stage-appropriate messaging\" (line 101); \"fire correctly\" (line 108); \"MAP appropriate for the business size\" (line 156)","penalty":-8,"pattern":"vague_quantifier","description":"4 vague quantifiers (\"reasonable\", \"appropriate\" x2, \"correctly\") used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:3e0b2bf30317c851b68b79c3b48f87ba85bfa03cd2f88f78fde544de038c13b8","category":"nl_quality","rule_id":"R01","file":"skills/import-template/SKILL.md","line":26,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 26)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:178a0a148f42ccb3671a3c4cd3f0abaf475474f1242b5d58bede8cde64bef38e","category":"nl_quality","rule_id":"R01","file":"skills/analytics-insights/SKILL.md","line":142,"severity":"low","confidence":"high","evidence":"\"Is the tracking code still firing correctly?\" (line 142)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"correctly\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit verification check (e.g. expected event payload)"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:b6a1857999c6716a650163a7ffeed7563bae60b301b050be73286a72ef76d4fc","category":"nl_quality","rule_id":"R01","file":"skills/eval-content/SKILL.md","line":26,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files (especially messaging.md ... visual-identity.md)\" (line 26)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:e2e67d732b16fda084b79762501c11507aa6b6ecbda7a73fde0f7cfaa55b58b4","category":"nl_quality","rule_id":"R01","file":"skills/prompt-test/SKILL.md","line":28,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files (voice-and-tone rules, messaging hierarchy, channel style guides)\" (line 28)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:b6a32b5b4a916d7e3db433debe01e5de62b64c741792054e7176e8baa1874dbc","category":"nl_quality","rule_id":"R01","file":"skills/entity-audit/SKILL.md","line":27,"severity":"low","confidence":"high","evidence":"\"For each relevant directory, verify the listing exists and check data consistency\" (line 27)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit directory list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:371b51edcea566efcc1ebaddd71f4a59ab370231bedf1f7a51ec67c10f35914f","category":"nl_quality","rule_id":"R01","file":"skills/pr-pitch/SKILL.md","line":26,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 26)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:991ac015b3b771912ba32b665a4932ace7931a46a4eb42d658fa1ecb458be023","category":"nl_quality","rule_id":"R01","file":"skills/qbr-plan/SKILL.md","line":29,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 29)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:b7d4d83473aee12813ac7017dcd1549ee9e47d9549f95fbe3b964fbf120754ea","category":"nl_quality","rule_id":"R01","file":"skills/webinar-plan/SKILL.md","line":30,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 30)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:990b8a813b24a21a84985eff2d38ad37a1e1ba204a429c71d8d6aef90f2cf384","category":"nl_quality","rule_id":"R01","file":"skills/language-audit/SKILL.md","line":24,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files for market-specific content rules\" (line 24); \"present and correctly localized\" (line 29)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"relevant\", \"correctly\") used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:8690b8b3fb55e4e89af6a58684a26172b994351a1dcc141cab46769e56da37ab","category":"nl_quality","rule_id":"R01","file":"skills/client-proposal/SKILL.md","line":29,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 29); \"Pull relevant industry performance data\" (line 30); \"Frame placeholders for relevant case studies\" (line 35)","penalty":-6,"pattern":"vague_quantifier","description":"3 vague quantifiers (\"relevant\" x3) used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:4d0aa441017d4659c7f677f8170b41ac1f5c0dcfea2e80262e091ac3ba433bd2","category":"nl_quality","rule_id":"R01","file":"skills/eval-config/SKILL.md","line":40,"severity":"low","confidence":"high","evidence":"\"Analyze the brand's industry, audience, content strategy, and compliance requirements to suggest appropriate settings\" (line 40)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit settings-selection criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:dd2eff91c3b812aeac0ad5111cec2246029fab333c5dc00f6f271b132e4acf5b","category":"nl_quality","rule_id":"R01","file":"skills/lead-import/SKILL.md","line":44,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 44); \"verify field values, scoring data, source attribution, and assignment all transferred correctly\" (line 54)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"relevant\", \"correctly\") used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:3da13890611b43f3c19112d6e143b4954f42c8b59339d717e438c8440089a09c","category":"nl_quality","rule_id":"R01","file":"skills/martech-audit/SKILL.md","line":28,"severity":"low","confidence":"high","evidence":"\"load restrictions and relevant category files\" (line 28)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:ad79864508c1988be9bb18add8cee949d26c56fd65e47a1c66900b90cd0f5274","category":"nl_quality","rule_id":"R01","file":"skills/live-dashboard/SKILL.md","line":12,"severity":"low","confidence":"high","evidence":"\"Auto-selects appropriate metrics, dimensions, and chart types\" (line 12); \"Select the appropriate metric hierarchy and page structure\" (line 36)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"appropriate\" x2) used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit selection criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:9538d8e100dda307fdc4d93ca8beef605679eb8d5842313f35f37c2ea873752b","category":"nl_quality","rule_id":"R01","file":"skills/funnel-audit/SKILL.md","line":26,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 26)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:1f90b5013125b3084777197ad90e6fee75a2a022584ad4b286ea3e0c4a569f35","category":"nl_quality","rule_id":"R01","file":"skills/add-integration/SKILL.md","line":27,"severity":"low","confidence":"high","evidence":"\"add the credentials to the appropriate credential profile\" (line 27); \"add the new integration's credential mapping to the appropriate profile\" (line 29)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"appropriate\" x2) used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit profile-selection criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:f6de1ac965a1afdc4f4a7d79d69043e73af80c590847073f018f1fa91ab1e76c","category":"nl_quality","rule_id":"R01","file":"skills/seo-audit/SKILL.md","line":36,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 36)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:206816a6ec13812f5c3a67e3afd8e12009c8b9416139520f63262fb282c7eae2","category":"nl_quality","rule_id":"R01","file":"skills/journey-design/SKILL.md","line":21,"severity":"low","confidence":"high","evidence":"\"the system designs based on objective-appropriate defaults\" (line 21)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"objective-appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit per-objective default table"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:b57554a48db5a254eb109cc6070f2bb88b7f64d40ee72b561f4f5f46d65aff8d","category":"nl_quality","rule_id":"R01","file":"skills/local-seo-audit/SKILL.md","line":27,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 27)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:a4c0e93bc11aa21b24fb232a74d116c0cafa51ce3566ab5ddedcee0ae0dae028","category":"nl_quality","rule_id":"R01","file":"skills/cro/SKILL.md","line":124,"severity":"low","confidence":"high","evidence":"\"unless running a multivariate test with sufficient traffic\" (line 124)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"sufficient\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit minimum traffic/sample-size threshold"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:e1c55ace9e3491c893217229f009f452012902dbc0e081803be00cb2373df984","category":"nl_quality","rule_id":"R01","file":"skills/team-assign/SKILL.md","line":42,"severity":"low","confidence":"high","evidence":"\"send an assignment notification ... with task details, priority, due date, and any relevant brand context\" (line 42)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with explicit brand-context fields to include"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:62af7c1a6e40a4eae5c454d71387b2b075eac3b9f84230d9ba74987db0621dff","category":"nl_quality","rule_id":"R01","file":"skills/campaign-plan/SKILL.md","line":26,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 26)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:6c6557d2b316193c6e11c6a2a4e6bc74c16a1169a49156f9a9329246d49c2827","category":"nl_quality","rule_id":"R01","file":"skills/aeo-audit/SKILL.md","line":33,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 33)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:ac1284da02dcff3aacde0a62975628e8147589ced72a2490ec52c7db60835aaa","category":"nl_quality","rule_id":"R01","file":"skills/campaign-orchestrator/SKILL.md","line":120,"severity":"low","confidence":"high","evidence":"\"Budget and schedules set correctly in all platforms\" (line 120); \"Recommend channels with more flexible policies where appropriate\" (line 183)","penalty":-4,"pattern":"vague_quantifier","description":"2 vague quantifiers (\"correctly\", \"appropriate\") used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:1103b1d91220adf496cb8f83e3ccd4e1cd9bf9feebea23e3d7fd3f5514f0f11d","category":"nl_quality","rule_id":"R11","file":"skills/launch-campaign/SKILL.md","line":12,"severity":"low","confidence":"high","evidence":"allowed-tools: Read Bash Glob Grep (line 12); body only describes Read (plan.json) and Bash (python/curl invocations), no Glob usage described","penalty":-3,"pattern":"unused_tool","description":"Glob declared in allowed-tools but never referenced or invoked in the skill body","false_positive":false,"suggested_fix":"Remove Glob from allowed-tools, or add a body step that legitimately uses it"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:1103b1d91220adf496cb8f83e3ccd4e1cd9bf9feebea23e3d7fd3f5514f0f11d","category":"nl_quality","rule_id":"R11","file":"skills/launch-campaign/SKILL.md","line":12,"severity":"low","confidence":"high","evidence":"allowed-tools: Read Bash Glob Grep (line 12); no grep/search operation described anywhere in the Process section","penalty":-3,"pattern":"unused_tool","description":"Grep declared in allowed-tools but never referenced or invoked in the skill body","false_positive":false,"suggested_fix":"Remove Grep from allowed-tools, or add a body step that legitimately uses it"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:24f03b38bbc3608bac7733de43246a5a1fe46d6b4dc1b5d49612892dfbe723d7","category":"nl_quality","rule_id":"R01","file":"skills/performance-report/SKILL.md","line":28,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 28)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:eff68740265bbe9a8aa71579baabdee1de0f716afd3684a4be8738ab9aac5d38","category":"nl_quality","rule_id":"R01","file":"skills/pipeline-update/SKILL.md","line":43,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 43)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"relevant\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit file/category list or selection rule"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:09da76d81408328ea39f44f2d9d68e267c1917b444bfdaaa710c626aef886427","category":"nl_quality","rule_id":"R01","file":"skills/review-response/SKILL.md","line":28,"severity":"low","confidence":"high","evidence":"\"if present, load restrictions and relevant category files\" (line 28); \"take responsibility where appropriate\" (line 31); \"highlight relevant brand strengths\" (line 33); \"naturally incorporate relevant keywords\" (line 38)","penalty":-8,"pattern":"vague_quantifier","description":"4 vague quantifiers (\"relevant\" x3, \"appropriate\") used as instructions with no measurable criteria","false_positive":false,"suggested_fix":"Replace each with explicit, measurable criteria"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:7a3b0a0de979c3db697fcb976633b604cc0c5446da0e9360fcc26fa4112185bb","category":"nl_quality","rule_id":"R11","file":"commands/email-sequence.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field","penalty":-5,"pattern":"missing_allowed_tools","description":"No allowed-tools field declared in command frontmatter","false_positive":false,"suggested_fix":"Add an allowed-tools frontmatter field listing the tools the command body actually uses"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:13b8cbe38469f848a75e6861c7ff46d8ab14bff0640de0cc25f9e39d76d98cf9","category":"nl_quality","rule_id":"R14","file":"commands/email-sequence.md","line":46,"severity":"medium","confidence":"medium","evidence":"## Sequence Design section (lines 46-98) covers architecture, per-email blueprint, segmentation/branching, and deliverability checklist as ### headers/bullets, not a numbered process list","penalty":-10,"pattern":"no_numbered_steps","description":"Multi-stage command body presented as unordered headers/bullets instead of numbered steps","false_positive":false,"suggested_fix":"Convert the Sequence Design section into an explicit numbered step list"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:c25e933e720522207a846494d75a95a4b46c7e280ae795c8f7c0e7f7ecdab9c1","category":"nl_quality","rule_id":"R01","file":"commands/email-sequence.md","line":93,"severity":"low","confidence":"high","evidence":"\"Link density appropriate (not too many links)\" (line 93)","penalty":-2,"pattern":"vague_quantifier","description":"1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria","false_positive":false,"suggested_fix":"Replace with an explicit max-link-count threshold"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:79fce5b95783b3a3368e4eecbca9754ee9bd860f95662b145b48b86d33ce9a1d","category":"nl_quality","rule_id":"R11","file":"commands/cowork-setup.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter only has description, argument-hint, disable-model-invocation (lines 1-5), no allowed-tools field","penalty":-5,"pattern":"missing_allowed_tools","description":"No allowed-tools field declared in command frontmatter","false_positive":false,"suggested_fix":"Add an allowed-tools frontmatter field listing the tools the command body actually uses"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:22a8838476f6c850717a3fc9d4b3187f5e6df6dd96d5aea55d835a60498c122a","category":"nl_quality","rule_id":"R15","file":"commands/check.md","line":3,"severity":"medium","confidence":"medium","evidence":"argument-hint requires (line 3); no \"if not provided\" guidance anywhere in the body","penalty":-10,"pattern":"no_empty_input_handling","description":"No handling specified for missing/empty required argument","false_positive":false,"suggested_fix":"Add explicit fallback/error behavior for when the argument is omitted"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:e84b6b1d523e3ec501e95d5a6119c7033f7f3c55036956cfcaf01a3e5d2fc9ef","category":"nl_quality","rule_id":"R11","file":"commands/backlink-gap.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field","penalty":-5,"pattern":"missing_allowed_tools","description":"No allowed-tools field declared in command frontmatter","false_positive":false,"suggested_fix":"Add an allowed-tools frontmatter field listing the tools the command body actually uses"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:f1ea1e7506b5c60fc0a6200b0172caf35915b49aff63456d84cc2011b14ca783","category":"nl_quality","rule_id":"R15","file":"commands/backlink-gap.md","line":21,"severity":"medium","confidence":"medium","evidence":"## Inputs section (lines 21-26) has no missing-input guidance, unlike sibling commands","penalty":-10,"pattern":"no_empty_input_handling","description":"Required domain/competitor arguments have no fallback for missing input","false_positive":false,"suggested_fix":"Add an explicit \"if not provided, ask the user\" fallback matching sibling commands"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:ccbccb0432cda543f278d601061da3f5a9b936d5d2ff224dd84a2adba2ecf0dc","category":"nl_quality","rule_id":"R11","file":"commands/competitor-analysis.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field","penalty":-5,"pattern":"missing_allowed_tools","description":"No allowed-tools field declared in command frontmatter","false_positive":false,"suggested_fix":"Add an allowed-tools frontmatter field listing the tools the command body actually uses"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:b670a1f13b83f7a32f934bfea5d2c0aa96d19b15d8a23e7431e9e4ba8627acea","category":"nl_quality","rule_id":"R15","file":"commands/execute-action.md","line":3,"severity":"medium","confidence":"medium","evidence":"argument-hint shows --action unbracketed (required) at line 3; no omission-handling text in body","penalty":-10,"pattern":"no_empty_input_handling","description":"No handling specified for when the required --action flag is omitted","false_positive":false,"suggested_fix":"Add explicit fallback/error behavior for when --action is omitted"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:c2a094b805cf9038ba8ded3d3615144210d4f271ff816f97ca6bcea10ae4b540","category":"nl_quality","rule_id":"R11","file":"commands/brand-setup.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field","penalty":-5,"pattern":"missing_allowed_tools","description":"No allowed-tools field declared in command frontmatter","false_positive":false,"suggested_fix":"Add an allowed-tools frontmatter field listing the tools the command body actually uses"} +{"event":"finding","timestamp":"2026-08-05T07:18:54Z","audit_run_id":"30983048070","repo":"indranilbanerjee/digital-marketing-pro","commit_sha":"e39f3940519ddb4103c197ccf7ec4951d5e8a8b9","fingerprint":"sha256:9b749f602b743698404231cf56b1e2b5f268165497eb54d53aae5ddb1aa339c2","category":"nl_quality","rule_id":"R11","file":"commands/seo-audit.md","line":null,"severity":"low","confidence":"high","evidence":"frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field","penalty":-5,"pattern":"missing_allowed_tools","description":"No allowed-tools field declared in command frontmatter","false_positive":false,"suggested_fix":"Add an allowed-tools frontmatter field listing the tools the command body actually uses"} {"event":"finding","timestamp":"2026-08-05T07:03:41Z","audit_run_id":"30983032406","repo":"Shubhamsaboo/awesome-llm-apps","commit_sha":"779e9f9bcf87fa8cd95870a438b70b84e47d3173","fingerprint":"sha256:881283f9ce3d21011a260342b383b03f4c27455c5f0c9caed189fd5474a597b8","category":"bug","rule_id":"BUG-broken-reference","file":"generative_ui_agents/ai-mcp-app-builder/apps/mcp-use-server/.agent/skills/chatgpt-app-builder/SKILL.md","line":4,"severity":"medium","confidence":"high","evidence":"ls .agent/skills/ shows chatgpt-app-builder, mcp-apps-builder, mcp-builder — no mcp-app-builder directory exists anywhere in the repo","penalty":null,"pattern":"deprecated-skill-pointer","description":"Deprecation notice points to a replacement skill named mcp-app-builder (singular) that does not exist; the real replacement is mcp-apps-builder (plural)","false_positive":false,"suggested_fix":"Update the deprecation notice to reference mcp-apps-builder (plural) to match the actual directory name"} {"event":"finding","timestamp":"2026-08-05T07:03:41Z","audit_run_id":"30983032406","repo":"Shubhamsaboo/awesome-llm-apps","commit_sha":"779e9f9bcf87fa8cd95870a438b70b84e47d3173","fingerprint":"sha256:f34ed29dd9fc02122cfc33ed25712512f0e1c5837159f06f8d06fb0e745134bb","category":"bug","rule_id":"BUG-broken-reference","file":"generative_ui_agents/ai-mcp-app-builder/apps/mcp-use-server/.agent/skills/mcp-builder/SKILL.md","line":4,"severity":"medium","confidence":"high","evidence":"ls .agent/skills/ shows chatgpt-app-builder, mcp-apps-builder, mcp-builder — no mcp-app-builder directory exists anywhere in the repo","penalty":null,"pattern":"deprecated-skill-pointer","description":"Deprecation notice points to a replacement skill named mcp-app-builder (singular) that does not exist; the real replacement is mcp-apps-builder (plural)","false_positive":false,"suggested_fix":"Update the deprecation notice to reference mcp-apps-builder (plural) to match the actual directory name"} {"event":"finding","timestamp":"2026-08-05T07:03:41Z","audit_run_id":"30983032406","repo":"Shubhamsaboo/awesome-llm-apps","commit_sha":"779e9f9bcf87fa8cd95870a438b70b84e47d3173","fingerprint":"sha256:7c0cdbbd5a1e0c51cbe02b597cb8a4a72adc993246f18766b894fef8ea83c1c9","category":"security","rule_id":"SEC-curl-pipe-sh","file":"generative_ui_agents/generative-ui-starter-project/Dockerfile","line":31,"severity":"critical","confidence":"high","evidence":"curl -fsSL https://deb.nodesource.com/setup_20.x | bash - executed with no checksum/signature verification","penalty":null,"pattern":"curl-pipe-sh","description":"Remote NodeSource setup script fetched over HTTPS and piped directly into bash","false_positive":false,"suggested_fix":"Download the script, verify its checksum/signature, then execute, or use a pinned apt/deb package instead"} diff --git a/auditor/logs/events.jsonl b/auditor/logs/events.jsonl index b0e4f524f..daf2e28aa 100644 --- a/auditor/logs/events.jsonl +++ b/auditor/logs/events.jsonl @@ -3761,6 +3761,10 @@ {"timestamp":"2026-08-05T02:07:56Z","workflow":"discover","event":"search_complete","run_id":"30968348211","run_number":39,"data":{"candidates":161,"new":57,"worthy":6,"oversized":18}} {"timestamp":"2026-08-05T04:36:41Z","workflow":"classify","event":"classifications_emitted","run_id":"30975581065","run_number":107,"data":{"classifications":0,"invalid":0,"no_dissent":true}} {"timestamp":"2026-08-05T05:14:52Z","workflow":"track","event":"status_check","run_id":"30977076136","run_number":653,"data":{"contributed":57,"tracked":37,"case_study_ready":42,"rule_adopted":2}} +{"timestamp":"2026-08-05T07:18:54Z","workflow":"audit","event":"scorer_drift_check","run_id":"30983048070","run_number":747,"data":{"repo":"indranilbanerjee/digital-marketing-pro","sidecar":"auditor/audits/indranilbanerjee-digital-marketing-pro.findings.jsonl","drifts":8,"exit_code":1,"total_findings":127,"missing_confidence":0}} +{"timestamp":"2026-08-05T07:18:58Z","workflow":"audit","event":"findings_aggregated","run_id":"30983048070","run_number":747,"data":{"repo":"indranilbanerjee/digital-marketing-pro","findings":127,"invalid_lines":0,"self_false_positives":0}} +{"timestamp":"2026-08-05T07:18:58Z","workflow":"audit","event":"repo_report_rendered","run_id":"30983048070","run_number":747,"data":{"repo":"indranilbanerjee/digital-marketing-pro","html":"auditor/reports/indranilbanerjee-digital-marketing-pro.html"}} +{"timestamp":"2026-08-05T07:18:59Z","workflow":"audit","event":"audit_complete","run_id":"30983048070","run_number":747,"data":{"repo":"indranilbanerjee/digital-marketing-pro","score":91,"artifacts":202,"strategy":"progressive"}} {"timestamp":"2026-08-05T07:03:41Z","workflow":"audit","event":"scorer_drift_check","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","sidecar":"auditor/audits/Shubhamsaboo-awesome-llm-apps.findings.jsonl","drifts":0,"exit_code":0,"total_findings":23,"missing_confidence":0}} {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"findings_aggregated","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","findings":23,"invalid_lines":0,"self_false_positives":0}} {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"repo_report_rendered","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","html":"auditor/reports/Shubhamsaboo-awesome-llm-apps.html"}} diff --git a/auditor/registry/repos.json b/auditor/registry/repos.json index 83f8cf0fb..204790e72 100644 --- a/auditor/registry/repos.json +++ b/auditor/registry/repos.json @@ -9746,10 +9746,13 @@ "stars": 705, "artifacts": 203, "description": "Open-source AI marketing plugin for agencies & in-house teams — 158 skills, 25 specialist agents, 12-Part Strategy Flow, Cowork team-persistent, EU AI Act Article 50 ready, 6-platform AEO/GEO incl. Google AI Mode. Installs on Claude Code, Cowork, Codex, Cursor, Copilot CLI, Antigravity. MIT-licensed.", - "status": "discovered", - "score": null, + "status": "audited", + "score": 91, "audit_issue": 760, - "prs": [] + "prs": [], + "strategy": "progressive", + "security": "BLOCKED", + "commit_sha_at_audit": "e39f3940519ddb4103c197ccf7ec4951d5e8a8b9" }, "microsoft/skills": { "discovered": "2026-08-05T02:07:37Z", diff --git a/auditor/reports/indranilbanerjee-digital-marketing-pro.html b/auditor/reports/indranilbanerjee-digital-marketing-pro.html new file mode 100644 index 000000000..69a92ce8b --- /dev/null +++ b/auditor/reports/indranilbanerjee-digital-marketing-pro.html @@ -0,0 +1,104 @@ + + + + + NLPM Report — indranilbanerjee/digital-marketing-pro + + + +
+
+

NLPM Report

+

indranilbanerjee/digital-marketing-pro · 2026-08-05T07:18:58Z

+
+
+
—
+
+
+
+ + + +
+
+

Per-file scores

+
+ + + + + + + + + + +
PathTypeScoreFindings
+
+
+ +
+

Score trend

+

Average score per snapshot, oldest → newest.

+
+
+ +
+

Cross-component references

+

Artifacts and their references. Broken references in red.

+
+
+ +
+

Vocabulary noun-verb map

+

+ Verbs (rounded rectangles), nouns (circles). Two scopes shown as compound containers. + Cross-scope homonyms have a doubled outline. Deferred-pending-warrant terms appear dashed. + Click a node for details. +

+
+ + + +
+
+ +
+ +
+

Vocabulary drift candidates

+

Registry-free advisory: clusters of likely-synonymous terms detected by `vocab-drift-scanner`.

+
+
+ +
+

Findings

+

All violations grouped by rule. Severity badges sort within each rule.

+
+
+
+ +
+

+ Generated by /nlpm:report. + Graph visualizations powered by AntV G6 (vendored at ./vendor/g6.min.js). + Open this file directly via file:// — no server needed. +

+
+ + + + + + diff --git a/auditor/reports/indranilbanerjee-digital-marketing-pro.json b/auditor/reports/indranilbanerjee-digital-marketing-pro.json new file mode 100644 index 000000000..ad8e0deec --- /dev/null +++ b/auditor/reports/indranilbanerjee-digital-marketing-pro.json @@ -0,0 +1,2362 @@ +{ + "project": "indranilbanerjee/digital-marketing-pro", + "score_threshold": 70, + "r51_enabled": false, + "summary": { + "total_files": 78, + "average_score": 91, + "pass_count": 0, + "fail_count": 0 + }, + "files": [ + { + "path": "agents/agency-operations.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/analytics-analyst.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + }, + { + "rule": "R01", + "severity": "low", + "line": 27, + "message": "2 vague quantifiers (\"appropriate\", \"sufficient\") used as instructions with no measurable criteria" + } + ] + }, + { + "path": "agents/brand-guardian.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + }, + { + "rule": "R01", + "severity": "low", + "line": 14, + "message": "2 vague quantifiers (\"appropriate\" x2) used as instructions with no measurable criteria" + } + ] + }, + { + "path": "agents/competitive-intel.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/content-creator.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + }, + { + "rule": "R01", + "severity": "low", + "line": 75, + "message": "1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "agents/crm-manager.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/cro-specialist.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/email-specialist.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/execution-coordinator.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + }, + { + "rule": "R11", + "severity": "low", + "line": 5, + "message": "Edit tool declared but never referenced or invoked in the agent body" + } + ] + }, + { + "path": "agents/growth-engineer.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/influencer-manager.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/intelligence-curator.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/journey-orchestrator.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/localization-specialist.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/market-intelligence.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + }, + { + "rule": "R01", + "severity": "low", + "line": 15, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "agents/marketing-scientist.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/marketing-strategist.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + }, + { + "rule": "R01", + "severity": "low", + "line": 97, + "message": "1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "agents/media-buyer.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + }, + { + "rule": "R01", + "severity": "low", + "line": 26, + "message": "1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "agents/memory-manager.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + }, + { + "rule": "R01", + "severity": "low", + "line": 33, + "message": "1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "agents/performance-monitor-agent.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + }, + { + "rule": "R01", + "severity": "low", + "line": 24, + "message": "1 vague quantifier (\"sufficient\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "agents/pr-outreach.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + }, + { + "rule": "R01", + "severity": "low", + "line": 30, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "agents/quality-assurance.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/seo-specialist.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "agents/social-media-manager.md", + "type": "agent", + "score": null, + "findings": [ + { + "rule": "R10", + "severity": "low", + "line": null, + "message": "No model tier declared in agent frontmatter" + }, + { + "rule": "R09", + "severity": "medium", + "line": null, + "message": "Zero blocks in agent body" + } + ] + }, + { + "path": "commands/backlink-gap.md", + "type": "command", + "score": null, + "findings": [ + { + "rule": "BUG-undeclared-tool", + "severity": "medium", + "line": null, + "message": "Command invokes Bash and Write with no allowed-tools declared in frontmatter" + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "No allowed-tools field declared in command frontmatter" + }, + { + "rule": "R15", + "severity": "medium", + "line": 21, + "message": "Required domain/competitor arguments have no fallback for missing input" + } + ] + }, + { + "path": "commands/brand-setup.md", + "type": "command", + "score": null, + "findings": [ + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "No allowed-tools field declared in command frontmatter" + } + ] + }, + { + "path": "commands/check.md", + "type": "command", + "score": null, + "findings": [ + { + "rule": "R15", + "severity": "medium", + "line": 3, + "message": "No handling specified for missing/empty required argument" + } + ] + }, + { + "path": "commands/competitor-analysis.md", + "type": "command", + "score": null, + "findings": [ + { + "rule": "BUG-undeclared-tool", + "severity": "medium", + "line": 139, + "message": "Command invokes Task tool with no allowed-tools declared in frontmatter" + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "No allowed-tools field declared in command frontmatter" + } + ] + }, + { + "path": "commands/cowork-setup.md", + "type": "command", + "score": null, + "findings": [ + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "No allowed-tools field declared in command frontmatter" + } + ] + }, + { + "path": "commands/email-sequence.md", + "type": "command", + "score": null, + "findings": [ + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "No allowed-tools field declared in command frontmatter" + }, + { + "rule": "R14", + "severity": "medium", + "line": 46, + "message": "Multi-stage command body presented as unordered headers/bullets instead of numbered steps" + }, + { + "rule": "R01", + "severity": "low", + "line": 93, + "message": "1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "commands/execute-action.md", + "type": "command", + "score": null, + "findings": [ + { + "rule": "R15", + "severity": "medium", + "line": 3, + "message": "No handling specified for when the required --action flag is omitted" + } + ] + }, + { + "path": "commands/seo-audit.md", + "type": "command", + "score": null, + "findings": [ + { + "rule": "BUG-undeclared-tool", + "severity": "medium", + "line": 166, + "message": "Command invokes Bash with no allowed-tools declared in frontmatter" + }, + { + "rule": "R11", + "severity": "low", + "line": null, + "message": "No allowed-tools field declared in command frontmatter" + } + ] + }, + { + "path": "scripts/ai-visibility-checker.py", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-env-var-access", + "severity": "medium", + "line": 164, + "message": "Reads OPENAI_API_KEY from environment to authenticate an outbound API call" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "line": 173, + "message": "Sends user-supplied query text to the OpenAI chat completions API" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "line": 204, + "message": "Reads ANTHROPIC_API_KEY from environment to authenticate an outbound API call" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "line": 213, + "message": "Sends user-supplied query text to the Anthropic messages API" + } + ] + }, + { + "path": "scripts/brand-voice-scorer.py", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-network-call", + "severity": "medium", + "line": 73, + "message": "nltk.download() silently fetches tokenizer/tagger corpus data from NLTK's remote server on first run" + } + ] + }, + { + "path": "scripts/competitor-scraper.py", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-network-call", + "severity": "medium", + "line": 75, + "message": "Fetches robots.txt from an arbitrary, caller-supplied destination" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "line": 168, + "message": "Fetches page content from an arbitrary, caller-supplied destination" + } + ] + }, + { + "path": "scripts/connector_executor.py", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-env-var-access", + "severity": "medium", + "line": 269, + "message": "Loads the entire environment dict as the credential source instead of an explicit named allow-list" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "line": 331, + "message": "Sends injected credentials to hardcoded external vendor endpoints" + } + ] + }, + { + "path": "scripts/credential-manager.py", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-env-var-access", + "severity": "medium", + "line": 173, + "message": "Iterates arbitrary env-var names from a stored profile to check credential presence" + } + ] + }, + { + "path": "scripts/crm-sync.py", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-env-var-access", + "severity": "medium", + "line": 367, + "message": "Reads CRM token env vars to report connection status (presence check only)" + } + ] + }, + { + "path": "scripts/embed-c2pa.py", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-postinstall-script", + "severity": "medium", + "line": 104, + "message": "Auto-installs a third-party package at runtime when missing" + } + ] + }, + { + "path": "scripts/memory-manager.py", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-env-var-access", + "severity": "medium", + "line": 360, + "message": "Reads memory-service API key env vars to report connection status (presence check only)" + } + ] + }, + { + "path": "scripts/output-publisher.py", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-file-write-outside-repo", + "severity": "high", + "line": 77, + "message": "Writes published artifacts outside the repo/plugin sandbox into the user's home directory" + } + ] + }, + { + "path": "scripts/refresh_models.py", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-env-var-access", + "severity": "medium", + "line": 53, + "message": "Sends ANTHROPIC_API_KEY to a hardcoded external endpoint" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "line": 66, + "message": "Sends OPENAI_API_KEY to a hardcoded external endpoint" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "line": 79, + "message": "Sends GEMINI_API_KEY as a URL query parameter to a hardcoded external endpoint" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "line": 96, + "message": "Sends EVOLINK_API_KEY to a hardcoded, lesser-known third-party endpoint" + } + ] + }, + { + "path": "scripts/requirements.txt", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-unpinned-semver", + "severity": "low", + "line": 10, + "message": "Multiple dependencies pinned with >= range instead of exact version, risking non-reproducible builds" + } + ] + }, + { + "path": "scripts/setup.py", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-postinstall-script", + "severity": "medium", + "line": 274, + "message": "Runtime pip install of dependency lists during setup script execution" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "line": 285, + "message": "Runtime network fetch of NLTK corpus data during setup" + } + ] + }, + { + "path": "scripts/sync_model_registry.sh", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-file-write-outside-repo", + "severity": "high", + "line": 52, + "message": "Writes model_registry.json to a sibling directory outside the repo root via relative traversal" + } + ] + }, + { + "path": "scripts/tech-seo-auditor.py", + "type": "?", + "score": null, + "findings": [ + { + "rule": "SEC-network-call", + "severity": "medium", + "line": 134, + "message": "Unrestricted URL fetch of caller-supplied targets with no private-IP/localhost block-list" + } + ] + }, + { + "path": "skills/add-integration/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 27, + "message": "2 vague quantifiers (\"appropriate\" x2) used as instructions with no measurable criteria" + } + ] + }, + { + "path": "skills/aeo-audit/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 33, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/analytics-insights/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 142, + "message": "1 vague quantifier (\"correctly\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/campaign-orchestrator/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 120, + "message": "2 vague quantifiers (\"correctly\", \"appropriate\") used as instructions with no measurable criteria" + } + ] + }, + { + "path": "skills/campaign-plan/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 26, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/client-proposal/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 29, + "message": "3 vague quantifiers (\"relevant\" x3) used as instructions with no measurable criteria" + } + ] + }, + { + "path": "skills/cro/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 124, + "message": "1 vague quantifier (\"sufficient\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/entity-audit/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 27, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/eval-config/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 40, + "message": "1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/eval-content/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 26, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/executive-dashboard/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 27, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/funnel-audit/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 26, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/import-template/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 26, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/journey-design/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 21, + "message": "1 vague quantifier (\"objective-appropriate\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/language-audit/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 24, + "message": "2 vague quantifiers (\"relevant\", \"correctly\") used as instructions with no measurable criteria" + } + ] + }, + { + "path": "skills/launch-campaign/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R11", + "severity": "low", + "line": 12, + "message": "Glob declared in allowed-tools but never referenced or invoked in the skill body" + }, + { + "rule": "R11", + "severity": "low", + "line": 12, + "message": "Grep declared in allowed-tools but never referenced or invoked in the skill body" + } + ] + }, + { + "path": "skills/lead-import/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 44, + "message": "2 vague quantifiers (\"relevant\", \"correctly\") used as instructions with no measurable criteria" + } + ] + }, + { + "path": "skills/live-dashboard/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 12, + "message": "2 vague quantifiers (\"appropriate\" x2) used as instructions with no measurable criteria" + } + ] + }, + { + "path": "skills/local-seo-audit/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 27, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/marketing-automation/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 57, + "message": "4 vague quantifiers (\"reasonable\", \"appropriate\" x2, \"correctly\") used as instructions with no measurable criteria" + } + ] + }, + { + "path": "skills/martech-audit/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 28, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/performance-report/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 28, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/pipeline-update/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 43, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/pr-pitch/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 26, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/programmatic-seo/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 47, + "message": "1 vague quantifier (\"sufficient\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/prompt-test/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 28, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/qbr-plan/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 29, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/review-response/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 28, + "message": "4 vague quantifiers (\"relevant\" x3, \"appropriate\") used as instructions with no measurable criteria" + } + ] + }, + { + "path": "skills/send-report/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 12, + "message": "3 vague quantifiers (\"appropriate\" x3) used as instructions with no measurable criteria" + } + ] + }, + { + "path": "skills/seo-audit/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 36, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/team-assign/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 42, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + }, + { + "path": "skills/webinar-plan/SKILL.md", + "type": "skill", + "score": null, + "findings": [ + { + "rule": "R01", + "severity": "low", + "line": 30, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria" + } + ] + } + ], + "history": [ + { + "timestamp": "2026-08-05T07:14:58Z", + "average_score": 91, + "kind": "initial_audit" + } + ], + "cross_component": { + "nodes": [], + "edges": [] + }, + "vocabulary": null, + "vocab_drift": { + "candidates": [] + }, + "findings": [ + { + "rule": "BUG-undeclared-tool", + "severity": "medium", + "confidence": "high", + "file": "commands/backlink-gap.md", + "line": null, + "message": "Command invokes Bash and Write with no allowed-tools declared in frontmatter — body runs scripts/backlink_gap.py via Bash (line 33) and writes PLAN.md via Write (line 38); frontmatter declares no allowed-tools field" + }, + { + "rule": "BUG-undeclared-tool", + "severity": "medium", + "confidence": "high", + "file": "commands/competitor-analysis.md", + "line": 139, + "message": "Command invokes Task tool with no allowed-tools declared in frontmatter — body instructs dispatching seven parallel Task tool calls (line 139); frontmatter declares no allowed-tools field" + }, + { + "rule": "BUG-undeclared-tool", + "severity": "medium", + "confidence": "high", + "file": "commands/seo-audit.md", + "line": 166, + "message": "Command invokes Bash with no allowed-tools declared in frontmatter — Execution discipline section runs scripts/link-profile-analyzer.py via Bash (lines 163-166); frontmatter declares no allowed-tools field" + }, + { + "rule": "SEC-file-write-outside-repo", + "severity": "high", + "confidence": "high", + "file": "scripts/output-publisher.py", + "line": 77, + "message": "Writes published artifacts outside the repo/plugin sandbox into the user's home directory — get_visible_publish_dir() resolves to ~/Documents/DigitalMarketingPro/{brand}; _publish_file() copies artifacts there via shutil.copy2() at line 118" + }, + { + "rule": "SEC-file-write-outside-repo", + "severity": "high", + "confidence": "high", + "file": "scripts/sync_model_registry.sh", + "line": 52, + "message": "Writes model_registry.json to a sibling directory outside the repo root via relative traversal — dest path computed via ../ traversal from REPO_ROOT to a sibling checkout outside the repo root; written by embedded python json.dump at line 93" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "confidence": "high", + "file": "scripts/ai-visibility-checker.py", + "line": 164, + "message": "Reads OPENAI_API_KEY from environment to authenticate an outbound API call — os.environ.get(\"OPENAI_API_KEY\") read to authenticate outbound OpenAI API call" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "confidence": "high", + "file": "scripts/ai-visibility-checker.py", + "line": 173, + "message": "Sends user-supplied query text to the OpenAI chat completions API — sends user-supplied query text to OpenAI chat completions API endpoint" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "confidence": "high", + "file": "scripts/ai-visibility-checker.py", + "line": 204, + "message": "Reads ANTHROPIC_API_KEY from environment to authenticate an outbound API call — os.environ.get(\"ANTHROPIC_API_KEY\") read to authenticate outbound Anthropic API call" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "confidence": "high", + "file": "scripts/ai-visibility-checker.py", + "line": 213, + "message": "Sends user-supplied query text to the Anthropic messages API — sends user-supplied query text to Anthropic messages API endpoint" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "confidence": "high", + "file": "scripts/brand-voice-scorer.py", + "line": 73, + "message": "nltk.download() silently fetches tokenizer/tagger corpus data from NLTK's remote server on first run — nltk.download() call with no gating flag" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "confidence": "high", + "file": "scripts/competitor-scraper.py", + "line": 75, + "message": "Fetches robots.txt from an arbitrary, caller-supplied destination — fetches robots.txt from a host derived from the user-supplied --url argument" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "confidence": "high", + "file": "scripts/competitor-scraper.py", + "line": 168, + "message": "Fetches page content from an arbitrary, caller-supplied destination — fetches full page content from the user-supplied --url argument" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "confidence": "high", + "file": "scripts/connector_executor.py", + "line": 269, + "message": "Loads the entire environment dict as the credential source instead of an explicit named allow-list — loads entire os.environ as the default credential source (SLACK_BOT_TOKEN, HUBSPOT_PRIVATE_APP_TOKEN, KLAVIYO_PRIVATE_KEY, SENDGRID_API_KEY, BREVO_API_KEY, CUSTOMERIO_APP_API_KEY, MAILCHIMP_API_KEY, AHREFS_API_KEY, etc.)" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "confidence": "high", + "file": "scripts/connector_executor.py", + "line": 331, + "message": "Sends injected credentials to hardcoded external vendor endpoints — fires outbound HTTP requests via urllib to hardcoded per-connector vendor endpoints (e.g. api.hubapi.com, a.klaviyo.com) with injected credentials" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "confidence": "high", + "file": "scripts/credential-manager.py", + "line": 173, + "message": "Iterates arbitrary env-var names from a stored profile to check credential presence — os.environ.get(v) reads arbitrary env-var names loaded from a stored profile JSON (validate-profile action); boolean presence check only" + }, + { + "rule": "SEC-postinstall-script", + "severity": "medium", + "confidence": "high", + "file": "scripts/embed-c2pa.py", + "line": 104, + "message": "Auto-installs a third-party package at runtime when missing — subprocess.check_call runs pip install --quiet c2pa-python>=0.32 at runtime if the module is missing" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "confidence": "high", + "file": "scripts/crm-sync.py", + "line": 367, + "message": "Reads CRM token env vars to report connection status (presence check only) — os.environ.get(env_var) reads SALESFORCE_ACCESS_TOKEN, HUBSPOT_ACCESS_TOKEN, ZOHO_REFRESH_TOKEN, PIPEDRIVE_API_TOKEN; boolean presence check only, no value exfiltration" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "confidence": "high", + "file": "scripts/memory-manager.py", + "line": 360, + "message": "Reads memory-service API key env vars to report connection status (presence check only) — os.environ.get(env_var) reads PINECONE_API_KEY, QDRANT_API_KEY, SUPERMEMORY_API_KEY, GRAPHITI_API_KEY; boolean presence check only, no value exfiltration" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "confidence": "high", + "file": "scripts/refresh_models.py", + "line": 53, + "message": "Sends ANTHROPIC_API_KEY to a hardcoded external endpoint — reads ANTHROPIC_API_KEY and sends it as x-api-key header to hardcoded https://api.anthropic.com/v1/models (line 57)" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "confidence": "high", + "file": "scripts/refresh_models.py", + "line": 66, + "message": "Sends OPENAI_API_KEY to a hardcoded external endpoint — reads OPENAI_API_KEY and sends it as a Bearer token to hardcoded https://api.openai.com/v1/models (line 70)" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "confidence": "high", + "file": "scripts/refresh_models.py", + "line": 79, + "message": "Sends GEMINI_API_KEY as a URL query parameter to a hardcoded external endpoint — reads GEMINI_API_KEY and appends it as a ?key= query param to hardcoded generativelanguage.googleapis.com (line 83)" + }, + { + "rule": "SEC-env-var-access", + "severity": "medium", + "confidence": "high", + "file": "scripts/refresh_models.py", + "line": 96, + "message": "Sends EVOLINK_API_KEY to a hardcoded, lesser-known third-party endpoint — reads EVOLINK_API_KEY and sends it as a Bearer token to hardcoded https://direct.evolink.ai/v1/models (line 100), a lesser-known third-party host" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "confidence": "high", + "file": "scripts/tech-seo-auditor.py", + "line": 134, + "message": "Unrestricted URL fetch of caller-supplied targets with no private-IP/localhost block-list — opener.open() fetches an arbitrary caller-supplied URL (from --url/--urls/--file) with manual redirect-following and no destination allow-list" + }, + { + "rule": "SEC-postinstall-script", + "severity": "medium", + "confidence": "high", + "file": "scripts/setup.py", + "line": 274, + "message": "Runtime pip install of dependency lists during setup script execution — subprocess.check_call() invokes pip install at runtime for LITE_DEPS/FULL_DEPS package lists" + }, + { + "rule": "SEC-network-call", + "severity": "medium", + "confidence": "high", + "file": "scripts/setup.py", + "line": 285, + "message": "Runtime network fetch of NLTK corpus data during setup — nltk.download() fetches NLTK corpus data packages from NLTK's remote distribution servers at runtime" + }, + { + "rule": "SEC-unpinned-semver", + "severity": "low", + "confidence": "high", + "file": "scripts/requirements.txt", + "line": 10, + "message": "Multiple dependencies pinned with >= range instead of exact version, risking non-reproducible builds — nltk>=3.8, textstat>=0.7, beautifulsoup4>=4.12, requests>=2.31 (lines 10-15) use >= range pins instead of exact == pins" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/analytics-analyst.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/analytics-analyst.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "agents/analytics-analyst.md", + "line": 27, + "message": "2 vague quantifiers (\"appropriate\", \"sufficient\") used as instructions with no measurable criteria — \"recommend the appropriate measurement method\" (line 27); \"whether the sample size is sufficient for confidence\" (line 28)" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/cro-specialist.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/cro-specialist.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/influencer-manager.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/influencer-manager.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/content-creator.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/content-creator.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "agents/content-creator.md", + "line": 75, + "message": "1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria — \"ensure audience-appropriate reading level\" (line 75)" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/intelligence-curator.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/intelligence-curator.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/journey-orchestrator.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/journey-orchestrator.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/media-buyer.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/media-buyer.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "agents/media-buyer.md", + "line": 26, + "message": "1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria — \"content category blocklists where appropriate\" (line 26)" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/marketing-scientist.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/marketing-scientist.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/growth-engineer.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/growth-engineer.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/social-media-manager.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/social-media-manager.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/marketing-strategist.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/marketing-strategist.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "agents/marketing-strategist.md", + "line": 97, + "message": "1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria — \"recommend the appropriate specialist agents\" (line 97)" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/quality-assurance.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/brand-guardian.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/brand-guardian.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "agents/brand-guardian.md", + "line": 14, + "message": "2 vague quantifiers (\"appropriate\" x2) used as instructions with no measurable criteria — \"ensuring channel-appropriate voice adaptation\" (line 14); \"clear, conspicuous, and platform-appropriate\" (line 30)" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/pr-outreach.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/pr-outreach.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "agents/pr-outreach.md", + "line": 30, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"a clear reason why this story is relevant to them specifically\" (line 30)" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/competitive-intel.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/competitive-intel.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/crm-manager.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/crm-manager.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/memory-manager.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/memory-manager.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "agents/memory-manager.md", + "line": 33, + "message": "1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria — \"Recommend the appropriate memory layer based on query type\" (line 33)" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/agency-operations.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/agency-operations.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/localization-specialist.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/localization-specialist.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/performance-monitor-agent.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/performance-monitor-agent.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "agents/performance-monitor-agent.md", + "line": 24, + "message": "1 vague quantifier (\"sufficient\") used as instruction with no measurable criteria — \"Without sufficient data, note the observation as 'insufficient baseline'\" (line 24)" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/execution-coordinator.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/execution-coordinator.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": "agents/execution-coordinator.md", + "line": 5, + "message": "Edit tool declared but never referenced or invoked in the agent body — tools: Read, Write, Edit, Grep, Glob, Bash, WebFetch (line 5); body only describes remote CMS/platform publishing via MCP and script calls, no local file editing described" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/market-intelligence.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/market-intelligence.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "agents/market-intelligence.md", + "line": 15, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"moments worth joining (brand-relevant, authentic fit)\" (line 15)" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/seo-specialist.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/seo-specialist.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R10", + "severity": "low", + "confidence": "high", + "file": "agents/email-specialist.md", + "line": null, + "message": "No model tier declared in agent frontmatter — frontmatter (lines 1-6) has name/description/maxTurns/tools only, no model: field" + }, + { + "rule": "R09", + "severity": "medium", + "confidence": "high", + "file": "agents/email-specialist.md", + "line": null, + "message": "Zero blocks in agent body — no tag present in the file" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/send-report/SKILL.md", + "line": 12, + "message": "3 vague quantifiers (\"appropriate\" x3) used as instructions with no measurable criteria — \"with appropriate approval gates\" (line 12); \"Apply the appropriate template depth\" (line 47); \"appropriate permissions\" (line 51)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/programmatic-seo/SKILL.md", + "line": 47, + "message": "1 vague quantifier (\"sufficient\") used as instruction with no measurable criteria — \"Word count per page | <300 | Flag for review (may lack sufficient value)\" (line 47)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/executive-dashboard/SKILL.md", + "line": 27, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"load restrictions and relevant category files\" (line 27)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/marketing-automation/SKILL.md", + "line": 57, + "message": "4 vague quantifiers (\"reasonable\", \"appropriate\" x2, \"correctly\") used as instructions with no measurable criteria — \"infer reasonable defaults\" (line 57); \"stage-appropriate messaging\" (line 101); \"fire correctly\" (line 108); \"MAP appropriate for the business size\" (line 156)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/import-template/SKILL.md", + "line": 26, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"load restrictions and relevant category files\" (line 26)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/analytics-insights/SKILL.md", + "line": 142, + "message": "1 vague quantifier (\"correctly\") used as instruction with no measurable criteria — \"Is the tracking code still firing correctly?\" (line 142)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/eval-content/SKILL.md", + "line": 26, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"load restrictions and relevant category files (especially messaging.md ... visual-identity.md)\" (line 26)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/prompt-test/SKILL.md", + "line": 28, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"load restrictions and relevant category files (voice-and-tone rules, messaging hierarchy, channel style guides)\" (line 28)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/entity-audit/SKILL.md", + "line": 27, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"For each relevant directory, verify the listing exists and check data consistency\" (line 27)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/pr-pitch/SKILL.md", + "line": 26, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"load restrictions and relevant category files\" (line 26)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/qbr-plan/SKILL.md", + "line": 29, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"load restrictions and relevant category files\" (line 29)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/webinar-plan/SKILL.md", + "line": 30, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"load restrictions and relevant category files\" (line 30)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/language-audit/SKILL.md", + "line": 24, + "message": "2 vague quantifiers (\"relevant\", \"correctly\") used as instructions with no measurable criteria — \"load restrictions and relevant category files for market-specific content rules\" (line 24); \"present and correctly localized\" (line 29)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/client-proposal/SKILL.md", + "line": 29, + "message": "3 vague quantifiers (\"relevant\" x3) used as instructions with no measurable criteria — \"load restrictions and relevant category files\" (line 29); \"Pull relevant industry performance data\" (line 30); \"Frame placeholders for relevant case studies\" (line 35)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/eval-config/SKILL.md", + "line": 40, + "message": "1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria — \"Analyze the brand's industry, audience, content strategy, and compliance requirements to suggest appropriate settings\" (line 40)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/lead-import/SKILL.md", + "line": 44, + "message": "2 vague quantifiers (\"relevant\", \"correctly\") used as instructions with no measurable criteria — \"load restrictions and relevant category files\" (line 44); \"verify field values, scoring data, source attribution, and assignment all transferred correctly\" (line 54)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/martech-audit/SKILL.md", + "line": 28, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"load restrictions and relevant category files\" (line 28)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/live-dashboard/SKILL.md", + "line": 12, + "message": "2 vague quantifiers (\"appropriate\" x2) used as instructions with no measurable criteria — \"Auto-selects appropriate metrics, dimensions, and chart types\" (line 12); \"Select the appropriate metric hierarchy and page structure\" (line 36)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/funnel-audit/SKILL.md", + "line": 26, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"if present, load restrictions and relevant category files\" (line 26)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/add-integration/SKILL.md", + "line": 27, + "message": "2 vague quantifiers (\"appropriate\" x2) used as instructions with no measurable criteria — \"add the credentials to the appropriate credential profile\" (line 27); \"add the new integration's credential mapping to the appropriate profile\" (line 29)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/seo-audit/SKILL.md", + "line": 36, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"if present, load restrictions and relevant category files\" (line 36)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/journey-design/SKILL.md", + "line": 21, + "message": "1 vague quantifier (\"objective-appropriate\") used as instruction with no measurable criteria — \"the system designs based on objective-appropriate defaults\" (line 21)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/local-seo-audit/SKILL.md", + "line": 27, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"if present, load restrictions and relevant category files\" (line 27)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/cro/SKILL.md", + "line": 124, + "message": "1 vague quantifier (\"sufficient\") used as instruction with no measurable criteria — \"unless running a multivariate test with sufficient traffic\" (line 124)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/team-assign/SKILL.md", + "line": 42, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"send an assignment notification ... with task details, priority, due date, and any relevant brand context\" (line 42)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/campaign-plan/SKILL.md", + "line": 26, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"if present, load restrictions and relevant category files\" (line 26)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/aeo-audit/SKILL.md", + "line": 33, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"if present, load restrictions and relevant category files\" (line 33)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/campaign-orchestrator/SKILL.md", + "line": 120, + "message": "2 vague quantifiers (\"correctly\", \"appropriate\") used as instructions with no measurable criteria — \"Budget and schedules set correctly in all platforms\" (line 120); \"Recommend channels with more flexible policies where appropriate\" (line 183)" + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": "skills/launch-campaign/SKILL.md", + "line": 12, + "message": "Glob declared in allowed-tools but never referenced or invoked in the skill body — allowed-tools: Read Bash Glob Grep (line 12); body only describes Read (plan.json) and Bash (python/curl invocations), no Glob usage described" + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": "skills/launch-campaign/SKILL.md", + "line": 12, + "message": "Grep declared in allowed-tools but never referenced or invoked in the skill body — allowed-tools: Read Bash Glob Grep (line 12); no grep/search operation described anywhere in the Process section" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/performance-report/SKILL.md", + "line": 28, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"if present, load restrictions and relevant category files\" (line 28)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/pipeline-update/SKILL.md", + "line": 43, + "message": "1 vague quantifier (\"relevant\") used as instruction with no measurable criteria — \"if present, load restrictions and relevant category files\" (line 43)" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "skills/review-response/SKILL.md", + "line": 28, + "message": "4 vague quantifiers (\"relevant\" x3, \"appropriate\") used as instructions with no measurable criteria — \"if present, load restrictions and relevant category files\" (line 28); \"take responsibility where appropriate\" (line 31); \"highlight relevant brand strengths\" (line 33); \"naturally incorporate relevant keywords\" (line 38)" + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": "commands/email-sequence.md", + "line": null, + "message": "No allowed-tools field declared in command frontmatter — frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field" + }, + { + "rule": "R14", + "severity": "medium", + "confidence": "medium", + "file": "commands/email-sequence.md", + "line": 46, + "message": "Multi-stage command body presented as unordered headers/bullets instead of numbered steps — ## Sequence Design section (lines 46-98) covers architecture, per-email blueprint, segmentation/branching, and deliverability checklist as ### headers/bullets, not a numbered process list" + }, + { + "rule": "R01", + "severity": "low", + "confidence": "high", + "file": "commands/email-sequence.md", + "line": 93, + "message": "1 vague quantifier (\"appropriate\") used as instruction with no measurable criteria — \"Link density appropriate (not too many links)\" (line 93)" + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": "commands/cowork-setup.md", + "line": null, + "message": "No allowed-tools field declared in command frontmatter — frontmatter only has description, argument-hint, disable-model-invocation (lines 1-5), no allowed-tools field" + }, + { + "rule": "R15", + "severity": "medium", + "confidence": "medium", + "file": "commands/check.md", + "line": 3, + "message": "No handling specified for missing/empty required argument — argument-hint requires (line 3); no \"if not provided\" guidance anywhere in the body" + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": "commands/backlink-gap.md", + "line": null, + "message": "No allowed-tools field declared in command frontmatter — frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field" + }, + { + "rule": "R15", + "severity": "medium", + "confidence": "medium", + "file": "commands/backlink-gap.md", + "line": 21, + "message": "Required domain/competitor arguments have no fallback for missing input — ## Inputs section (lines 21-26) has no missing-input guidance, unlike sibling commands" + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": "commands/competitor-analysis.md", + "line": null, + "message": "No allowed-tools field declared in command frontmatter — frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field" + }, + { + "rule": "R15", + "severity": "medium", + "confidence": "medium", + "file": "commands/execute-action.md", + "line": 3, + "message": "No handling specified for when the required --action flag is omitted — argument-hint shows --action unbracketed (required) at line 3; no omission-handling text in body" + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": "commands/brand-setup.md", + "line": null, + "message": "No allowed-tools field declared in command frontmatter — frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field" + }, + { + "rule": "R11", + "severity": "low", + "confidence": "high", + "file": "commands/seo-audit.md", + "line": null, + "message": "No allowed-tools field declared in command frontmatter — frontmatter only has description and argument-hint (lines 1-4), no allowed-tools field" + } + ], + "repo_meta": { + "status": "discovered", + "stars": 705, + "security": "BLOCKED", + "audit_report_path": "auditor/audits/indranilbanerjee-digital-marketing-pro.md" + }, + "generated_at": "2026-08-05T07:18:58Z", + "schema_version": 1 +} From d217a1b59f5def3e095656e34d7a7d467bef73ea Mon Sep 17 00:00:00 2001 From: "nlpm-auditor[bot]" Date: Wed, 5 Aug 2026 07:20:46 +0000 Subject: [PATCH 2/2] disclosure-pending: indranilbanerjee/digital-marketing-pro (security:BLOCKED) --- .../indranilbanerjee-digital-marketing-pro.md | 32 +++++++++++++++++++ auditor/logs/events.jsonl | 1 + 2 files changed, 33 insertions(+) create mode 100644 auditor/disclosures-pending/indranilbanerjee-digital-marketing-pro.md diff --git a/auditor/disclosures-pending/indranilbanerjee-digital-marketing-pro.md b/auditor/disclosures-pending/indranilbanerjee-digital-marketing-pro.md new file mode 100644 index 000000000..a6024b6c2 --- /dev/null +++ b/auditor/disclosures-pending/indranilbanerjee-digital-marketing-pro.md @@ -0,0 +1,32 @@ + + +## Security Findings in Executable Artifacts + +While auditing NL programming artifacts in this repository, our scanner detected potential security issues in executable files. + +### Findings + +| # | Severity | File | Line | Pattern | Description | +|---|----------|------|------|---------|-------------| +| 1 | High | scripts/output-publisher.py | 77 | file-write-outside-repo | `get_visible_publish_dir()` resolves to `~/Documents/DigitalMarketingPro/{brand}`; `_publish_file()` copies artifacts there via `shutil.copy2()` — a write outside the repo/plugin sandbox into the user's home directory (documented "publish" feature, not attacker-controlled, but matches the HIGH pattern literally) | +| 2 | High | scripts/sync_model_registry.sh | 52 | file-write-outside-repo | Destination path is computed via `../` traversal to a sibling checkout outside the repo root, then written by the embedded Python `json.dump` at line 93; no curl-pipe-sh or unvalidated remote download present, but the write target itself escapes the repo tree | + +### About This Report + +These findings come from [NLPM](https://github.com/xiaolai/nlpm)'s security scanner, which checks executable surfaces (hooks, scripts, MCP configs, dependencies) against known-dangerous patterns. + +We may be wrong — false positives happen. If any finding is intentional or already mitigated, please close this issue. If a finding is genuine and you'd like a fix PR, let us know. + +Full audit report: https://github.com/xiaolai/nlpm/blob/main/auditor/audits/indranilbanerjee-digital-marketing-pro.md diff --git a/auditor/logs/events.jsonl b/auditor/logs/events.jsonl index daf2e28aa..f36303f8c 100644 --- a/auditor/logs/events.jsonl +++ b/auditor/logs/events.jsonl @@ -3770,4 +3770,5 @@ {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"repo_report_rendered","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","html":"auditor/reports/Shubhamsaboo-awesome-llm-apps.html"}} {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"audit_complete","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","score":96,"artifacts":11,"strategy":"single"}} {"timestamp":"2026-08-05T07:03:59Z","workflow":"audit","event":"manual_disclosure_pending","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","queue_path":"auditor/disclosures-pending/Shubhamsaboo-awesome-llm-apps.md","gh_error":"GraphQL: Resource not accessible by integration (createIssue)"}} +{"timestamp":"2026-08-05T07:20:46Z","workflow":"audit","event":"manual_disclosure_pending","run_id":"30983048070","run_number":747,"data":{"repo":"indranilbanerjee/digital-marketing-pro","queue_path":"auditor/disclosures-pending/indranilbanerjee-digital-marketing-pro.md","gh_error":"GraphQL: Resource not accessible by integration (createIssue)"}} {"timestamp":"2026-08-05T09:09:12Z","workflow":"track","event":"status_check","run_id":"30991292365","run_number":654,"data":{"contributed":57,"tracked":37,"case_study_ready":42,"rule_adopted":2}}