From c01155db2f7c16e7850164bc140eda48be670ce0 Mon Sep 17 00:00:00 2001 From: "nlpm-auditor[bot]" Date: Wed, 5 Aug 2026 12:56:03 +0000 Subject: [PATCH] audit: hoangsonww/Claude-Code-Agent-Monitor (72/100, security:REVIEW, progressive, 126 artifacts) --- ...w-Claude-Code-Agent-Monitor.findings.jsonl | 221 + .../hoangsonww-Claude-Code-Agent-Monitor.md | 252 ++ auditor/disagreements.jsonl | 2 + auditor/findings.jsonl | 221 + auditor/logs/events.jsonl | 4 + auditor/registry/repos.json | 9 +- .../hoangsonww-Claude-Code-Agent-Monitor.html | 104 + .../hoangsonww-Claude-Code-Agent-Monitor.json | 3881 +++++++++++++++++ 8 files changed, 4691 insertions(+), 3 deletions(-) create mode 100644 auditor/audits/hoangsonww-Claude-Code-Agent-Monitor.findings.jsonl create mode 100644 auditor/audits/hoangsonww-Claude-Code-Agent-Monitor.md create mode 100644 auditor/reports/hoangsonww-Claude-Code-Agent-Monitor.html create mode 100644 auditor/reports/hoangsonww-Claude-Code-Agent-Monitor.json diff --git a/auditor/audits/hoangsonww-Claude-Code-Agent-Monitor.findings.jsonl b/auditor/audits/hoangsonww-Claude-Code-Agent-Monitor.findings.jsonl new file mode 100644 index 000000000..d80dc4e0b --- /dev/null +++ b/auditor/audits/hoangsonww-Claude-Code-Agent-Monitor.findings.jsonl @@ -0,0 +1,221 @@ +{"category":"bug","rule_id":"BUG-unsanitized-argument","file":"plugins/ccam-workflows/commands/dag.md","line":13,"severity":"high","confidence":"high","evidence":"Line 13: curl -s http://localhost:4820/api/workflows/$ARGUMENTS — $ARGUMENTS is spliced unquoted directly into the shell command with no quoting or validation.","penalty":null,"pattern":"","description":"$ARGUMENTS is interpolated unquoted into a curl command line, allowing shell metacharacters in the argument to break out of the intended command.","false_positive":false,"suggested_fix":"Quote the value and validate it looks like a session id, e.g. curl -s \"http://localhost:4820/api/workflows/${ARGUMENTS}\" after checking it matches an expected id pattern."} +{"category":"bug","rule_id":"BUG-unsanitized-argument","file":"plugins/ccam-workflows/commands/workflow.md","line":13,"severity":"high","confidence":"high","evidence":"Line 13: curl -s http://localhost:4820/api/workflows/$ARGUMENTS — $ARGUMENTS is spliced unquoted directly into the shell command with no quoting or validation.","penalty":null,"pattern":"","description":"$ARGUMENTS is interpolated unquoted into a curl command line, allowing shell metacharacters in the argument to break out of the intended command.","false_positive":false,"suggested_fix":"Quote the value and validate it looks like a session id, e.g. curl -s \"http://localhost:4820/api/workflows/${ARGUMENTS}\" after checking it matches an expected id pattern."} +{"category":"bug","rule_id":"BUG-broken-reference","file":"plugins/ccam-dashboard/agents/dashboard-operator.md","line":55,"severity":"medium","confidence":"high","evidence":"grep -n self-update-restart across the repo returns only the one mention in this file; no scripts/self-update-restart.js exists anywhere","penalty":null,"pattern":"","description":"References 'node scripts/self-update-restart.js' as the self-update+restart command, but no such file exists in the repository.","false_positive":false,"suggested_fix":"Add the referenced script, or replace the instruction with the actual self-update mechanism (server/lib/update-check.js referenced by CLAUDE.md)."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-analytics/skills/productivity-score/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: productivity-score' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-analytics/skills/usage-trends/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: usage-trends' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-analytics/skills/cost-breakdown/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: cost-breakdown' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-analytics/skills/model-mix/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: model-mix' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-analytics/skills/session-report/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: session-report' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-analytics/skills/cache-efficiency/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: cache-efficiency' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-dashboard/skills/live-watch/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: live-watch' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-dashboard/skills/endpoint-probe/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: endpoint-probe' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-dashboard/skills/quick-stats/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: quick-stats' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-dashboard/skills/dashboard-status/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: dashboard-status' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-devtools/skills/health-check/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: health-check' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-devtools/skills/data-export/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: data-export' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-devtools/skills/hook-diagnostics/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: hook-diagnostics' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-devtools/skills/transcript-grep/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: transcript-grep' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-devtools/skills/event-trace/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: event-trace' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-devtools/skills/session-debug/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: session-debug' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-insights/skills/anomaly-alert/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: anomaly-alert' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-insights/skills/session-compare/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: session-compare' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-insights/skills/pattern-detect/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: pattern-detect' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-insights/skills/regression-watch/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: regression-watch' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-insights/skills/benchmark/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: benchmark' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-insights/skills/optimization-suggest/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: optimization-suggest' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-quality/skills/hook-failure-audit/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: hook-failure-audit' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-quality/skills/api-error-report/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: api-error-report' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-quality/skills/error-scan/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: error-scan' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-quality/skills/slo-check/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: slo-check' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-quality/skills/regression-alert/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: regression-alert' to the YAML frontmatter."} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-productivity/skills/time-of-day/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: time-of-day' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-productivity/skills/weekly-report/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: weekly-report' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-productivity/skills/sprint-summary/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: sprint-summary' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-productivity/skills/monthly-review/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: monthly-review' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-productivity/skills/daily-standup/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: daily-standup' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-productivity/skills/workflow-optimizer/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: workflow-optimizer' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-workflows/skills/concurrency-report/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: concurrency-report' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-workflows/skills/fleet-runs/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: fleet-runs' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-workflows/skills/delegation-audit/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: delegation-audit' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-workflows/skills/dag-map/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: dag-map' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-workflows/skills/error-propagation/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: error-propagation' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-config/skills/mcp-audit/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: mcp-audit' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-config/skills/memory-review/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: memory-review' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-config/skills/skill-inventory/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: skill-inventory' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-config/skills/hook-inventory/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: hook-inventory' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-config/skills/config-audit/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: config-audit' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-sessions/skills/session-timeline/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: session-timeline' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-sessions/skills/session-cleanup/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: session-cleanup' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-sessions/skills/cwd-rollup/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: cwd-rollup' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-sessions/skills/transcript-replay/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: transcript-replay' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-sessions/skills/session-search/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: session-search' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-cost-guard/skills/budget-set/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: budget-set' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-cost-guard/skills/spend-forecast/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: spend-forecast' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-cost-guard/skills/cost-alert/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: cost-alert' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-cost-guard/skills/daily-budget-check/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: daily-budget-check' to the YAML frontmatter block"} +{"category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-cost-guard/skills/model-savings/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: model-savings' to the YAML frontmatter block"} +{"category":"security","rule_id":"SEC-loopback-network-call","file":"plugins/ccam-analytics/hooks/hooks.json","line":8,"severity":"medium","confidence":"high","evidence":"Stop/SubagentStop hook pipes hook JSON through jq and POSTs to http://localhost:4820/api/hooks/event via curl","penalty":null,"pattern":"curl -X POST http://localhost","description":"Hook makes an unconditional network POST; loopback-only destination limits real-world risk.","false_positive":false,"suggested_fix":"No change required; document that the dashboard hook telemetry is loopback-only."} +{"category":"security","rule_id":"SEC-loopback-network-call","file":"plugins/ccam-cost-guard/hooks/hooks.json","line":8,"severity":"medium","confidence":"high","evidence":"Stop hook POSTs session_id/stop_reason/timestamp to http://localhost:4820/api/hooks/event via curl","penalty":null,"pattern":"curl -X POST http://localhost","description":"Hook makes an unconditional network POST; loopback-only destination limits real-world risk.","false_positive":false,"suggested_fix":"No change required; document that the dashboard hook telemetry is loopback-only."} +{"category":"security","rule_id":"SEC-unverified-binary-download","file":"monitoring/scripts/ensure-binaries.js","line":41,"severity":"medium","confidence":"high","evidence":"installPrometheus()/installGrafana() call downloadFile() then extractArchive() with no checksum comparison anywhere in ensure-binaries.js or install-utils.js","penalty":null,"pattern":"downloadFile(prometheusUrl(), archive)","description":"Downloads and extracts pinned-version Prometheus/Grafana release archives over HTTPS with no SHA256/signature verification before the binaries are later executed locally.","false_positive":false,"suggested_fix":"Verify the downloaded archive's SHA256 against the checksum file each project publishes per release before extraction; abort on mismatch."} +{"category":"security","rule_id":"SEC-file-write-outside-repo","file":"plugins/ccam-productivity/hooks/hooks.json","line":8,"severity":"low","confidence":"high","evidence":"SessionStart/SessionEnd hook commands append a line to /tmp/ccam-session-timing.log","penalty":null,"pattern":">> /tmp/ccam-session-timing.log","description":"Hook writes a timestamp line to a fixed path under /tmp on every session start/end.","false_positive":false,"suggested_fix":"Write to the dashboard's own data directory (server/lib/claude-home.js getDataDir()) instead of /tmp."} +{"category":"security","rule_id":"SEC-hardcoded-credentials","file":"monitoring/scripts/paths.js","line":123,"severity":"low","confidence":"high","evidence":"GRAFANA_ADMIN_USER = \"admin\"; GRAFANA_ADMIN_PASSWORD = \"admin\"; seeded via grafanaAdminEnv() into GF_SECURITY_ADMIN_USER/PASSWORD","penalty":null,"pattern":"GRAFANA_ADMIN_PASSWORD = \"admin\"","description":"Hardcoded default admin/admin credentials for the bundled local Grafana instance.","false_positive":false,"suggested_fix":"Generate and persist a random password on first setup, or require GF_SECURITY_ADMIN_PASSWORD to be set explicitly."} +{"category":"security","rule_id":"SEC-shell-true","file":"scripts/postinstall.js","line":38,"severity":"low","confidence":"high","evidence":"spawnSync(\"npm\", [\"install\"], { cwd: clientDir, stdio: \"inherit\", shell: true }) — shell:true is unconditional here but gated to Windows in the sibling desktop/scripts calls with an identical fixed arg list","penalty":null,"pattern":"shell: true","description":"spawnSync uses shell:true; reviewed and confirmed the argument list is fixed/non-interpolated, so no shell metacharacters can reach the command.","false_positive":true,"fp_reason":"Argument list to spawnSync is a fixed literal array (\"npm\",[\"install\"]) with no interpolation of external input; shell:true is required only for Windows .cmd shim resolution per the inline comment, and the equivalent calls in desktop/scripts/install.js and prebuild.js explicitly gate it to process.platform === \"win32\".","rule_gap":"The security scanner's HIGH pattern for shell=True/shell:true should distinguish fixed-argument spawn calls from calls that interpolate external/user input into the command or args.","suggested_fix":"No change required; optionally gate this call to win32 as well for consistency with the sibling scripts."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/agents/token-economist.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/agents/token-economist.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 14; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/agents/token-economist.md","line":15,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 15; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/agents/analytics-advisor.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/agents/analytics-advisor.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 14; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/agents/analytics-advisor.md","line":15,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 15; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R01","file":"plugins/ccam-analytics/agents/analytics-advisor.md","line":49,"severity":"low","confidence":"medium","evidence":"line 49: 'Fetch from relevant endpoints with curl' — 'relevant' given with no concrete selection criteria","penalty":-2,"pattern":"relevant","description":"Vague quantifier 'relevant' used without stating which endpoints or by what criteria.","false_positive":false,"suggested_fix":"Name the specific endpoints to fetch instead of 'relevant endpoints'."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-dashboard/agents/dashboard-operator.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-dashboard/agents/dashboard-operator.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 13; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-dashboard/agents/dashboard-operator.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 14; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R01","file":"plugins/ccam-dashboard/agents/dashboard-operator.md","line":71,"severity":"low","confidence":"medium","evidence":"line 71: 'Mention the bundled MCP server as a direct-access alternative when relevant.' — no concrete criteria for 'when relevant'","penalty":-2,"pattern":"relevant","description":"Vague quantifier 'relevant' used without concrete criteria for when the condition applies.","false_positive":false,"suggested_fix":"State the concrete condition, e.g. 'when the MCP server is connected'."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/agents/db-inspector.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/agents/db-inspector.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 12; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/agents/db-inspector.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 13; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/agents/issue-triager.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/agents/issue-triager.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 12; body's diagnostic commands (cat, ls, curl, lsof) all run via Bash, never via the Read tool","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/agents/issue-triager.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 13; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R01","file":"plugins/ccam-devtools/agents/issue-triager.md","line":70,"severity":"low","confidence":"medium","evidence":"line 70: 'P2 Medium: Feature degraded (slow queries, stale sessions, missing some events)' — 'some' with no concrete count/criteria","penalty":-2,"pattern":"some","description":"Vague quantifier 'some' used without concrete criteria for what counts as 'missing some events'.","false_positive":false,"suggested_fix":"Replace with a concrete threshold, e.g. 'missing >5% of expected events'."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/agents/trend-forecaster.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/agents/trend-forecaster.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 12; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/agents/trend-forecaster.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 13; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/agents/insights-advisor.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/agents/insights-advisor.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Bash' at line 12; unlike sibling agents, body never says 'curl' or names any shell command — it only lists API endpoints and describes 'analyzing data'","penalty":-3,"pattern":"","description":"Tool 'Bash' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Add explicit 'using curl -s http://localhost:4820/api/...' language as sibling agents do."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/agents/insights-advisor.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 13; body never describes reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/agents/insights-advisor.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 14; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-quality/agents/reliability-engineer.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-quality/agents/reliability-engineer.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 12; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-quality/agents/reliability-engineer.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 13; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/agents/focus-analyst.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/agents/focus-analyst.md","line":11,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 11; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/agents/focus-analyst.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 12; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/agents/productivity-coach.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R12","file":"plugins/ccam-productivity/agents/productivity-coach.md","line":null,"severity":"medium","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"File has sections Available Data / Key Metrics You Can Compute / Coaching Style / Constraints but no Output Standards/Output Format section defining response structure; sibling agents (focus-analyst.md, budget-sentinel.md, etc.) all have an explicit Output Standards section.","false_positive":false,"suggested_fix":"Add an Output Standards section specifying formatting rules matching sibling agents in the same repo."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/agents/productivity-coach.md","line":11,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Bash' at line 11; unlike sibling agents, body never says 'curl' or names any shell command","penalty":-3,"pattern":"","description":"Tool 'Bash' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Add explicit 'using curl -s http://localhost:4820/api/...' language as sibling agents do."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/agents/productivity-coach.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 12; body never describes reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/agents/productivity-coach.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 13; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-workflows/agents/orchestration-analyst.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-workflows/agents/orchestration-analyst.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 13; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-workflows/agents/orchestration-analyst.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 14; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-config/agents/config-auditor.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-config/agents/config-auditor.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 13; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-config/agents/config-auditor.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 14; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-sessions/agents/session-investigator.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-sessions/agents/session-investigator.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 13; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-sessions/agents/session-investigator.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 14; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-cost-guard/agents/budget-sentinel.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-cost-guard/agents/budget-sentinel.md","line":15,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 15; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-cost-guard/agents/budget-sentinel.md","line":16,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 16; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"category":"nl_quality","rule_id":"R09","file":".claude/agents/frontend-reviewer.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative diff/review scenario and the expected findings output."} +{"category":"nl_quality","rule_id":"R11","file":".claude/agents/frontend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body is only 'Focus on: ...' and 'Output: ...' bullet lists with no mention of any tool name or command","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or reference it explicitly (e.g. 'read the changed files')."} +{"category":"nl_quality","rule_id":"R11","file":".claude/agents/frontend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or reference it explicitly."} +{"category":"nl_quality","rule_id":"R11","file":".claude/agents/frontend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions locating files by pattern","penalty":-3,"pattern":"","description":"Tool 'Glob' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Glob' from tools:, or reference it explicitly."} +{"category":"nl_quality","rule_id":"R11","file":".claude/agents/frontend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions running a shell/verification command","penalty":-3,"pattern":"","description":"Tool 'Bash' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Bash' from tools:, or reference it explicitly (e.g. running the test suite)."} +{"category":"nl_quality","rule_id":"R09","file":".claude/agents/backend-reviewer.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative diff/review scenario and the expected findings output."} +{"category":"nl_quality","rule_id":"R11","file":".claude/agents/backend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body is only 'Focus on: ...' and 'Output: ...' bullet lists with no mention of any tool name or command","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or reference it explicitly."} +{"category":"nl_quality","rule_id":"R11","file":".claude/agents/backend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or reference it explicitly."} +{"category":"nl_quality","rule_id":"R11","file":".claude/agents/backend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions locating files by pattern","penalty":-3,"pattern":"","description":"Tool 'Glob' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Glob' from tools:, or reference it explicitly."} +{"category":"nl_quality","rule_id":"R11","file":".claude/agents/backend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions running a shell/verification command","penalty":-3,"pattern":"","description":"Tool 'Bash' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Bash' from tools:, or reference it explicitly (e.g. running npm run test:server)."} +{"category":"nl_quality","rule_id":"R09","file":".claude/agents/mcp-reviewer.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative diff/review scenario and the expected findings output."} +{"category":"nl_quality","rule_id":"R11","file":".claude/agents/mcp-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body is only 'Focus on: ...' and 'Output: ...' bullet lists with no mention of any tool name or command","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or reference it explicitly."} +{"category":"nl_quality","rule_id":"R11","file":".claude/agents/mcp-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or reference it explicitly."} +{"category":"nl_quality","rule_id":"R11","file":".claude/agents/mcp-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions locating files by pattern","penalty":-3,"pattern":"","description":"Tool 'Glob' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Glob' from tools:, or reference it explicitly."} +{"category":"nl_quality","rule_id":"R11","file":".claude/agents/mcp-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions running a shell/verification command","penalty":-3,"pattern":"","description":"Tool 'Bash' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Bash' from tools:, or reference it explicitly (e.g. running the MCP typecheck/build)."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/commands/burn-rate.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl) against the dashboard API.","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/commands/top-spenders.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/commands/cost-today.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-dashboard/commands/open-dashboard.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs uname -s and open via bash code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash.","false_positive":false,"suggested_fix":"Add allowed-tools: Bash to the frontmatter."} +{"category":"nl_quality","rule_id":"R14","file":"plugins/ccam-dashboard/commands/open-dashboard.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"Body describes three sequential phases (print URL/command block, detect platform via uname -s, conditionally suggest an open command) in prose with no numbered step list.","false_positive":false,"suggested_fix":"Convert the phases into an explicit numbered list."} +{"category":"nl_quality","rule_id":"R01","file":"plugins/ccam-dashboard/commands/open-dashboard.md","line":6,"severity":"low","confidence":"medium","evidence":"","penalty":-2,"pattern":"","description":"'the relevant commands' is a vague quantifier without stated selection criteria at point of use.","false_positive":false,"suggested_fix":"Replace with a concrete reference, e.g. 'the start commands listed below.'"} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-dashboard/commands/ping.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-dashboard/commands/status.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/commands/tail-events.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl+jq via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl, jq).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*), Bash(jq:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R14","file":"plugins/ccam-devtools/commands/tail-events.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"Body describes multiple sequential phases (fetch events, render table, print count line, handle error) in prose with no numbered step list.","false_positive":false,"suggested_fix":"Convert the phases into an explicit numbered list."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/commands/export.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/commands/doctor.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via bash code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/commands/compare.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/commands/insights.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R01","file":"plugins/ccam-insights/commands/insights.md","line":17,"severity":"low","confidence":"medium","evidence":"","penalty":-2,"pattern":"","description":"'decision-relevant' is a vague quantifier-style modifier without a precise selection threshold.","false_positive":false,"suggested_fix":"Define the selection rule explicitly, e.g. 'the 3 findings with the largest $ impact.'"} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/commands/anomalies.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-quality/commands/errors.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-quality/commands/health.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via bash code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-quality/commands/slo.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via bash code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/commands/whats-next.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/commands/focus-report.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/commands/standup.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-workflows/commands/dag.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-workflows/commands/runs.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-workflows/commands/workflow.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-config/commands/audit-config.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R14","file":"plugins/ccam-config/commands/audit-config.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"Body describes multiple sequential phases (fetch overview, print the surface table, print a closing verdict line) in prose with no numbered step list.","false_positive":false,"suggested_fix":"Convert the phases into an explicit numbered list."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-config/commands/inventory.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-config/commands/memory.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-sessions/commands/replay.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-sessions/commands/recent.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R14","file":"plugins/ccam-sessions/commands/recent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"Body describes multiple sequential phases (fetch sessions, print the ranked list, print the summed-cost/status tally) in prose with no numbered step list.","false_positive":false,"suggested_fix":"Convert the phases into an explicit numbered list."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-sessions/commands/find-session.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-cost-guard/commands/overspend.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-cost-guard/commands/forecast.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R11","file":"plugins/ccam-cost-guard/commands/budget.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/skills/productivity-score/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/skills/usage-trends/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/skills/cost-breakdown/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/skills/model-mix/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/skills/session-report/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/skills/cache-efficiency/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-dashboard/skills/live-watch/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R01","file":"plugins/ccam-dashboard/skills/live-watch/SKILL.md","line":3,"severity":"low","confidence":"high","evidence":"line 3: 'Polls the Agent Monitor /api/stats endpoint several times over a short window'","penalty":-2,"pattern":"several","description":"Vague quantifier 'several' used without a concrete numeric criterion at point of use.","false_positive":false,"suggested_fix":"Replace 'several' with the concrete default sample count already stated later in the file (5)."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-dashboard/skills/endpoint-probe/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R01","file":"plugins/ccam-dashboard/skills/endpoint-probe/SKILL.md","line":6,"severity":"low","confidence":"high","evidence":"line 6: 'flagging which are reachable. Use to verify a dashboard install is wired up correctly.'","penalty":-2,"pattern":"correctly","description":"Vague quantifier 'correctly' used without a concrete criterion for what 'correctly wired up' means.","false_positive":false,"suggested_fix":"Replace with a concrete criterion, e.g. 'all probed routes return 2xx'."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-dashboard/skills/quick-stats/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-dashboard/skills/dashboard-status/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/skills/health-check/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R01","file":"plugins/ccam-devtools/skills/health-check/SKILL.md","line":5,"severity":"low","confidence":"high","evidence":"line 5: 'Use to verify the monitoring setup is working correctly.'","penalty":-2,"pattern":"correctly","description":"Vague quantifier 'correctly' used without a concrete criterion for what 'working correctly' means.","false_positive":false,"suggested_fix":"State the concrete pass criteria (e.g. all 7 checks PASS)."} +{"category":"nl_quality","rule_id":"R01","file":"plugins/ccam-devtools/skills/health-check/SKILL.md","line":39,"severity":"low","confidence":"high","evidence":"line 39: 'Verify database file exists and has reasonable size'","penalty":-2,"pattern":"reasonable","description":"Vague quantifier 'reasonable' used without a concrete size threshold.","false_positive":false,"suggested_fix":"Specify a concrete size threshold or range instead of 'reasonable size'."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/skills/data-export/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R01","file":"plugins/ccam-devtools/skills/data-export/SKILL.md","line":10,"severity":"low","confidence":"high","evidence":"line 10: 'Export Agent Monitor data in various formats.'","penalty":-2,"pattern":"various","description":"Vague quantifier 'various' used where the concrete list (json/csv/markdown) is already known.","false_positive":false,"suggested_fix":"Replace 'various formats' with the concrete list: JSON, CSV, or Markdown."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/skills/hook-diagnostics/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/skills/transcript-grep/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/skills/event-trace/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/skills/session-debug/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/skills/anomaly-alert/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/skills/session-compare/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/skills/pattern-detect/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/skills/regression-watch/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/skills/benchmark/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/skills/optimization-suggest/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-quality/skills/hook-failure-audit/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-quality/skills/api-error-report/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-quality/skills/error-scan/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-quality/skills/slo-check/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-quality/skills/regression-alert/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/skills/time-of-day/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/skills/weekly-report/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/skills/sprint-summary/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/skills/monthly-review/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/skills/daily-standup/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/skills/workflow-optimizer/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-workflows/skills/concurrency-report/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-workflows/skills/fleet-runs/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-workflows/skills/delegation-audit/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-workflows/skills/dag-map/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-workflows/skills/error-propagation/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-config/skills/mcp-audit/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-config/skills/memory-review/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-config/skills/skill-inventory/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-config/skills/hook-inventory/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-config/skills/config-audit/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-sessions/skills/session-timeline/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-sessions/skills/session-cleanup/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-sessions/skills/cwd-rollup/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-sessions/skills/transcript-replay/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-sessions/skills/session-search/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-cost-guard/skills/budget-set/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-cost-guard/skills/spend-forecast/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-cost-guard/skills/cost-alert/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-cost-guard/skills/daily-budget-check/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"nl_quality","rule_id":"R01","file":"plugins/ccam-cost-guard/skills/daily-budget-check/SKILL.md","line":34,"severity":"low","confidence":"high","evidence":"line 34: 'If inline cost is absent for some rows, fall back to...' — 'some' used without a concrete criterion for which rows","penalty":-2,"pattern":"some","description":"Vague quantifier 'some' used without concrete criteria","false_positive":false,"suggested_fix":"Specify the condition precisely, e.g. 'for sessions where the cost field is null or missing'"} +{"category":"nl_quality","rule_id":"R09","file":"plugins/ccam-cost-guard/skills/model-savings/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"category":"cross_component","rule_id":"CC-orphan-component","file":"plugins/ccam-dashboard/.mcp.json","line":null,"severity":"info","confidence":"high","evidence":"mcp/build/ is listed in both .gitignore and mcp/.gitignore as a TypeScript build artifact directory","penalty":null,"pattern":"","description":"plugins/ccam-dashboard/.mcp.json references ../../mcp/build/index.js which does not exist on disk in a fresh checkout, but this is expected — it is a gitignored build output generated by npm run mcp:build, not a broken reference.","false_positive":true,"fp_reason":"mcp/build/ is a standard gitignored TypeScript compilation output regenerated by npm run mcp:build; absence in a fresh git checkout is expected, not a bug.","rule_gap":"Broken-reference checks for .mcp.json server paths should first check the nearest .gitignore before flagging a missing build-output path as broken.","suggested_fix":"No change needed."} diff --git a/auditor/audits/hoangsonww-Claude-Code-Agent-Monitor.md b/auditor/audits/hoangsonww-Claude-Code-Agent-Monitor.md new file mode 100644 index 000000000..e8b78b1d5 --- /dev/null +++ b/auditor/audits/hoangsonww-Claude-Code-Agent-Monitor.md @@ -0,0 +1,252 @@ +# NLPM Audit: hoangsonww/Claude-Code-Agent-Monitor +**Date**: 2026-04-06 | **Artifacts**: 126 | **Strategy**: progressive +**NL Score**: 72/100 +**Security**: REVIEW +**Bugs**: 56 | **Quality Issues**: 158 | **Security Findings**: 6 + +100 NL artifacts were scored directly (17 agents, 30 commands, 53 skills). Two systemic, repo-wide patterns dominate the result: **every one of the 53 `SKILL.md` files omits the required `name` frontmatter field** (open SKILL.md spec, -25 each), and **every one of the 30 commands omits `allowed-tools`** despite invoking `Bash`/`curl` in their bodies (-5 each). Both are single mechanical fixes applied repo-wide, not 83 independent design problems. + +## NL Score Summary +| File | Type | Score | Top Issue | +|------|------|-------|-----------| +| plugins/ccam-devtools/skills/health-check/SKILL.md | skill | 56 | Missing required frontmatter field: name (-25) | +| plugins/ccam-dashboard/skills/live-watch/SKILL.md | skill | 58 | Missing required frontmatter field: name (-25) | +| plugins/ccam-dashboard/skills/endpoint-probe/SKILL.md | skill | 58 | Missing required frontmatter field: name (-25) | +| plugins/ccam-devtools/skills/data-export/SKILL.md | skill | 58 | Missing required frontmatter field: name (-25) | +| plugins/ccam-cost-guard/skills/daily-budget-check/SKILL.md | skill | 58 | Missing required frontmatter field: name (-25) | +| plugins/ccam-analytics/skills/productivity-score/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-analytics/skills/usage-trends/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-analytics/skills/cost-breakdown/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-analytics/skills/model-mix/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-analytics/skills/session-report/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-analytics/skills/cache-efficiency/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-dashboard/skills/quick-stats/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-dashboard/skills/dashboard-status/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-devtools/skills/hook-diagnostics/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-devtools/skills/transcript-grep/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-devtools/skills/event-trace/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-devtools/skills/session-debug/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-insights/skills/anomaly-alert/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-insights/skills/session-compare/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-insights/skills/pattern-detect/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-insights/skills/regression-watch/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-insights/skills/benchmark/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-insights/skills/optimization-suggest/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-quality/skills/hook-failure-audit/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-quality/skills/api-error-report/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-quality/skills/error-scan/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-quality/skills/slo-check/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-quality/skills/regression-alert/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-productivity/skills/time-of-day/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-productivity/skills/weekly-report/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-productivity/skills/sprint-summary/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-productivity/skills/monthly-review/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-productivity/skills/daily-standup/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-productivity/skills/workflow-optimizer/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-workflows/skills/concurrency-report/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-workflows/skills/fleet-runs/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-workflows/skills/delegation-audit/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-workflows/skills/dag-map/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-workflows/skills/error-propagation/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-config/skills/mcp-audit/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-config/skills/memory-review/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-config/skills/skill-inventory/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-config/skills/hook-inventory/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-config/skills/config-audit/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-sessions/skills/session-timeline/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-sessions/skills/session-cleanup/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-sessions/skills/cwd-rollup/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-sessions/skills/transcript-replay/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-sessions/skills/session-search/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-cost-guard/skills/budget-set/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-cost-guard/skills/spend-forecast/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-cost-guard/skills/cost-alert/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-cost-guard/skills/model-savings/SKILL.md | skill | 60 | Missing required frontmatter field: name (-25) | +| plugins/ccam-productivity/agents/productivity-coach.md | agent | 66 | No `` blocks (-15) + missing Output Standards section (-10) + 3 unused declared tools (-9) | +| plugins/ccam-dashboard/agents/dashboard-operator.md | agent | 67 | Broken reference to non-existent scripts/self-update-restart.js | +| .claude/agents/frontend-reviewer.md | agent | 73 | No `` blocks (-15) + all 4 declared tools unused in body (-12) | +| .claude/agents/backend-reviewer.md | agent | 73 | No `` blocks (-15) + all 4 declared tools unused in body (-12) | +| .claude/agents/mcp-reviewer.md | agent | 73 | No `` blocks (-15) + all 4 declared tools unused in body (-12) | +| plugins/ccam-insights/agents/insights-advisor.md | agent | 76 | No `` blocks (-15) + Bash/Read/Grep all unused (-9) | +| plugins/ccam-analytics/agents/analytics-advisor.md | agent | 77 | No `` blocks (-15) | +| plugins/ccam-devtools/agents/issue-triager.md | agent | 77 | No `` blocks (-15) | +| plugins/ccam-analytics/agents/token-economist.md | agent | 79 | No `` blocks (-15) | +| plugins/ccam-devtools/agents/db-inspector.md | agent | 79 | No `` blocks (-15) | +| plugins/ccam-insights/agents/trend-forecaster.md | agent | 79 | No `` blocks (-15) | +| plugins/ccam-quality/agents/reliability-engineer.md | agent | 79 | No `` blocks (-15) | +| plugins/ccam-productivity/agents/focus-analyst.md | agent | 79 | No `` blocks (-15) | +| plugins/ccam-workflows/agents/orchestration-analyst.md | agent | 79 | No `` blocks (-15) | +| plugins/ccam-config/agents/config-auditor.md | agent | 79 | No `` blocks (-15) | +| plugins/ccam-sessions/agents/session-investigator.md | agent | 79 | No `` blocks (-15) | +| plugins/ccam-cost-guard/agents/budget-sentinel.md | agent | 79 | No `` blocks (-15) | +| plugins/ccam-dashboard/commands/open-dashboard.md | command | 83 | Multi-step body without numbered steps (-10) | +| plugins/ccam-devtools/commands/tail-events.md | command | 85 | Multi-step body without numbered steps (-10) | +| plugins/ccam-workflows/commands/dag.md | command | 85 | Unsanitized $ARGUMENTS spliced unquoted into curl (command-injection risk) | +| plugins/ccam-workflows/commands/workflow.md | command | 85 | Unsanitized $ARGUMENTS spliced unquoted into curl (command-injection risk) | +| plugins/ccam-config/commands/audit-config.md | command | 85 | Multi-step body without numbered steps (-10) | +| plugins/ccam-sessions/commands/recent.md | command | 85 | Multi-step body without numbered steps (-10) | +| plugins/ccam-insights/commands/insights.md | command | 93 | Missing allowed-tools (-5) + vague quantifier "decision-relevant" (-2) | +| plugins/ccam-analytics/commands/burn-rate.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-analytics/commands/top-spenders.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-analytics/commands/cost-today.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-dashboard/commands/ping.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-dashboard/commands/status.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-devtools/commands/export.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-devtools/commands/doctor.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-insights/commands/compare.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-insights/commands/anomalies.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-quality/commands/errors.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-quality/commands/health.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-quality/commands/slo.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-productivity/commands/whats-next.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-productivity/commands/focus-report.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-productivity/commands/standup.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-workflows/commands/runs.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-config/commands/inventory.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-config/commands/memory.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-sessions/commands/replay.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-sessions/commands/find-session.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-cost-guard/commands/overspend.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-cost-guard/commands/forecast.md | command | 95 | Missing allowed-tools declaration (-5) | +| plugins/ccam-cost-guard/commands/budget.md | command | 95 | Missing allowed-tools declaration (-5) | + +Weighted average across all 100 scored artifacts (17 agents, 30 commands, 53 skills; simple mean, each file equal weight): agents avg 76.1, commands avg 92.9, skills avg 59.8 → overall **72/100**. + +## Security Scan +| Severity | Count | +|----------|-------| +| Critical | 0 | +| High | 0 | +| Medium | 3 | +| Low | 3 | + +The pre-scan flagged 1 Critical + 3 High coarse pattern matches. Under a detailed, context-aware manual review — including a repo-wide regex sweep for `curl\|sh`, `eval(`, `os.system`, `shell=True`, `sudo`, `base64 -d`, `/dev/tcp/`, `child_process.exec`, `new Function()` across every `.sh/.py/.js/.ts/.tsx` file outside `node_modules` — **zero** of those patterns reproduced in first-party code. The only repo-wide hit was inside a vendored, minified third-party bundle (`wiki/mermaid.min.js`), which is not first-party executable surface and is out of scope. The Critical/High pre-scan flags most likely came from coarse substring matches (e.g. `password`/`secret`-shaped identifiers in the legitimate Apple notarization flow, or `sudo`/`shell` appearing in deployment-script comments and usage text) that do not hold up as real vulnerabilities on inspection. + +### Execution Surface Inventory +| Surface | Files | +|---------|-------| +| Hooks (`plugins/*/hooks/hooks.json`) | 3 (`ccam-analytics`, `ccam-productivity`, `ccam-cost-guard`) | +| MCP configs (`plugins/*/.mcp.json`) | 1 (`ccam-dashboard`) | +| Operational scripts (`scripts/`, `deployments/scripts/`, `desktop/scripts/`, `monitoring/scripts/`, `.claude/skills/*/scripts/`, `bin/`, `.husky/`) | 36 reviewed in full (of 165 total `.sh/.py/.js` files repo-wide; the remainder are application source/tests under `server/`, `mcp/src/`, `client/`, `desktop/src/`, `vscode-extension/` — not operational/install-time scripts) | +| Package manifests (`package.json`) | 6 (root, `mcp/`, `desktop/`, `vscode-extension/`, `monitoring/`, `client/`) — no `requirements.txt` in the repo | + +### Security Findings +| # | Severity | File | Line | Pattern | Description | +|---|----------|------|------|---------|-------------| +| 1 | Medium | plugins/ccam-analytics/hooks/hooks.json | 8 | network-call | Stop/SubagentStop hooks pipe hook JSON through `jq` and POST it via `curl` to `http://localhost:4820/api/hooks/event`. Loopback-only, no external network or credential exposure, but it is an unconditional network call pattern from a hook. | +| 2 | Medium | plugins/ccam-cost-guard/hooks/hooks.json | 8 | network-call | Stop hook POSTs `{session_id, stop_reason, timestamp}` via `curl` to `http://localhost:4820/api/hooks/event`. Same loopback-only pattern as finding 1. | +| 3 | Medium | monitoring/scripts/ensure-binaries.js / monitoring/scripts/install-utils.js | ensure-binaries.js:41,56; install-utils.js:13-23 | runtime-binary-download | `npm run monitoring:setup` (also wired as `monitoring/package.json`'s `postinstall`) downloads Prometheus and Grafana release archives over HTTPS from `github.com`/`dl.grafana.com` and extracts+installs them into `monitoring/.bin/` with **no checksum or signature verification** before they are later executed as local binaries. URLs and versions are hardcoded/pinned (not user-controlled), which limits — but does not eliminate — the supply-chain exposure if either upstream host is compromised or MITM'd. | +| 4 | Low | plugins/ccam-productivity/hooks/hooks.json | 8, 20 | file-write-outside-repo | SessionStart/SessionEnd hooks append a timestamp line to `/tmp/ccam-session-timing.log`. Fixed path, non-sensitive content (a timestamp), low real-world impact. | +| 5 | Low | monitoring/scripts/paths.js | 123-124 | hardcoded-credentials | `GRAFANA_ADMIN_USER`/`GRAFANA_ADMIN_PASSWORD` are hardcoded to `admin`/`admin` and seeded into the local Grafana container via `GF_SECURITY_ADMIN_*` env vars on first start. Scoped to a local-only monitoring stack (127.0.0.1), but a well-known default-credential pattern worth flagging if the stack is ever exposed. | +| 6 | Low | scripts/postinstall.js / desktop/scripts/install.js / desktop/scripts/prebuild.js | postinstall.js:38; install.js:26; prebuild.js:36 | shell-true-reviewed | `spawnSync(..., { shell: true })` is used to launch `npm`/`npx`, but is gated to `process.platform === "win32"` with a fixed, non-interpolated argument list in every call site. Reviewed and confirmed not exploitable — no shell metacharacters reach the command. Recorded for completeness (false positive). | + +### Execution Surfaces Reviewed and Cleared +`deployments/scripts/{deploy,rollback,teardown,blue-green-switch,db-backup,db-restore,health-check}.sh` (production-grade ops scripts: multi-step confirmation prompts on `production`, `set -euo pipefail`, array-based `kubectl`/`helm`/`terraform` invocations — no unquoted variable expansion into a shell string), `scripts/{hook-handler,codex-hook-handler,install-hooks,install-codex-hooks,postinstall,dev,clear-data,import-history,seed,generate-openapi-yaml}.js`, `scripts/expand-ts-module-docs.py`, `.claude/skills/file-headers/scripts/check-headers*.sh`, `.claude/skills/update-project-docs/scripts/doc-coverage.sh`, `.husky/{pre-commit,commit-msg}`, `bin/ccam.js`, `desktop/scripts/{build-icons.sh,notarize.js}`, all 6 `package.json` manifests (semver-range-pinned dependencies throughout, no `preinstall`/`postinstall` scripts beyond the reviewed items above). + +## Bugs (PR-worthy) +| # | File | Issue | Impact | +|---|------|-------|--------| +| 1 | plugins/ccam-workflows/commands/dag.md | Line 13: `curl -s http://localhost:4820/api/workflows/$ARGUMENTS` splices `$ARGUMENTS` unquoted directly into the shell command | A session id containing shell metacharacters executed via the Bash tool can break out of the intended `curl` invocation — command-injection risk when the argument is user-supplied. | +| 2 | plugins/ccam-workflows/commands/workflow.md | Line 13: identical unquoted `$ARGUMENTS` splice into `curl -s http://localhost:4820/api/workflows/$ARGUMENTS` | Same command-injection risk as #1. | +| 3 | plugins/ccam-dashboard/agents/dashboard-operator.md | Line 55 documents `node scripts/self-update-restart.js` as the self-update+restart command; no such file exists anywhere in the repo (verified) | Following the documented instruction fails with `MODULE_NOT_FOUND`; the agent will hallucinate or fail when a user asks it to self-update. | +| 4–30 | 27 files under `plugins/*/skills/**/SKILL.md` (ccam-analytics ×6, ccam-dashboard ×4, ccam-devtools ×6, ccam-insights ×6, ccam-quality ×5) | Frontmatter contains only `description:`, no `name:` field | Violates the open SKILL.md spec (`name` is required, 1-64 chars, must match the parent directory name); strict frontmatter validators will reject or fail to register the skill. Full file list in the JSONL sidecar. | +| 31–56 | 26 files under `plugins/*/skills/**/SKILL.md` (ccam-productivity ×6, ccam-workflows ×5, ccam-config ×5, ccam-sessions ×5, ccam-cost-guard ×5) | Same missing `name:` field | Same as above. Full file list in the JSONL sidecar. | + +All 53 `SKILL.md` files repo-wide are missing `name:` — this is one mechanical, repo-wide fix (add `name: ` to each frontmatter block), not 53 unrelated design issues. + +## Security Fixes (PR-worthy, Medium/Low only) +| # | File | Issue | Suggested Fix | +|---|------|-------|---------------| +| 1 | plugins/ccam-productivity/hooks/hooks.json | SessionStart/SessionEnd write to `/tmp/ccam-session-timing.log` | Route through the dashboard's own data directory (e.g. `getDataDir()` from `server/lib/claude-home.js`) instead of the shared, world-writable `/tmp`, for consistency with how the rest of the app stores state. | +| 2 | monitoring/scripts/ensure-binaries.js, monitoring/scripts/install-utils.js | Downloads and extracts Prometheus/Grafana binaries with no integrity check | Verify the downloaded archive's SHA256 against the checksum files both projects publish alongside each release (`prometheus-*.sha256`, `grafana-*.sha256`) before extraction; abort on mismatch. | +| 3 | monitoring/scripts/paths.js | Hardcoded `admin`/`admin` Grafana credentials | Generate a random password on first setup (persist it to `monitoring/.data/` alongside the other local state) and print it once, or read `GF_SECURITY_ADMIN_PASSWORD` from the environment with `admin`/`admin` only as an explicit `--insecure-default-creds`-style opt-in. | + +Medium/Low findings 4 and 6 (the two loopback-only hook POSTs, and the reviewed-safe `shell:true` usage) need no code change — flagging them in the tracking issue for visibility is sufficient. + +## Quality Issues (informational) +| # | File | Issue | Penalty | +|---|------|-------|---------| +| 1 | plugins/ccam-analytics/agents/token-economist.md | No `` blocks | -15 | +| 2 | plugins/ccam-analytics/agents/token-economist.md | `Read` declared in frontmatter, never used in body | -3 | +| 3 | plugins/ccam-analytics/agents/token-economist.md | `Grep` declared in frontmatter, never used in body | -3 | +| 4 | plugins/ccam-analytics/agents/analytics-advisor.md | No `` blocks | -15 | +| 5 | plugins/ccam-analytics/agents/analytics-advisor.md | `Read` declared, never used | -3 | +| 6 | plugins/ccam-analytics/agents/analytics-advisor.md | `Grep` declared, never used | -3 | +| 7 | plugins/ccam-analytics/agents/analytics-advisor.md | Line 49: vague quantifier "relevant endpoints" | -2 | +| 8 | plugins/ccam-dashboard/agents/dashboard-operator.md | No `` blocks | -15 | +| 9 | plugins/ccam-dashboard/agents/dashboard-operator.md | `Read` declared, never used | -3 | +| 10 | plugins/ccam-dashboard/agents/dashboard-operator.md | `Grep` declared, never used | -3 | +| 11 | plugins/ccam-dashboard/agents/dashboard-operator.md | Line 71: vague quantifier "when relevant" | -2 | +| 12 | plugins/ccam-devtools/agents/db-inspector.md | No `` blocks | -15 | +| 13 | plugins/ccam-devtools/agents/db-inspector.md | `Read` declared, never used | -3 | +| 14 | plugins/ccam-devtools/agents/db-inspector.md | `Grep` declared, never used | -3 | +| 15 | plugins/ccam-devtools/agents/issue-triager.md | No `` blocks | -15 | +| 16 | plugins/ccam-devtools/agents/issue-triager.md | `Read` declared, never used | -3 | +| 17 | plugins/ccam-devtools/agents/issue-triager.md | `Grep` declared, never used | -3 | +| 18 | plugins/ccam-devtools/agents/issue-triager.md | Line 70: vague quantifier "missing some events" | -2 | +| 19 | plugins/ccam-insights/agents/trend-forecaster.md | No `` blocks | -15 | +| 20 | plugins/ccam-insights/agents/trend-forecaster.md | `Read` declared, never used | -3 | +| 21 | plugins/ccam-insights/agents/trend-forecaster.md | `Grep` declared, never used | -3 | +| 22 | plugins/ccam-insights/agents/insights-advisor.md | No `` blocks | -15 | +| 23 | plugins/ccam-insights/agents/insights-advisor.md | `Bash` declared, never referenced (unlike sibling agents, body never names curl or a shell command) | -3 | +| 24 | plugins/ccam-insights/agents/insights-advisor.md | `Read` declared, never used | -3 | +| 25 | plugins/ccam-insights/agents/insights-advisor.md | `Grep` declared, never used | -3 | +| 26 | plugins/ccam-quality/agents/reliability-engineer.md | No `` blocks | -15 | +| 27 | plugins/ccam-quality/agents/reliability-engineer.md | `Read` declared, never used | -3 | +| 28 | plugins/ccam-quality/agents/reliability-engineer.md | `Grep` declared, never used | -3 | +| 29 | plugins/ccam-productivity/agents/focus-analyst.md | No `` blocks | -15 | +| 30 | plugins/ccam-productivity/agents/focus-analyst.md | `Read` declared, never used | -3 | +| 31 | plugins/ccam-productivity/agents/focus-analyst.md | `Grep` declared, never used | -3 | +| 32 | plugins/ccam-productivity/agents/productivity-coach.md | No `` blocks | -15 | +| 33 | plugins/ccam-productivity/agents/productivity-coach.md | No "Output Standards" section (sibling agents all define one) | -10 | +| 34 | plugins/ccam-productivity/agents/productivity-coach.md | `Bash` declared, never referenced | -3 | +| 35 | plugins/ccam-productivity/agents/productivity-coach.md | `Read` declared, never used | -3 | +| 36 | plugins/ccam-productivity/agents/productivity-coach.md | `Grep` declared, never used | -3 | +| 37 | plugins/ccam-workflows/agents/orchestration-analyst.md | No `` blocks | -15 | +| 38 | plugins/ccam-workflows/agents/orchestration-analyst.md | `Read` declared, never used | -3 | +| 39 | plugins/ccam-workflows/agents/orchestration-analyst.md | `Grep` declared, never used | -3 | +| 40 | plugins/ccam-config/agents/config-auditor.md | No `` blocks | -15 | +| 41 | plugins/ccam-config/agents/config-auditor.md | `Read` declared, never used | -3 | +| 42 | plugins/ccam-config/agents/config-auditor.md | `Grep` declared, never used | -3 | +| 43 | plugins/ccam-sessions/agents/session-investigator.md | No `` blocks | -15 | +| 44 | plugins/ccam-sessions/agents/session-investigator.md | `Read` declared, never used | -3 | +| 45 | plugins/ccam-sessions/agents/session-investigator.md | `Grep` declared, never used | -3 | +| 46 | plugins/ccam-cost-guard/agents/budget-sentinel.md | No `` blocks | -15 | +| 47 | plugins/ccam-cost-guard/agents/budget-sentinel.md | `Read` declared, never used | -3 | +| 48 | plugins/ccam-cost-guard/agents/budget-sentinel.md | `Grep` declared, never used | -3 | +| 49 | .claude/agents/frontend-reviewer.md | No `` blocks | -15 | +| 50 | .claude/agents/frontend-reviewer.md | `Read`/`Grep`/`Glob`/`Bash` all declared, none referenced explicitly in body | -12 | +| 51 | .claude/agents/backend-reviewer.md | No `` blocks | -15 | +| 52 | .claude/agents/backend-reviewer.md | `Read`/`Grep`/`Glob`/`Bash` all declared, none referenced explicitly in body | -12 | +| 53 | .claude/agents/mcp-reviewer.md | No `` blocks | -15 | +| 54 | .claude/agents/mcp-reviewer.md | `Read`/`Grep`/`Glob`/`Bash` all declared, none referenced explicitly in body | -12 | +| 55–84 | All 30 files under `plugins/*/commands/*.md` | Missing `allowed-tools` frontmatter despite the body invoking Bash/curl | -5 each | +| 85 | plugins/ccam-dashboard/commands/open-dashboard.md | Multi-step body (print block → detect platform → suggest open command) with no numbered list | -10 | +| 86 | plugins/ccam-dashboard/commands/open-dashboard.md | Line 6: vague quantifier "the relevant commands" | -2 | +| 87 | plugins/ccam-devtools/commands/tail-events.md | Multi-step body with no numbered list | -10 | +| 88 | plugins/ccam-insights/commands/insights.md | Line 17: vague quantifier "decision-relevant" | -2 | +| 89 | plugins/ccam-config/commands/audit-config.md | Multi-step body with no numbered list | -10 | +| 90 | plugins/ccam-sessions/commands/recent.md | Multi-step body with no numbered list | -10 | +| 91–117 | 27 files under `plugins/*/skills/**/SKILL.md` (ccam-analytics through ccam-quality) | No `` blocks | -15 each | +| 118 | plugins/ccam-dashboard/skills/live-watch/SKILL.md | Line 3: vague quantifier "several times" | -2 | +| 119 | plugins/ccam-dashboard/skills/endpoint-probe/SKILL.md | Line 6: vague quantifier "correctly" | -2 | +| 120 | plugins/ccam-devtools/skills/health-check/SKILL.md | Line 5: vague quantifier "correctly" | -2 | +| 121 | plugins/ccam-devtools/skills/health-check/SKILL.md | Line 39: vague quantifier "reasonable size" | -2 | +| 122 | plugins/ccam-devtools/skills/data-export/SKILL.md | Line 10: vague quantifier "various formats" | -2 | +| 123–148 | 26 files under `plugins/*/skills/**/SKILL.md` (ccam-productivity through ccam-cost-guard) | No `` blocks | -15 each | +| 149 | plugins/ccam-cost-guard/skills/daily-budget-check/SKILL.md | Line 34: vague quantifier "for some rows" | -2 | + +Rows 55–84, 91–117, and 123–148 are collapsed ranges of one repeated finding type each (missing `allowed-tools` on all 30 commands; no `` blocks on all 53 skills) — every individual instance is broken out by file in the JSONL sidecar (158 quality-issue lines total). + +## Cross-Component +- `plugins/ccam-dashboard/.mcp.json` references `../../mcp/build/index.js`, which does not exist on disk — **not a bug**: `mcp/build/` is listed in both `.gitignore` and `mcp/.gitignore` as a TypeScript build output, generated by `npm run mcp:build`. +- `.claude-plugin/marketplace.json` lists exactly 10 plugin entries, matching the 10 directories under `plugins/`. No stale or orphaned plugin entries found. +- Skills referenced by name from command bodies (`dag-map`, `fleet-runs`, `delegation-audit`, `concurrency-report`, `error-propagation`, `model-savings`) all resolve to an existing `SKILL.md` under the matching plugin's `skills/` directory — no broken cross-references found beyond the one documented in Bugs #3. +- The missing-`name`-frontmatter pattern (53/53 skills) and missing-`allowed-tools` pattern (30/30 commands) are both total — i.e. they are not local to one plugin but apply identically across all 10 plugins, consistent with all 10 plugins having been generated from one shared template that predates both requirements. + +## Recommendation +**REVIEW — submit NL fix PRs for the 56 bugs, flag the 3 Medium security findings in the tracking issue** (do not open public PRs for the Medium findings per the security-fix policy; note them for the maintainer). No Critical or High security findings survived detailed review, so contribution is not blocked. Given the size of the bug set, PR splitting guidance: +1. One PR: add `name:` frontmatter to all 53 `SKILL.md` files (single mechanical commit). +2. One PR: add `allowed-tools` frontmatter to all 30 commands (single mechanical commit). +3. One PR: quote `$ARGUMENTS` in `dag.md` and `workflow.md` (security-adjacent NL bug, small and isolated — safe for a public PR since it's a documentation/prompt fix, not the underlying execution engine). +4. One PR: fix or remove the `scripts/self-update-restart.js` reference in `dashboard-operator.md`. diff --git a/auditor/disagreements.jsonl b/auditor/disagreements.jsonl index ee21c4762..5e9e0aa28 100644 --- a/auditor/disagreements.jsonl +++ b/auditor/disagreements.jsonl @@ -228,3 +228,5 @@ {"event":"maintainer_rejected","pr":"laolaoshiren/claude-code-skills-zh#16","fingerprints":["sha256:c949f71c4d1fa09e8c29690639cfb7dab79feca91ef138b5b9ad7628b062a60c","sha256:fa5e9803f2ff3c1a834b85059c9727fc819a7d7316103668c27e40df2e83e529"],"rule_ids":["SEC-temp-file-write","SEC-temp-file-write"],"dissent_type":"context_missed","quote":"We did not adopt the repository .tmp scheme because new directory might still be 0755 under common POSIX umask.","commenter_role":"maintainer","classifier_model":"haiku-4-5","classifier_confidence":"medium","comments_hash":"sha256:021cf038186b23b9ec71e4fb392a3cc2909e331a4dbdc68aaefdb954c966f75f","timestamp":"2026-08-01T04:40:35Z"} {"event": "downstream_suppression", "timestamp": "2026-08-02T00:22:26Z", "repo": "xiaolai/cc-suite", "commit_sha": "6d02d7540acba055eda79c8355e85275a0451a3d", "rule_id": "R31", "suppression_type": "threshold_adjustment", "fingerprint": "sha256:479c2103b7d8dd2532b6af6c514e5d3b95f364db6503416633bba4b838612fde", "file_fingerprint": "sha256:0973eb2098961d7d60ac66c4217a6974abac61cd366b713ee9f4ac626fe6fb59", "path": ".claude/nlpm.local.md", "override_value": {"threshold": 900}, "reason_given": ""} {"event": "downstream_suppression", "timestamp": "2026-08-02T00:22:26Z", "repo": "xiaolai/cc-suite", "commit_sha": "6d02d7540acba055eda79c8355e85275a0451a3d", "rule_id": "R51", "suppression_type": "rule_override", "fingerprint": "sha256:6eb255100e953a537daab93747608eb544524e9e41b5c095b0cafe48079486a2", "file_fingerprint": "sha256:0973eb2098961d7d60ac66c4217a6974abac61cd366b713ee9f4ac626fe6fb59", "path": ".claude/nlpm.local.md", "override_value": {"enabled": true, "vocabulary_skill": "skills/cc-suite/vocabulary/"}, "reason_given": ""} +{"event":"self_false_positive","timestamp":"2026-08-05T12:55:57Z","repo":"hoangsonww/Claude-Code-Agent-Monitor","fingerprint":"sha256:021a7ba0a1cdd92dea374bea8829d0026a5920d9dd89ada4f03d00039fdfe820","rule_id":"SEC-shell-true","reason":"Argument list to spawnSync is a fixed literal array (\"npm\",[\"install\"]) with no interpolation of external input; shell:true is required only for Windows .cmd shim resolution per the inline comment, and the equivalent calls in desktop/scripts/install.js and prebuild.js explicitly gate it to process.platform === \"win32\".","rule_gap":"The security scanner's HIGH pattern for shell=True/shell:true should distinguish fixed-argument spawn calls from calls that interpolate external/user input into the command or args."} +{"event":"self_false_positive","timestamp":"2026-08-05T12:55:57Z","repo":"hoangsonww/Claude-Code-Agent-Monitor","fingerprint":"sha256:1e78a18687daca55f79179c6306894e05d4c89789d13c09351de7c89e750dc71","rule_id":"CC-orphan-component","reason":"mcp/build/ is a standard gitignored TypeScript compilation output regenerated by npm run mcp:build; absence in a fresh git checkout is expected, not a bug.","rule_gap":"Broken-reference checks for .mcp.json server paths should first check the nearest .gitignore before flagging a missing build-output path as broken."} diff --git a/auditor/findings.jsonl b/auditor/findings.jsonl index 05519cdc1..b4c95d57a 100644 --- a/auditor/findings.jsonl +++ b/auditor/findings.jsonl @@ -5304,6 +5304,227 @@ {"event":"finding","timestamp":"2026-08-05T07:03:41Z","audit_run_id":"30983032406","repo":"Shubhamsaboo/awesome-llm-apps","commit_sha":"779e9f9bcf87fa8cd95870a438b70b84e47d3173","fingerprint":"sha256:2bfa78d32cfaa8b1309799ea441db44cc498402ae36c506eadd79c6683afe525","category":"nl_quality","rule_id":"R01","file":"agent_skills/commit-archaeologist/SKILL.md","line":119,"severity":"low","confidence":"high","evidence":"line 119 'End by offering one relevant follow-up, such as:'","penalty":-2,"pattern":"vague-quantifier","description":"Vague quantifier 'relevant' used without measurable criteria","false_positive":false,"suggested_fix":"Replace with a measurable criterion or remove the qualifier"} {"event":"finding","timestamp":"2026-08-05T07:03:41Z","audit_run_id":"30983032406","repo":"Shubhamsaboo/awesome-llm-apps","commit_sha":"779e9f9bcf87fa8cd95870a438b70b84e47d3173","fingerprint":"sha256:7d87bda7727b4fa0dfc7962debaf47090c6b0f33b9e081b4e9ec8e2178840a9c","category":"nl_quality","rule_id":"R01","file":"agent_skills/dependency-doctor/SKILL.md","line":47,"severity":"low","confidence":"high","evidence":"line 47 'If no path is given and several manifests exist,'","penalty":-2,"pattern":"vague-quantifier","description":"Vague quantifier 'several' used without measurable criteria","false_positive":false,"suggested_fix":"Replace with a measurable criterion or remove the qualifier"} {"event":"finding","timestamp":"2026-08-05T07:03:41Z","audit_run_id":"30983032406","repo":"Shubhamsaboo/awesome-llm-apps","commit_sha":"779e9f9bcf87fa8cd95870a438b70b84e47d3173","fingerprint":"sha256:e56e87e8405e56c8cad8fb4336a237bb584a69792634fe21ac8fb8a216d7fd72","category":"cross_component","rule_id":"CC-terminology-drift","file":"generative_ui_agents/ai-mcp-app-builder/apps/mcp-use-server/.agent/skills","line":null,"severity":"low","confidence":"high","evidence":"chatgpt-app-builder and mcp-builder both reference 'mcp-app-builder' (singular); the live skill directory is 'mcp-apps-builder' (plural)","penalty":null,"pattern":"naming-mismatch","description":"Deprecation-notice naming drift between two stub skills and the actual replacement skill directory name","false_positive":false,"suggested_fix":"Standardize on mcp-apps-builder (the real directory name) in both deprecation notices"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:bc7ccbbfe02ad72d53d5411a24750bce55aba2da4136502687b3d61bc51266f6","category":"bug","rule_id":"BUG-unsanitized-argument","file":"plugins/ccam-workflows/commands/dag.md","line":13,"severity":"high","confidence":"high","evidence":"Line 13: curl -s http://localhost:4820/api/workflows/$ARGUMENTS — $ARGUMENTS is spliced unquoted directly into the shell command with no quoting or validation.","penalty":null,"pattern":"","description":"$ARGUMENTS is interpolated unquoted into a curl command line, allowing shell metacharacters in the argument to break out of the intended command.","false_positive":false,"suggested_fix":"Quote the value and validate it looks like a session id, e.g. curl -s \"http://localhost:4820/api/workflows/${ARGUMENTS}\" after checking it matches an expected id pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:631a733deaff7ed80c20d0fb48e5b48ad88f474e80fdb803f32878ff755fa754","category":"bug","rule_id":"BUG-unsanitized-argument","file":"plugins/ccam-workflows/commands/workflow.md","line":13,"severity":"high","confidence":"high","evidence":"Line 13: curl -s http://localhost:4820/api/workflows/$ARGUMENTS — $ARGUMENTS is spliced unquoted directly into the shell command with no quoting or validation.","penalty":null,"pattern":"","description":"$ARGUMENTS is interpolated unquoted into a curl command line, allowing shell metacharacters in the argument to break out of the intended command.","false_positive":false,"suggested_fix":"Quote the value and validate it looks like a session id, e.g. curl -s \"http://localhost:4820/api/workflows/${ARGUMENTS}\" after checking it matches an expected id pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:7a951b601c015107c0b892b60b99b50f51278d0fe7872240b91a63bc2ba4c4d9","category":"bug","rule_id":"BUG-broken-reference","file":"plugins/ccam-dashboard/agents/dashboard-operator.md","line":55,"severity":"medium","confidence":"high","evidence":"grep -n self-update-restart across the repo returns only the one mention in this file; no scripts/self-update-restart.js exists anywhere","penalty":null,"pattern":"","description":"References 'node scripts/self-update-restart.js' as the self-update+restart command, but no such file exists in the repository.","false_positive":false,"suggested_fix":"Add the referenced script, or replace the instruction with the actual self-update mechanism (server/lib/update-check.js referenced by CLAUDE.md)."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:fdda6ae73bc3b396cb34a8485eda1fbb84cb4f8cd5b6479abba193a024bb4c9e","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-analytics/skills/productivity-score/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: productivity-score' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:0fffaaf6250711fb5e8dcfe0f322b4101a118678651f61b0e98b54af174c0ff3","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-analytics/skills/usage-trends/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: usage-trends' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:47a4175f8e0e581fb34e7d7ce6b5bc54e934f0482ddca3b2b96922f295bce3e8","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-analytics/skills/cost-breakdown/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: cost-breakdown' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:15f3061850c21b55a809e148a739556175ce056f0b0a80a2561617b6198ac003","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-analytics/skills/model-mix/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: model-mix' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:be04d75f62982e62c06ac436b63d08ec5ce326b4394c89518a58b4d27fac4733","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-analytics/skills/session-report/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: session-report' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:cf5482af53d98ce45d8828ed3515f3e24c0dc940b2773d84ff21bdbad13ef3fa","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-analytics/skills/cache-efficiency/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: cache-efficiency' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:cfe7840b21067a05c85c7c76ad83c400ee543f2930db28f4922fb9c8071c0bea","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-dashboard/skills/live-watch/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: live-watch' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:bc6009c44c0e8835b3e87a53612f0849fca4811d975473a33c2b8696af4fa57b","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-dashboard/skills/endpoint-probe/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: endpoint-probe' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:89f43baa05884a6f248f01f98a1384db140f524e9ed1bdf89df32c8044b37ee9","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-dashboard/skills/quick-stats/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: quick-stats' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:61b7f89ab6fbf9082d3c9cc722fb4af25cccb1bca31fe3bd4b4ab24ed77af103","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-dashboard/skills/dashboard-status/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: dashboard-status' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:3d6ee61d3c8d9179875e70967a1c500286a11dca2ce4ae085a48954611ad83af","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-devtools/skills/health-check/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: health-check' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:9a714cfc4922e6b02eb52220a7157163a494be7e4b591bed7e8bf4d8640ba868","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-devtools/skills/data-export/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: data-export' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:91b41cd0654e735ec9b832f421fe1f8ba23b09d33878ed097d7ab34080f0b827","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-devtools/skills/hook-diagnostics/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: hook-diagnostics' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:86977bef865f1a6bdbfaa5e221cc6d4c9f00d3c0983a73b28585cf47151bb678","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-devtools/skills/transcript-grep/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: transcript-grep' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:7e0051dc43733316c12744e8f0150d750006ab50858d771a61ff378439389cbe","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-devtools/skills/event-trace/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: event-trace' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:01fd8a908ad10f7db3dc31dc757d2ab8018e605f685771f23f7f41fda4e7496a","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-devtools/skills/session-debug/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: session-debug' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:2a1ff43a068be01b27ae0d5b2fdb1fa46171594b74250b37c43e80d5777a1701","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-insights/skills/anomaly-alert/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: anomaly-alert' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:f7df8b297fcd63e8398e203968a490a5261a5a29ecd27d3c5d69dac4ac71816e","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-insights/skills/session-compare/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: session-compare' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:a38ceecf8161dab0f11996a063ce83052974f3a7ecfc04596a6cebea81a767a8","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-insights/skills/pattern-detect/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: pattern-detect' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:15be3412b825b498f158b03af32756ba027dc7d0d778bd7146dd01bbf1c7ce97","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-insights/skills/regression-watch/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: regression-watch' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:5d97e2e8dc0be557fe53cdab4f331e46bd650e5cb12b5ca188924a426c541194","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-insights/skills/benchmark/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: benchmark' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:5deaf96b37a1abe875da2b773a60a938b2d1ebee299e5867905bc1912d37789d","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-insights/skills/optimization-suggest/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: optimization-suggest' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:27dcac5d4157f481e3216be3bbd0be6e1fa03fa8f9e2aab506db736427cfeb3d","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-quality/skills/hook-failure-audit/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: hook-failure-audit' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:16426578b0e78df34b46a07f1547a21afc204fae5387117f929d64bc86e87652","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-quality/skills/api-error-report/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: api-error-report' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:94d85a2eae786e7821f24c0be16c268ec9c353eaaf519b91f3d555c8bef6c9b1","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-quality/skills/error-scan/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: error-scan' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:49d4df8b6aacb33da92086c5dfed4e2a64709901b2eaa21da062b8effd94aee4","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-quality/skills/slo-check/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: slo-check' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:598f4deef4bf7740be69d524c0c6d9aa71c9f7eb1ba79b50aeda17b1217641ac","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-quality/skills/regression-alert/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter has only 'description:' field, no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field.","false_positive":false,"suggested_fix":"Add 'name: regression-alert' to the YAML frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:70307473c5b417b2ffc447fd64b8b419faec1b6ede9cf3f059cb1711aac5811b","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-productivity/skills/time-of-day/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: time-of-day' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:1f14a7113be135e8f72e98b461506c1f74677633a07746061f6a91d562fad0e1","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-productivity/skills/weekly-report/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: weekly-report' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:55f087db90c273d1a90518c7df771b38418ceddd157c4706c41cf3321522a770","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-productivity/skills/sprint-summary/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: sprint-summary' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:991ab0f7d2ac8f813751c5b62a4260138de6fbf729cdc2f895588496c28535d5","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-productivity/skills/monthly-review/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: monthly-review' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:747b5abcd969affdf2c6e9d4752cfc278268e43be78ceb08f0ca0b0e5477c15d","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-productivity/skills/daily-standup/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: daily-standup' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:f356b52e6d17715a46d9e2df459726b975593e71183a88294a5307c09f2fd6de","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-productivity/skills/workflow-optimizer/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: workflow-optimizer' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:354679a17fdd05ec3941813acff0debbd56d889016b1972b929125886bb30a52","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-workflows/skills/concurrency-report/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: concurrency-report' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:b9deb5852ac1abc611176ae3fe82ae69a3ce28c0d20f310a98332bda6cffbb5b","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-workflows/skills/fleet-runs/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: fleet-runs' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:f21e64af76384c74aa751282dbbe44fb21415c48c3aa75904a577bada95706d6","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-workflows/skills/delegation-audit/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: delegation-audit' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:52fd0b91219261225d08bd1571bd6d1f1dcc8b8150e2737af1a7a16ccc997711","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-workflows/skills/dag-map/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: dag-map' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:df267df530a9457b8d640628665c09a863633180ef929f879d213acb0fb7d70f","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-workflows/skills/error-propagation/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: error-propagation' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:777d75f4645501d3afa40cdc533a4172704f1251d4556c11fbab95149ec91f25","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-config/skills/mcp-audit/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: mcp-audit' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:2987b1ddfebdc11b74bce2cdb087909be0045b137d402a1a6d516b67f672e151","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-config/skills/memory-review/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: memory-review' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:553d5af2c59d6ec879fc76094023457a354b828dde07e40626e511174759da78","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-config/skills/skill-inventory/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: skill-inventory' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:d66f3f25fdbc39bd2cc2b90a0eaa2ca07aec730ff33548f0ce8d69bb086f4a72","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-config/skills/hook-inventory/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: hook-inventory' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:81815126b8c97002aca4d63a7c7f170c3998e10288b8e3c5083e2d1d37273f6f","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-config/skills/config-audit/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: config-audit' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:c932391501a9fab4e95bd2b3af5af9fcf17ba6309b6c1168e9d9ed374ed0d0e6","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-sessions/skills/session-timeline/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: session-timeline' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:23806391e724262382e8eeb874a65adc6efc121fba77db01afe2539a0c8b3ad2","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-sessions/skills/session-cleanup/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: session-cleanup' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:34566d6812ee8e64369aa280372329fb852f956181abc1060c1925ad9c433953","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-sessions/skills/cwd-rollup/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: cwd-rollup' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:f282378754bfa8a35cc928afdc6dfcbb6463fa4113bbb20db09cc437d56a3735","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-sessions/skills/transcript-replay/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: transcript-replay' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:4124d012aa9354f2571a1faf753b464f9946d9f6372327e56dafaaa4aead3092","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-sessions/skills/session-search/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: session-search' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:11999c984690e610e0ad4ddbc74aa30a514e52bff2ce604da65f7019826cbe45","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-cost-guard/skills/budget-set/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: budget-set' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:8d926aa8223a24461646ca47a873d3e10849a08e8940528716780472ac3f4c97","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-cost-guard/skills/spend-forecast/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: spend-forecast' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:f6c7ab6896f1c519e8c88dd704b693681da6054a4bb8d1d62d05017c505afe2c","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-cost-guard/skills/cost-alert/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: cost-alert' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:bdbb5f186b7a927bc1fff18da647db9e92c2dbbf6b08f1e47764e910a263e51f","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-cost-guard/skills/daily-budget-check/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: daily-budget-check' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:730fe2495c707f0d2be89cc54b3231a7c1f57a5513f19710cd210f964e69838e","category":"bug","rule_id":"BUG-missing-frontmatter","file":"plugins/ccam-cost-guard/skills/model-savings/SKILL.md","line":1,"severity":"high","confidence":"high","evidence":"frontmatter contains only 'description:', no 'name:' field","penalty":null,"pattern":"","description":"SKILL.md frontmatter is missing the required 'name' field","false_positive":false,"suggested_fix":"Add 'name: model-savings' to the YAML frontmatter block"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:28035d0720a1f9374c1a6a060be458b758bc2ff10604c635aab5ff926ef7ca16","category":"security","rule_id":"SEC-loopback-network-call","file":"plugins/ccam-analytics/hooks/hooks.json","line":8,"severity":"medium","confidence":"high","evidence":"Stop/SubagentStop hook pipes hook JSON through jq and POSTs to http://localhost:4820/api/hooks/event via curl","penalty":null,"pattern":"curl -X POST http://localhost","description":"Hook makes an unconditional network POST; loopback-only destination limits real-world risk.","false_positive":false,"suggested_fix":"No change required; document that the dashboard hook telemetry is loopback-only."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:84a806a156e38f55056a020de29971d96dc183dc9e93d5199b5a1b212416e542","category":"security","rule_id":"SEC-loopback-network-call","file":"plugins/ccam-cost-guard/hooks/hooks.json","line":8,"severity":"medium","confidence":"high","evidence":"Stop hook POSTs session_id/stop_reason/timestamp to http://localhost:4820/api/hooks/event via curl","penalty":null,"pattern":"curl -X POST http://localhost","description":"Hook makes an unconditional network POST; loopback-only destination limits real-world risk.","false_positive":false,"suggested_fix":"No change required; document that the dashboard hook telemetry is loopback-only."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:e195b10480b53bfbd6af639fd85d0093666012218908f5cc98482a3a672752b1","category":"security","rule_id":"SEC-unverified-binary-download","file":"monitoring/scripts/ensure-binaries.js","line":41,"severity":"medium","confidence":"high","evidence":"installPrometheus()/installGrafana() call downloadFile() then extractArchive() with no checksum comparison anywhere in ensure-binaries.js or install-utils.js","penalty":null,"pattern":"downloadFile(prometheusUrl(), archive)","description":"Downloads and extracts pinned-version Prometheus/Grafana release archives over HTTPS with no SHA256/signature verification before the binaries are later executed locally.","false_positive":false,"suggested_fix":"Verify the downloaded archive's SHA256 against the checksum file each project publishes per release before extraction; abort on mismatch."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:6ffd86a36eb2f66fb3ee059e60b48db6d5c525c90b8df867acc23303d40a906c","category":"security","rule_id":"SEC-file-write-outside-repo","file":"plugins/ccam-productivity/hooks/hooks.json","line":8,"severity":"low","confidence":"high","evidence":"SessionStart/SessionEnd hook commands append a line to /tmp/ccam-session-timing.log","penalty":null,"pattern":">> /tmp/ccam-session-timing.log","description":"Hook writes a timestamp line to a fixed path under /tmp on every session start/end.","false_positive":false,"suggested_fix":"Write to the dashboard's own data directory (server/lib/claude-home.js getDataDir()) instead of /tmp."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:07d60276abbce376d97d744a63836d36246808e380d8997ac41a0bbcd920ad69","category":"security","rule_id":"SEC-hardcoded-credentials","file":"monitoring/scripts/paths.js","line":123,"severity":"low","confidence":"high","evidence":"GRAFANA_ADMIN_USER = \"admin\"; GRAFANA_ADMIN_PASSWORD = \"admin\"; seeded via grafanaAdminEnv() into GF_SECURITY_ADMIN_USER/PASSWORD","penalty":null,"pattern":"GRAFANA_ADMIN_PASSWORD = \"admin\"","description":"Hardcoded default admin/admin credentials for the bundled local Grafana instance.","false_positive":false,"suggested_fix":"Generate and persist a random password on first setup, or require GF_SECURITY_ADMIN_PASSWORD to be set explicitly."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:021a7ba0a1cdd92dea374bea8829d0026a5920d9dd89ada4f03d00039fdfe820","category":"security","rule_id":"SEC-shell-true","file":"scripts/postinstall.js","line":38,"severity":"low","confidence":"high","evidence":"spawnSync(\"npm\", [\"install\"], { cwd: clientDir, stdio: \"inherit\", shell: true }) — shell:true is unconditional here but gated to Windows in the sibling desktop/scripts calls with an identical fixed arg list","penalty":null,"pattern":"shell: true","description":"spawnSync uses shell:true; reviewed and confirmed the argument list is fixed/non-interpolated, so no shell metacharacters can reach the command.","false_positive":true,"fp_reason":"Argument list to spawnSync is a fixed literal array (\"npm\",[\"install\"]) with no interpolation of external input; shell:true is required only for Windows .cmd shim resolution per the inline comment, and the equivalent calls in desktop/scripts/install.js and prebuild.js explicitly gate it to process.platform === \"win32\".","rule_gap":"The security scanner's HIGH pattern for shell=True/shell:true should distinguish fixed-argument spawn calls from calls that interpolate external/user input into the command or args.","suggested_fix":"No change required; optionally gate this call to win32 as well for consistency with the sibling scripts."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:57031ef9aec25f4e2699c03e9e1136a106767b907774440a72c28249fd8c867d","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/agents/token-economist.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:7b33d68ad31a5e9a8c89f4b775ae5338d2231081ebd49df11e9a2ded53d23d09","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/agents/token-economist.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 14; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:b2cada05f6652d01086274b3e3fa5607f18d359fa35e3d93fc034526feb8eb58","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/agents/token-economist.md","line":15,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 15; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:e2b304e2abfc76922e3d0d8cb19768e3e3f23fde18d2e0b75c5b3abf3e6d3e67","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/agents/analytics-advisor.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:a174163b4017354cae9017412293dc22f2d28df2b41a5a15dffea34f6fb0d53a","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/agents/analytics-advisor.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 14; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:03c5533a02ec5bd89b0c1ac909c599c01b6814c02cc68464599596dccf529cc3","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/agents/analytics-advisor.md","line":15,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 15; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:2dfc9a894809597316e0cf61e14a225a711207066a15db4ed4162fb9edb57524","category":"nl_quality","rule_id":"R01","file":"plugins/ccam-analytics/agents/analytics-advisor.md","line":49,"severity":"low","confidence":"medium","evidence":"line 49: 'Fetch from relevant endpoints with curl' — 'relevant' given with no concrete selection criteria","penalty":-2,"pattern":"relevant","description":"Vague quantifier 'relevant' used without stating which endpoints or by what criteria.","false_positive":false,"suggested_fix":"Name the specific endpoints to fetch instead of 'relevant endpoints'."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:fa892007343c48fc13008c716e839322ffb105f91e96a21fc9f233757df0eec5","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-dashboard/agents/dashboard-operator.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:dcf6feaf11986439d57d97569dd785478bb14a83cba600c68586fc048b4466f6","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-dashboard/agents/dashboard-operator.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 13; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:4b9cb8b4c2996de50d643cf4fcfc58149f5038bd64c58c167ab5629491125840","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-dashboard/agents/dashboard-operator.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 14; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:834e6d329063aee098f982c026f1f651347ffb58c5ea07d6b8d1ea31a2c83dcf","category":"nl_quality","rule_id":"R01","file":"plugins/ccam-dashboard/agents/dashboard-operator.md","line":71,"severity":"low","confidence":"medium","evidence":"line 71: 'Mention the bundled MCP server as a direct-access alternative when relevant.' — no concrete criteria for 'when relevant'","penalty":-2,"pattern":"relevant","description":"Vague quantifier 'relevant' used without concrete criteria for when the condition applies.","false_positive":false,"suggested_fix":"State the concrete condition, e.g. 'when the MCP server is connected'."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:fccb25da218ecbec45b4d52963d26dd95f4b8f2b0a5ff39fac555a776dfd584a","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/agents/db-inspector.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:d18fb793c9ca351271fbe9c2c29786d10ae39e92ac075639e5c2f3d110b4e74d","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/agents/db-inspector.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 12; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:a95b1cc4a430fe3837d6f8ddf7970ba2e321a0ba472cd7ef03ccf3dc059fea11","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/agents/db-inspector.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 13; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:2d228a15071a3c47290e0284bc00b0b54688ce5a51f39082ac38b27e4752001f","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/agents/issue-triager.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:baa14729758aa33ad7f69441090295ddeae622c1342cf4d619b56ded626d0b71","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/agents/issue-triager.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 12; body's diagnostic commands (cat, ls, curl, lsof) all run via Bash, never via the Read tool","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:3a666c848fb6e5d83c498656e6f9d963a69c17342c74d2b32ac3903a1bb8093d","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/agents/issue-triager.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 13; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:c09ecea812bffc099bd65ccd5f1d85f6a2cbb55d94ec0dbd040ebb4cc2421b68","category":"nl_quality","rule_id":"R01","file":"plugins/ccam-devtools/agents/issue-triager.md","line":70,"severity":"low","confidence":"medium","evidence":"line 70: 'P2 Medium: Feature degraded (slow queries, stale sessions, missing some events)' — 'some' with no concrete count/criteria","penalty":-2,"pattern":"some","description":"Vague quantifier 'some' used without concrete criteria for what counts as 'missing some events'.","false_positive":false,"suggested_fix":"Replace with a concrete threshold, e.g. 'missing >5% of expected events'."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:bef8eed7581fc1a29622e82c4e0548e2673cbce4942f80f38f54e1c558df5c8c","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/agents/trend-forecaster.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:1023e3d3c067e3ee11de064556cbe9e15d9a401fa153d1b7281c2b5de2fcb721","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/agents/trend-forecaster.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 12; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:3af4f303e49330d35f49804e51b66cc0fa23a30264b158aced1d405f793210f9","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/agents/trend-forecaster.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 13; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:dd3d4ac344369a1b9bbb22c7b567120075f20260304635e15024762437546604","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/agents/insights-advisor.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:d0275bfdd0f3bfc9aa3824289725f3e83a64397736e3b9b4e1d6ce5266951eb7","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/agents/insights-advisor.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Bash' at line 12; unlike sibling agents, body never says 'curl' or names any shell command — it only lists API endpoints and describes 'analyzing data'","penalty":-3,"pattern":"","description":"Tool 'Bash' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Add explicit 'using curl -s http://localhost:4820/api/...' language as sibling agents do."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:912fb04c0865e399b61436feed3738c552b0b4c5e10a16b5e79e90ad8338e295","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/agents/insights-advisor.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 13; body never describes reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:3f46c9ea569fb94dc6d6fb5abf096bfbce1fe501d9791369184c8bff67a2adab","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/agents/insights-advisor.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 14; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:5756e8df5e481755c654641dae438770c6838ac3d35d142eae4024556f191008","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-quality/agents/reliability-engineer.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:c2d6a12ac945345f38ef9f62a7f4d43c916d8a91de27b151cf695fccbcf8523b","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-quality/agents/reliability-engineer.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 12; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:62bb95ecbe8780ed06f7c26e272ec493b05186a96c8bd6703350cdadeb664e4a","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-quality/agents/reliability-engineer.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 13; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:45a7f9d04a3be8d0937ef37c83cc34fe130ee9abd4edc2c445d0234e2d4b20d2","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/agents/focus-analyst.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:9ca97db945f844057145b321e276cb95ea142269cecf0bdea165c49cd9fa65a8","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/agents/focus-analyst.md","line":11,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 11; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:0ca143a4de37b99169815e5408c631a408a518c6191141a9b4d0b567cc851b37","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/agents/focus-analyst.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 12; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:4c0d224e65238cc3e5dde1cb5f91e56040b646f2c21c814dececaca376cbb797","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/agents/productivity-coach.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:1f63a4974dcaee03bad844c7d0f97b23f3ba4da0f13d1060c1781dc806185395","category":"nl_quality","rule_id":"R12","file":"plugins/ccam-productivity/agents/productivity-coach.md","line":null,"severity":"medium","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"File has sections Available Data / Key Metrics You Can Compute / Coaching Style / Constraints but no Output Standards/Output Format section defining response structure; sibling agents (focus-analyst.md, budget-sentinel.md, etc.) all have an explicit Output Standards section.","false_positive":false,"suggested_fix":"Add an Output Standards section specifying formatting rules matching sibling agents in the same repo."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:8bfe391b3e21a9222a5e31038d54b7fad53819fd304c21287039ab591daa0886","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/agents/productivity-coach.md","line":11,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Bash' at line 11; unlike sibling agents, body never says 'curl' or names any shell command","penalty":-3,"pattern":"","description":"Tool 'Bash' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Add explicit 'using curl -s http://localhost:4820/api/...' language as sibling agents do."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:8f1e68b5fd2d8b823ed22b7f50e23d7f9972db75c51666c128bfc9192a7a9276","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/agents/productivity-coach.md","line":12,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 12; body never describes reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:96b2c260c49a325bdbb20ba344d6f84fe471c41659a0a2abd03b9d16bc40f2d2","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/agents/productivity-coach.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 13; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:9ee387314f65b3b3879fa80bbcb041ec3bc6299e302c86f22277d4d271b66155","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-workflows/agents/orchestration-analyst.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:91781c17551546d9a1cb37f2365c3d5de4ecc022e3fa06ac573ea97b562d4620","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-workflows/agents/orchestration-analyst.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 13; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:673a229034d99e8f04d52b156e50326af3afa6cd5d6b28b6c5bf36c96e4c63cd","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-workflows/agents/orchestration-analyst.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 14; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:08fd381e86ff8a52b16315bb8df14d7fd2215c34766157b49a7856dc440744c0","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-config/agents/config-auditor.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:8af1bd526cb97fba17d86530485e51d0345c354f74cde327b3357768d859d718","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-config/agents/config-auditor.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 13; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:a4b262e054e2b0345cef9281b278c3d34d4d66d9d49c6562697f2aded69071a9","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-config/agents/config-auditor.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 14; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:3a3815bd5b410ec3c8213215280e9d2a05a99fec37a7e7d27452f76cbda22034","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-sessions/agents/session-investigator.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:d79e878dbb507ca601bbeb7040d70888a3db60e60d45e1cd946585024a7cdbc2","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-sessions/agents/session-investigator.md","line":13,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 13; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:de1e5380c5080e39dc5d8f56f6576491d017df13d595ead29d3fb5397004dfdd","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-sessions/agents/session-investigator.md","line":14,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 14; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:55275c9bcc04c9c13b2a2e6c3e6608f94496eee264634a18dbe11956d3bb4fce","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-cost-guard/agents/budget-sentinel.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative user request and the expected structured response."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:58ff6b018b899cb417f7b9d29edf6dc496b08ec0c0bfe2831a072e2eb1a9aa23","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-cost-guard/agents/budget-sentinel.md","line":15,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Read' at line 15; body only describes querying the API via curl (Bash), never reading a local file","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or add a body step that reads a local file."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:71ab37eafaa0b71b260aa39387bbdd14ab5cc13a4b89a01581e385ecf1cb26d0","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-cost-guard/agents/budget-sentinel.md","line":16,"severity":"low","confidence":"high","evidence":"frontmatter declares 'Grep' at line 16; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or add a body step that greps for a pattern."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:5a65e2ad9dd9cc71e59fdf18a81ef4bafcce406fc5fef5fb2a23e904c98076e6","category":"nl_quality","rule_id":"R09","file":".claude/agents/frontend-reviewer.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative diff/review scenario and the expected findings output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:cbd9becf2b1b3e4bf0cfc6a564500824f2e3af60a0fba94d0b7a25f95566cb48","category":"nl_quality","rule_id":"R11","file":".claude/agents/frontend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body is only 'Focus on: ...' and 'Output: ...' bullet lists with no mention of any tool name or command","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or reference it explicitly (e.g. 'read the changed files')."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:cbd9becf2b1b3e4bf0cfc6a564500824f2e3af60a0fba94d0b7a25f95566cb48","category":"nl_quality","rule_id":"R11","file":".claude/agents/frontend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or reference it explicitly."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:cbd9becf2b1b3e4bf0cfc6a564500824f2e3af60a0fba94d0b7a25f95566cb48","category":"nl_quality","rule_id":"R11","file":".claude/agents/frontend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions locating files by pattern","penalty":-3,"pattern":"","description":"Tool 'Glob' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Glob' from tools:, or reference it explicitly."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:cbd9becf2b1b3e4bf0cfc6a564500824f2e3af60a0fba94d0b7a25f95566cb48","category":"nl_quality","rule_id":"R11","file":".claude/agents/frontend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions running a shell/verification command","penalty":-3,"pattern":"","description":"Tool 'Bash' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Bash' from tools:, or reference it explicitly (e.g. running the test suite)."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:1da678a497f59b138135055d21805c5df2a9be0901e71851385f6fe2cf23465b","category":"nl_quality","rule_id":"R09","file":".claude/agents/backend-reviewer.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative diff/review scenario and the expected findings output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:987cf5119563e308a4f8b58972d665e0b15ec714f6bc77c46c1e90bf30cb8ed7","category":"nl_quality","rule_id":"R11","file":".claude/agents/backend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body is only 'Focus on: ...' and 'Output: ...' bullet lists with no mention of any tool name or command","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or reference it explicitly."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:987cf5119563e308a4f8b58972d665e0b15ec714f6bc77c46c1e90bf30cb8ed7","category":"nl_quality","rule_id":"R11","file":".claude/agents/backend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or reference it explicitly."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:987cf5119563e308a4f8b58972d665e0b15ec714f6bc77c46c1e90bf30cb8ed7","category":"nl_quality","rule_id":"R11","file":".claude/agents/backend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions locating files by pattern","penalty":-3,"pattern":"","description":"Tool 'Glob' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Glob' from tools:, or reference it explicitly."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:987cf5119563e308a4f8b58972d665e0b15ec714f6bc77c46c1e90bf30cb8ed7","category":"nl_quality","rule_id":"R11","file":".claude/agents/backend-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions running a shell/verification command","penalty":-3,"pattern":"","description":"Tool 'Bash' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Bash' from tools:, or reference it explicitly (e.g. running npm run test:server)."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:774719efc9a635c1651801d8afd601b4b303a869a3f688178c32d9d94324d6c5","category":"nl_quality","rule_id":"R09","file":".claude/agents/mcp-reviewer.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across the file returns 0 matches","penalty":-15,"pattern":"","description":"Agent body contains zero blocks demonstrating invocation and expected behavior.","false_positive":false,"suggested_fix":"Add 2+ blocks showing a representative diff/review scenario and the expected findings output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:9a95a9e633c0eb05eb6604baeb5c5714d5c1af1a2ac32737f6c5053e5400bc9d","category":"nl_quality","rule_id":"R11","file":".claude/agents/mcp-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body is only 'Focus on: ...' and 'Output: ...' bullet lists with no mention of any tool name or command","penalty":-3,"pattern":"","description":"Tool 'Read' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Read' from tools:, or reference it explicitly."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:9a95a9e633c0eb05eb6604baeb5c5714d5c1af1a2ac32737f6c5053e5400bc9d","category":"nl_quality","rule_id":"R11","file":".claude/agents/mcp-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions searching/grepping file content","penalty":-3,"pattern":"","description":"Tool 'Grep' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Grep' from tools:, or reference it explicitly."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:9a95a9e633c0eb05eb6604baeb5c5714d5c1af1a2ac32737f6c5053e5400bc9d","category":"nl_quality","rule_id":"R11","file":".claude/agents/mcp-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions locating files by pattern","penalty":-3,"pattern":"","description":"Tool 'Glob' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Glob' from tools:, or reference it explicitly."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:9a95a9e633c0eb05eb6604baeb5c5714d5c1af1a2ac32737f6c5053e5400bc9d","category":"nl_quality","rule_id":"R11","file":".claude/agents/mcp-reviewer.md","line":4,"severity":"low","confidence":"high","evidence":"frontmatter line 4 declares 'Read, Grep, Glob, Bash'; body never mentions running a shell/verification command","penalty":-3,"pattern":"","description":"Tool 'Bash' is declared in frontmatter but never referenced/used in the body text.","false_positive":false,"suggested_fix":"Remove 'Bash' from tools:, or reference it explicitly (e.g. running the MCP typecheck/build)."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:3e5ef3528dfac9fe57ed32be46d684c2c74b05f61ac6892c3c9a52eface73c9a","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/commands/burn-rate.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl) against the dashboard API.","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:f5533895ef01f1b3c63b7f2e3e5c55f3b59fd345e09406e3a159213e992d7191","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/commands/top-spenders.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:88fe32a38132d893a499ed358d940ea29b7975d2af38352c990bc2407487f001","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-analytics/commands/cost-today.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:6d061464c343b7a9d0d7ca04e05c63f2be5d287a1f04a250e174dba3102c86c0","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-dashboard/commands/open-dashboard.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs uname -s and open via bash code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash.","false_positive":false,"suggested_fix":"Add allowed-tools: Bash to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:38d0ec0dd94c702b78ff7259697c11949329c95a8ba42c48123dad60112b9d78","category":"nl_quality","rule_id":"R14","file":"plugins/ccam-dashboard/commands/open-dashboard.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"Body describes three sequential phases (print URL/command block, detect platform via uname -s, conditionally suggest an open command) in prose with no numbered step list.","false_positive":false,"suggested_fix":"Convert the phases into an explicit numbered list."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:2513eacb0ae7c216525a69ccbd9c05faac47a10898c7998a86cf679728dad38e","category":"nl_quality","rule_id":"R01","file":"plugins/ccam-dashboard/commands/open-dashboard.md","line":6,"severity":"low","confidence":"medium","evidence":"","penalty":-2,"pattern":"","description":"'the relevant commands' is a vague quantifier without stated selection criteria at point of use.","false_positive":false,"suggested_fix":"Replace with a concrete reference, e.g. 'the start commands listed below.'"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:63d04aa494ede8df35da7f6cf1cc9d55e0c2165cedbfacd871e97b1b9eae686a","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-dashboard/commands/ping.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:10dcc07b11a60e2880bea87fb27c3e902e78ba7a851186b35a699c5c4bebaafa","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-dashboard/commands/status.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:c6aaf3a8238ec045db5980e1169718c68f2e003fdf3bec2b7027c5ec43fa0384","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/commands/tail-events.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl+jq via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl, jq).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*), Bash(jq:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:b70e13f65818f53202a24d452c94d1ae734b04db0d6fa411adee13854bf746aa","category":"nl_quality","rule_id":"R14","file":"plugins/ccam-devtools/commands/tail-events.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"Body describes multiple sequential phases (fetch events, render table, print count line, handle error) in prose with no numbered step list.","false_positive":false,"suggested_fix":"Convert the phases into an explicit numbered list."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:8b22af7a84f807c2e762e90dec371153ef62ebe2dac507e88787393063114135","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/commands/export.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:05df2bc9685b9dbaae7c5c1b8e5b992abb3f1099f31874763a59ccc0eff81a75","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-devtools/commands/doctor.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via bash code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:72f81f8ac47278d527be5ca373a0aff46e7bd9b7ec681cc2d7011e21bd92c9e7","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/commands/compare.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:65fad21aada1723c9c5e088430e5871cdbbd3a88af2d5adc3bd9e7ee858add62","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/commands/insights.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:4725eb5941591c6782a3660adf11fd5e700804836bcf20b66fd7922dbdb1ff7b","category":"nl_quality","rule_id":"R01","file":"plugins/ccam-insights/commands/insights.md","line":17,"severity":"low","confidence":"medium","evidence":"","penalty":-2,"pattern":"","description":"'decision-relevant' is a vague quantifier-style modifier without a precise selection threshold.","false_positive":false,"suggested_fix":"Define the selection rule explicitly, e.g. 'the 3 findings with the largest $ impact.'"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:2d02e53c9d22d7b9be10cf706edd735d89ab52b101f6d5690cee3679f95f86c6","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-insights/commands/anomalies.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:e99581bb724feea2363b183fd03b8be606d90bfa1451c15aaac0f1b898c40b60","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-quality/commands/errors.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:dd47cd2aae966664cb7cbd4980496fb4b18cfa280f5f5e29c4b20b2b06e22ace","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-quality/commands/health.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via bash code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:4ee1289c5bf66673652948b392529986be11143d983fa9bd5a62075e00673bae","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-quality/commands/slo.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via bash code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:75c754afc2eb6f60856a3e42594e0acb62b0916e18cb8c17577442814378939f","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/commands/whats-next.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:5b5fed6b3422eec570700ba824ee091b4a2d3b55d194b61b81debce7be3898ac","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/commands/focus-report.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:c988c101a69f1362632cc0a9c6931fae6e1475a7b760617ccd3b95698790935f","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-productivity/commands/standup.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:74ffdbdee756dfb3c0b4c867d162d4bdd84e3c648dd4b5d4f994a5b142220810","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-workflows/commands/dag.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:5505e076fffa73538a72c67b5993ef11f9531574e56feaca55c626cfa4229247","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-workflows/commands/runs.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:14e63fe1b6900e7245ac74b827f83302fe110983e98f25c1611d964c20bb2998","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-workflows/commands/workflow.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:753ea7ba38bbf55d65e9a78984a8e32e9e77482b96dce5fe7674bd4ad9c3ff53","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-config/commands/audit-config.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:9bf4e85a1bd38b5fcd253cc9986110f2fcedbeecb9138504cd8aecbe62faf724","category":"nl_quality","rule_id":"R14","file":"plugins/ccam-config/commands/audit-config.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"Body describes multiple sequential phases (fetch overview, print the surface table, print a closing verdict line) in prose with no numbered step list.","false_positive":false,"suggested_fix":"Convert the phases into an explicit numbered list."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:be5a97ccbfc96b9e60e6649c0a6f1a3a71d0926b2bdb142ddbf19b708a5ef2ca","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-config/commands/inventory.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:fabcf1d8264d3e87fccf51801a453c643109c3e2eeb12fd2952a2c0a89371313","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-config/commands/memory.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:ff4a672eb2dc6515b614a9d4e28ff1d81040262ed1f50305d3c592fd9cccb44c","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-sessions/commands/replay.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:02213299c22a7467980abc8fc85c5821a4f2cd92b9f7663332c79c50108563a0","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-sessions/commands/recent.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:08116d2447eea56b72eaa415bf0f1bb39c721a09351798559b42081a7fc12ba3","category":"nl_quality","rule_id":"R14","file":"plugins/ccam-sessions/commands/recent.md","line":null,"severity":"low","confidence":"medium","evidence":"","penalty":-10,"pattern":"","description":"Body describes multiple sequential phases (fetch sessions, print the ranked list, print the summed-cost/status tally) in prose with no numbered step list.","false_positive":false,"suggested_fix":"Convert the phases into an explicit numbered list."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:2e09be3228c25a5bc3f0232f2d30a0cee91d84ec49028bbbe8d3c6995bfb31dc","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-sessions/commands/find-session.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a bash code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:9fbee38d59f9f33aa5e0d2be41adfc63721f67e10e877be3d2a23314a3f8ad1c","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-cost-guard/commands/overspend.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:9172bb041273bc633f00e7bb8ab9e81339a8b56b53ea2673bce1cdc5ddee4e1f","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-cost-guard/commands/forecast.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via code blocks.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:7645775dc42cc5ff588c8f16a27b5f5ecf3f7f91215cb1d002715ceda1c69830","category":"nl_quality","rule_id":"R11","file":"plugins/ccam-cost-guard/commands/budget.md","line":null,"severity":"medium","confidence":"high","evidence":"No allowed-tools/tools key in frontmatter; body runs curl via a code block.","penalty":-5,"pattern":"","description":"Frontmatter omits allowed-tools despite the body invoking Bash (curl).","false_positive":false,"suggested_fix":"Add allowed-tools: Bash(curl:*) to the frontmatter."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:3942dc2a98b96b21af89272b882bbc0cb76180b02e470c91977c7dde8ca99196","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/skills/productivity-score/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:68bebb5bd21dcade0c0138ab818a095368f6990484d2f042b68c4218cd3dbd3d","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/skills/usage-trends/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:16894d9ba930fd45220f5ab8e46f663f14709ea5cb5d06e0cf5b9eedfc87bd1d","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/skills/cost-breakdown/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:043d31148237191f63d7ce12e8b08066bf9642c13244c5328ffb9bd6a487f871","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/skills/model-mix/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:942cd4e1e04322c34837f877f3ed7f4781475b6c4f74334651b994d8d4f49f13","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/skills/session-report/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:2e7fddb64a9f74e634462837d3d0cb8881648555368067413299f0c9de49400a","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-analytics/skills/cache-efficiency/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:2eeaa4628df433e03ce55e3fab458c48a14f1b3d9f4cdf2af9b3a175db7ea03d","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-dashboard/skills/live-watch/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:b49994698799bdf023dd636230a1a9893af3c16dc943489543533de20801ede1","category":"nl_quality","rule_id":"R01","file":"plugins/ccam-dashboard/skills/live-watch/SKILL.md","line":3,"severity":"low","confidence":"high","evidence":"line 3: 'Polls the Agent Monitor /api/stats endpoint several times over a short window'","penalty":-2,"pattern":"several","description":"Vague quantifier 'several' used without a concrete numeric criterion at point of use.","false_positive":false,"suggested_fix":"Replace 'several' with the concrete default sample count already stated later in the file (5)."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:d7b428f4d6de4f83e37ce438ef774a8b3367e43ba4380fd7e2d5333957a95f8d","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-dashboard/skills/endpoint-probe/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:a710f9fbb4ab434cd65ad30f477ae9cde290f38713153e96b7fbdcd7d7c4b8d7","category":"nl_quality","rule_id":"R01","file":"plugins/ccam-dashboard/skills/endpoint-probe/SKILL.md","line":6,"severity":"low","confidence":"high","evidence":"line 6: 'flagging which are reachable. Use to verify a dashboard install is wired up correctly.'","penalty":-2,"pattern":"correctly","description":"Vague quantifier 'correctly' used without a concrete criterion for what 'correctly wired up' means.","false_positive":false,"suggested_fix":"Replace with a concrete criterion, e.g. 'all probed routes return 2xx'."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:6b9a56f96a04f184a14e399cda591a247f46906a7d34f63fcdbcd104e6cca72c","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-dashboard/skills/quick-stats/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:971b7589fa2453ecd973fa760a38c2f321f775d5d910f95d616b0d64d049b00b","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-dashboard/skills/dashboard-status/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:165464ce9efa443cdc2cb41da14c1be4b180c78ab9e7f7a5cc1240dbca94a4ee","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/skills/health-check/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:51e741741a8f6c9ab026f5cd658b3eb683001516ffed89f63c6232e75d7860c3","category":"nl_quality","rule_id":"R01","file":"plugins/ccam-devtools/skills/health-check/SKILL.md","line":5,"severity":"low","confidence":"high","evidence":"line 5: 'Use to verify the monitoring setup is working correctly.'","penalty":-2,"pattern":"correctly","description":"Vague quantifier 'correctly' used without a concrete criterion for what 'working correctly' means.","false_positive":false,"suggested_fix":"State the concrete pass criteria (e.g. all 7 checks PASS)."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:abf8a59cbfef77a44fdff9c43f73a8abf232255c2fd57a26ce67cc735639914b","category":"nl_quality","rule_id":"R01","file":"plugins/ccam-devtools/skills/health-check/SKILL.md","line":39,"severity":"low","confidence":"high","evidence":"line 39: 'Verify database file exists and has reasonable size'","penalty":-2,"pattern":"reasonable","description":"Vague quantifier 'reasonable' used without a concrete size threshold.","false_positive":false,"suggested_fix":"Specify a concrete size threshold or range instead of 'reasonable size'."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:e191fea7982e8f5ef363b7f06e5a176771ce2a90599e5c3b292b530b1db37812","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/skills/data-export/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:abaf14d8efce5d34cbd9c3e906fe5bbf6254b863a9499b7167ac5fa9c0a6e788","category":"nl_quality","rule_id":"R01","file":"plugins/ccam-devtools/skills/data-export/SKILL.md","line":10,"severity":"low","confidence":"high","evidence":"line 10: 'Export Agent Monitor data in various formats.'","penalty":-2,"pattern":"various","description":"Vague quantifier 'various' used where the concrete list (json/csv/markdown) is already known.","false_positive":false,"suggested_fix":"Replace 'various formats' with the concrete list: JSON, CSV, or Markdown."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:80fabe63fb6107157752439a8276c0aba1a13b53dcc3ce7306bdf037db09721e","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/skills/hook-diagnostics/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:989cea98889fe3c4943f8431aac7fcac2ca75b542d199f90f1e02319ccab2ddc","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/skills/transcript-grep/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:cc709c0e78913a4ac104c8146e827ba7a08cd309991f783fa16298c3578c6c79","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/skills/event-trace/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:be22346d5ab066b657780d52adada392cf13fa54ccc0cf8f216bc8dd15a0654b","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-devtools/skills/session-debug/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:783957bfac29c18296b4bf120c8992a7970cf002bbe9f3399e0488312640f260","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/skills/anomaly-alert/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:cfcbc92dd6324da09378a55c5a2697b857858932f168b3b2c08d5f8d332f4b6a","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/skills/session-compare/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:f02c535f08582ea7c2f8f30789a46e394bf8c945e09e790c5d1fc619052c6973","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/skills/pattern-detect/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:4a3c34a1c8bb761f77e9c5d8b5c43b4b1091956cf657ea062cea1e85fbf7b922","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/skills/regression-watch/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:a0b78f00be05e5b42de2a8f676e474da06fec14cfda73cf5ce5657e8024df3b0","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/skills/benchmark/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:900d65bbba36e0677d8844098f94ab23487ed56b66b43717eee46d2eb58f9c00","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-insights/skills/optimization-suggest/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:1a1e760e15c69c60f5ff17fe41f5da4bf0a0d7f4d1f2bef9033da467af006ef2","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-quality/skills/hook-failure-audit/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:37fd607557cbab2f348998444dfacad2a610cff4ee70e392486640523184c4bf","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-quality/skills/api-error-report/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:e595d4f96776c9819d17a35b822df6d35482bff562bf8ad8ceee8161af832bc7","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-quality/skills/error-scan/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:30325a684bf9772db9bba8e017650235fddbe3acb2c5785ee696b3e1e93aa5fb","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-quality/skills/slo-check/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:f083ca3007437a48c55096dc9d91fec2116fb3c5fd98275d1ffb7310defe48d1","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-quality/skills/regression-alert/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' across file returns zero matches","penalty":-15,"pattern":"","description":"No blocks (context + trigger + expected behavior) present.","false_positive":false,"suggested_fix":"Add at least 2 blocks demonstrating trigger scenarios and expected output."} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:daf319a6cbe6ba08d116dde27fb9e34dcbeab8b16a1aa65a3e4c511f2e3ed04e","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/skills/time-of-day/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:5b0a1b63b4f4a605dcaaf03694289aef0460c32fdeab79b8eac5ccfee422eec6","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/skills/weekly-report/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:efef8d1477a20dc7c1c179dd86fecc063d7cc1a3311ebfcd8896e4e38b79ffe3","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/skills/sprint-summary/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:e0cab743bc3bf8b607db0b71a74707742d74887c96133a9b1e0536136a83bf83","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/skills/monthly-review/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:3c8fc49d1b5c44f6bba39762e120e9fd9c4d341ee5017a7aecf1bb02e33807b0","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/skills/daily-standup/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:13e8734df8a5bc997d683bd62050ee831510481b23e0056a9ee26ee17bba8aff","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-productivity/skills/workflow-optimizer/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:6023eb0606cfe818540f5b0e47f3c3b45558085f4682cd7ab876ca1f268b6007","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-workflows/skills/concurrency-report/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:9211a4074ddfc2e542162717198d208440765aef0946e1f9863943ab5a33e705","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-workflows/skills/fleet-runs/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:132618c23be29b4561a6426ad1a6dabf0ec885fc9bc9638726682e5e070a421d","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-workflows/skills/delegation-audit/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:9afea216f89984f1e082843c0807995f84d09ec92fe9e83c06c99709acd20e30","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-workflows/skills/dag-map/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:6c9726b92f3d6872576aab6fab30b8011149e3b9083f7676e1a2968b21176eb1","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-workflows/skills/error-propagation/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:c5b6eb2abdf206eaacf9a8c09f335e919b7b1a47166edf001f122c8947f915b5","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-config/skills/mcp-audit/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:300a35f003d761e95d97149fed1a95767b1e76348bce9696d8926ed1fc2d459a","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-config/skills/memory-review/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:31cd9664e1fc7cde2c7d788a8f904af51363d821ac97cd1d4bb38a838e441002","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-config/skills/skill-inventory/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:ccb3f01a6ecc6867f0b14377da02ae2663549eb4e2ca78b3558c318d04e85031","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-config/skills/hook-inventory/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:e28be4fadf7f46a23d28e561c4a2cf64220b4f22cf7f863d112f21f7b874b2fb","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-config/skills/config-audit/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:6472d5d9a6bc1d09827b132a0bf55e9a5cc7986b6acf8d8522b91bf3f735c3cc","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-sessions/skills/session-timeline/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:f47f7bd890ac32c5829f07126d13c193711c99f16a8410ca30986ed3126e07e4","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-sessions/skills/session-cleanup/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:f2073b4999cec2fc3b81be0813825cce75a885ac86fdd100cf87e2aafd2e93bf","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-sessions/skills/cwd-rollup/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:76a17a0aa47c16543a3a2bff01540b0c425bc56ca6e499b2f7ef47ed03e18a21","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-sessions/skills/transcript-replay/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:316f9aa724550b1eacefd1997da2c31ceab195c96a7899a62f5e980e7a1174cf","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-sessions/skills/session-search/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:66ff4dd6f6bfffc2508f13e4a4654afdb9e77c1a351812b7ba7aabd3a50449b6","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-cost-guard/skills/budget-set/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:eb29b9ecb13ff06396988ba8f43e2026623ace9df03aad1a3d714ab33f558112","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-cost-guard/skills/spend-forecast/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:b3b473d1d3187441e626874777967b3bcf91f49cb105cfc7163a5886282e3942","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-cost-guard/skills/cost-alert/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:a6d06d00e2d8722d1da1a92e33c76c5cef406a41103583241122496a16656963","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-cost-guard/skills/daily-budget-check/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:538e5c65ad5821459b5eb8200696429efcc03d5281d39b365b5da56ebb68972c","category":"nl_quality","rule_id":"R01","file":"plugins/ccam-cost-guard/skills/daily-budget-check/SKILL.md","line":34,"severity":"low","confidence":"high","evidence":"line 34: 'If inline cost is absent for some rows, fall back to...' — 'some' used without a concrete criterion for which rows","penalty":-2,"pattern":"some","description":"Vague quantifier 'some' used without concrete criteria","false_positive":false,"suggested_fix":"Specify the condition precisely, e.g. 'for sessions where the cost field is null or missing'"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:5d99cf77ecc7631bb23d490d3e00300b71559f3da91363c24a6b1bd86cdee9bc","category":"nl_quality","rule_id":"R09","file":"plugins/ccam-cost-guard/skills/model-savings/SKILL.md","line":null,"severity":"medium","confidence":"high","evidence":"grep for literal '' returns 0 matches in file","penalty":-15,"pattern":"","description":"No blocks demonstrating context + trigger + expected behavior","false_positive":false,"suggested_fix":"Add at least 2 blocks showing a realistic invocation and expected output"} +{"event":"finding","timestamp":"2026-08-05T12:55:57Z","audit_run_id":"31006432913","repo":"hoangsonww/Claude-Code-Agent-Monitor","commit_sha":"10d6b2ef6304017c93b31bfa817e31caa7de1403","fingerprint":"sha256:1e78a18687daca55f79179c6306894e05d4c89789d13c09351de7c89e750dc71","category":"cross_component","rule_id":"CC-orphan-component","file":"plugins/ccam-dashboard/.mcp.json","line":null,"severity":"info","confidence":"high","evidence":"mcp/build/ is listed in both .gitignore and mcp/.gitignore as a TypeScript build artifact directory","penalty":null,"pattern":"","description":"plugins/ccam-dashboard/.mcp.json references ../../mcp/build/index.js which does not exist on disk in a fresh checkout, but this is expected — it is a gitignored build output generated by npm run mcp:build, not a broken reference.","false_positive":true,"fp_reason":"mcp/build/ is a standard gitignored TypeScript compilation output regenerated by npm run mcp:build; absence in a fresh git checkout is expected, not a bug.","rule_gap":"Broken-reference checks for .mcp.json server paths should first check the nearest .gitignore before flagging a missing build-output path as broken.","suggested_fix":"No change needed."} {"event":"finding","timestamp":"2026-08-07T06:30:30Z","audit_run_id":"31153883774","repo":"Vincentwei1021/video-shotcraft","commit_sha":"0022ec45d28800cecb5b16624a3179093c93f4e9","fingerprint":"sha256:fe9bcce17b04db042b1843e383c797e9f8c507d99e5377e649272db1bbf664c5","category":"security","rule_id":"SEC-unescaped-attribute-interpolation","file":"gallery/app.js","line":152,"severity":"medium","confidence":"high","evidence":"data-src=\"${style.media.url}\" is not wrapped in escapeHtml(), while the adjacent title/sourceUrl values in the same file are","penalty":null,"pattern":"unescaped-attribute-interpolation","description":"style.media.url interpolated directly into a data-src attribute with no HTML-escaping in the gif branch of mediaMarkup()","false_positive":false,"suggested_fix":"Wrap with escapeHtml(style.media.url) to match the escaping used for sourceUrl and title elsewhere in the file"} {"event":"finding","timestamp":"2026-08-07T06:30:30Z","audit_run_id":"31153883774","repo":"Vincentwei1021/video-shotcraft","commit_sha":"0022ec45d28800cecb5b16624a3179093c93f4e9","fingerprint":"sha256:feb1039c429e3ace708ddb25e1cb7d9238d2c588b33843a9785be78a245d7a57","category":"security","rule_id":"SEC-unescaped-attribute-interpolation","file":"gallery/app.js","line":158,"severity":"medium","confidence":"high","evidence":"data-src=\"${style.media.url}\" is not wrapped in escapeHtml() in the