Why this verdict
- suspicious: finding skill:skills/cli-anything-chromadb:skills/cli-anything-chromadb/SKILL.md:16:SUPPLY
Security findings 1
Supply chain
mediumContextual riskmedium confidenceThe skill instructs the agent to run an unpinned pip install of the package cli-anything-chromadb from PyPI, so the code executed at install time and at CLI runtime is not fixed to any audited version.
pip install cli-anything-chromadb
vector:instruction
Counter-argument considered
The skill body gives the agent a concrete, unpinned `pip install cli-anything-chromadb` command, so the official-registry carve-out (which requires pinning) does not apply and the code executed is not fixed to an audited version. Open documentation of the install step keeps it from being concealed, but disclosure alone does not neutralize the supply-chain fixity risk.
Coverage gaps 6
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
docs/hub/assets/demos/arcgis-pro-live-bridge-demo.mp4
context:unanalyzable_binary binary content is only byte-scanned
docs/hub/assets/demos/blender-orbital-relay-drone-preview-trajectory.mp4
context:unanalyzable_binary binary content is only byte-scanned
docs/hub/assets/demos/drawio-demo.mp4
context:unanalyzable_binary binary content is only byte-scanned
docs/hub/assets/demos/freecad-curiosity-preview-trajectory.mp4
context:unanalyzable_binary binary content is only byte-scanned
docs/hub/assets/demos/slay-the-spire-ii-gameplay.mp4
context:unanalyzable_binary pe content is only byte-scanned
slay_the_spire_ii/agent-harness/bridge/install/bridge_plugin/STS2_Bridge.dll
