Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All skills
Skill

avif-format

skill:thedaviddias/front-end-checklist#avif-format

Use when reviewing image assets, markup, and CDN or build transforms related to Use AVIF format for modern browsers. Check encoded size, rendered size, loading strategy, and above-the-fold impact together.

SkillsMP
Verdict
Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 27, 2026, 21:31 UTC at e8d14d0

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

0
findings
—
highest severity
0
threat classes
1,978
files scanned
27/47
checks satisfied
0
package advisories

Why this verdict

  • inconclusive: gap invalid_judge_pass
  • inconclusive: gap ledger_missing
  • inconclusive: judge runs incomplete or invalid
  • inconclusive: ledger 27/47 checks satisfied

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the coverage gaps below; 1 candidate finding was refuted on review.
Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Supply chain

mediumRefutedlow confidence

The skill's reference documentation instructs running npx sharp-cli, which fetches and executes the unpinned sharp-cli package from the npm registry on the host; this matches the skill's declared image-conversion purpose, so it is a bounded fetch-and-execute capability rather than an established harm.

skills/avif-format/references/rule.md:70
npx sharp-cli input.jpg -o output.avif
Why it was refuted

The command is openly documented as the skill's declared core capability - JPEG-to-AVIF conversion using the standard registry tool, presented alongside equivalent ImageMagick and avifenc alternatives under 'Generating AVIF Images' - so the fetch-and-execute falls under the declared-core-capability carve-out rather than established harm, with nothing concealed and no directive to the agent beyond benign conversion examples.

Coverage gaps 25

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned
apps/web/public/projects/indie-dev-toolkit/indie-dev-toolkit.mp4
context:unanalyzable_binary binary content is only byte-scanned
docs/audits/2026-10-04-mcp-validation/assets/checklist-interaction.webm
context:unanalyzable_binary binary content is only byte-scanned
docs/audits/2026-10-04-mcp-validation/assets/mcp-tab-interaction.webm
context:manifest_unparseable yaml: YAML node count exceeds 20000
pnpm-lock.yaml
ledger_missing run 1: declared-vs-actual.0 SRC:1b7e2fc26a5906ec
ledger_missing run 1: declared-vs-actual.0 SRC:bbfaae4da0887c25
ledger_missing run 1: declared-vs-actual.0 SRC:3f9451af09c3ed3b
ledger_missing run 1: declared-vs-actual.0 SRC:7235df6d6e97f976
ledger_missing run 1: declared-vs-actual.0 SRC:27f09e943a6a78ff
ledger_missing run 1: declared-vs-actual.0 SRC:fdc08547ae1530df
ledger_missing run 1: declared-vs-actual.0 SRC:545fea54c04e1e0f
ledger_missing run 1: declared-vs-actual.0 SRC:19f37edcb7b1bfdd
ledger_missing run 1: declared-vs-actual.0 SRC:de2462a2e2173cbd
ledger_missing run 1: declared-vs-actual.0 SRC:645935ef62db8a37
ledger_missing run 1: declared-vs-actual.0 SRC:5a7c8f80ecd9656d
ledger_missing run 1: declared-vs-actual.0 SRC:9ad020425a489be4
ledger_missing run 1: declared-vs-actual.0 SRC:ed1015ac91418173
ledger_missing run 1: declared-vs-actual.0 SRC:1f02e506beb19161
ledger_missing run 1: declared-vs-actual.0 SRC:bde9dea934c82261
ledger_missing run 1: declared-vs-actual.0 SRC:bd6ce8a6a5e3bf90
ledger_missing run 1: declared-vs-actual.0 SRC:ec3d1218b8ab7263
ledger_missing run 1: declared-vs-actual.0 SRC:56f729cb1fcfc1c4
ledger_missing run 1: declared-vs-actual.0 SRC:0667d76ab9909594
ledger_missing run 1: declared-vs-actual.0 SRC:7f1775394a5d0701
invalid_judge_pass run 1: ['declared-vs-actual.0']