← All scanned servers

⚠️ This snapshot is over 30 days old — treat the grade as stale until the next refresh. Re-scan locally to verify.

Trust Card · Static snapshot

examples/secure-agent-skill U

Ungraded — insufficient static coverage · 0 findings (0 critical) · scope minimal · Not ranked: insufficient static coverage.

Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream eulogik/OpenTrustBench @ 00d5021 (2026-10-19)

Score breakdown

No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.

Insufficient static coverage: No non-empty supported source analyzed; documentation and data alone provide limited coverage. Findings remain actionable; absence of findings is not evidence of safety.

Coverage: limited

Static-heuristic scope: 0 analyzed / 1 discovered files; 0 unsupported source files; 1 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.

• No non-empty supported source analyzed; documentation and data alone provide limited coverage
• Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.
• Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.
• Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.
• Ignored directories, declarations, and non-implementation assets are outside rule scope.

{
  "mode": "static-heuristic",
  "status": "limited",
  "reasons": [
    "No non-empty supported source analyzed; documentation and data alone provide limited coverage"
  ],
  "limitations": [
    "Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
    "Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
    "Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
    "Ignored directories, declarations, and non-implementation assets are outside rule scope."
  ],
  "discoveredFiles": 1,
  "analyzedFiles": [],
  "unsupportedSourceFiles": [],
  "excludedFiles": [
    {
      "path": "SKILL.md",
      "reason": "skill-instructions-not-code-analyzed"
    }
  ],
  "readErrors": [],
  "truncation": [],
  "limits": {
    "maxFiles": 4000,
    "maxDepth": 12,
    "maxFileBytes": 1048576
  }
}

Fix first (0 critical/high)

No findings in scope of the 8-rule static suite.

Permissions

Scope: minimal · Shell: disabled · Network egress: no · File deletion: none · Human approval: none

Provenance

License: none detected · Lockfile: no · Security policy: no · Signals: unverified origin