{"id":"cmudc57a16jg7ad07li3oqedl","slug":"unknown","publicId":"d4d083bb-3ed9-4f23-8c82-ec4b4c7f3bda","name":"unknown","description":"","version":"","author":"microsoft","license":"","compatibility":"","status":"completed","overallGrade":"B","scannerVersion":9,"fileCount":27,"hasSkillMd":true,"hasScripts":true,"hasReferences":true,"hasEvals":false,"hasAssets":false,"sourceType":"github","sourceUrl":"https://github.com/microsoft/skills/tree/main/.github/plugins/azure-skills/skills/azure-app-onboard/scaffold","createdAt":"2026-09-22T23:58:58.585Z","completedAt":"2026-09-22T23:58:58.582Z","visibility":"public","publishedAt":"2026-08-05T23:43:48.188Z","category":"","frameworks":[],"badgeStatus":"conditional","downloadCount":0,"verdictRationale":{"summary":"Skill has warnings: 1 warning in security or structure checks.","verdict":"warn","scanners":[{"source":"vettd","weight":1,"verdict":"warn"},{"source":"cisco","weight":0.8,"verdict":"pass"}],"consensus":"warn","warnTriggers":["References external URL — review for indirect prompt injection risk"],"policyVersion":"consensus-v1","hardFailTriggers":[]},"verdictPolicyVersion":"consensus-v1","skillId":"cmsdrdaev02udad069ma2d8jt","findings":[{"id":"cmudc57a26jgpad07nzabkzi5","source":"cisco","category":"security","label":"Deeply nested file references detected","detail":"SKILL.md — Skill has file references nested more than 5 levels deep. This could be an attempt to hide malicious content in files that are only loaded under specific conditions.","severity":"medium","ruleId":"LAZY_LOAD_DEEP_NESTING","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c10e4e79f20cb2b75140fe364439bc01","filepath":"SKILL.md"},{"id":"cmudc57a26jgoad07jkfr4hyf","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in references/bicep-container-apps.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"b2c400939d2c1658399fbda9fdf32667","filepath":"references/bicep-container-apps.md"},{"id":"cmudc57a26jgqad07eos91irx","source":"cisco","category":"security","label":"Vague skill description","detail":"SKILL.md — Skill description is too short (16 chars). Provide detailed explanation.","severity":"low","ruleId":"VTD-0087","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"bbe419cfb0687c04e7f13893e88c32c2","filepath":"SKILL.md"},{"id":"cmudc57a26jgnad074k1envfl","source":"vettd","category":"security","label":"No prompt injection or jailbreak signals detected","detail":"Scanned text content for instruction override, jailbreak framing, credential solicitation, and embedded injection markers","severity":"info","ruleId":"VTD-0092","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"ee5675c6452295fc92108d4c30cfebf6","filepath":""},{"id":"cmudc57a26jgdad07w38uo5c7","source":"vettd","category":"security","label":"No repository link","detail":"No repository field found in SKILL.md frontmatter. Skills without a verifiable source repository cannot be externally audited.","severity":"info","ruleId":"VTD-0083","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"e09767e7943872a2754f559ba01ef7db","filepath":""},{"id":"cmudc57a26jgmad07bo7gvdgh","source":"vettd","category":"security","label":"No secrets or unsafe code patterns detected","detail":"Scanned all files for credentials, private keys, and code-level risks (eval, shell exec, destructive ops)","severity":"info","ruleId":"VTD-0091","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2e3428ecd3c04cac33cabd959f51437a","filepath":""},{"id":"cmudc57a26jgsad07p2i6tuyc","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"592f7ac7731768f0fd0bba83f30850f9","filepath":"SKILL.md"},{"id":"cmudc57a26jgrad072xon32wt","source":"cisco","category":"security","label":"Skill name does not follow agent skills naming rules","detail":"SKILL.md — Skill name 'cisco-shim-1_tshiue' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.","severity":"info","ruleId":"VTD-0099","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"a766f184215bdf7a56dae405d860c2a6","filepath":"SKILL.md"},{"id":"cmudc57a16jgaad07b3zmx6ut","source":"vettd","category":"structure","label":"references/ directory present","detail":"Additional documentation files available for progressive disclosure","severity":"info","ruleId":"VTD-0097","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"a5f22b7185c58877c3d5a94338930d62","filepath":""},{"id":"cmudc57a16jg9ad07d03nqq7w","source":"vettd","category":"structure","label":"scripts/ directory present","detail":"Bundled executable scripts found","severity":"info","ruleId":"VTD-0096","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"21a167b473d29b0a653734953d43b2fc","filepath":""},{"id":"cmudc57a16jg8ad07hyzp32nv","source":"vettd","category":"structure","label":"SKILL.md present","detail":"Required skill definition file found","severity":"info","ruleId":"VTD-0095","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c4ab14319b89c3d0802fadf0dd105bac","filepath":""},{"id":"cmudc57a16jgcad07r37972b2","source":"vettd","category":"structure","label":"Valid name field","detail":"Name \"unknown\" follows spec (lowercase, hyphens, ≤64 chars)","severity":"info","ruleId":"VTD-0099","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"5ba54eca0b3e299a99112de98cbcd97f","filepath":""},{"id":"cmudc57a26jgead07th2dnazk","source":"vettd","category":"description","label":"Missing description field","detail":"The description field is required and should describe what the skill does and when to use it","severity":"info","ruleId":"VTD-0109","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c16cc61f3e0856ca472c191e6c32cd88","filepath":""},{"id":"cmudc57a26jggad07ititvako","source":"vettd","category":"best-practices","label":"Examples included","detail":"Found code blocks, input/output samples, or an examples section — concrete samples help agents pattern-match effectively","severity":"info","ruleId":"VTD-0103","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c2ceb48c4af3c87dafa32ec2596251b8","filepath":""},{"id":"cmudc57a26jgjad07tmvu8of7","source":"vettd","category":"best-practices","label":"Progressive disclosure used","detail":"SKILL.md body references files in references/, scripts/, or assets/ — agents can load additional context on demand instead of consuming everything upfront","severity":"info","ruleId":"VTD-0107","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"6fd5870d64ef20cb2bbaf421f8655a32","filepath":""},{"id":"cmudc57a26jgfad07eqpnsx2k","source":"vettd","category":"best-practices","label":"SKILL.md body length is reasonable","detail":"191 lines (recommended: under 500)","severity":"info","ruleId":"VTD-0101","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42debaa072535bf5650f90d3168f0b93","filepath":""},{"id":"cmudc57a26jghad077as3h7wx","source":"vettd","category":"best-practices","label":"Step-by-step workflow found","detail":"Structured procedures improve reliability for complex tasks","severity":"info","ruleId":"VTD-0106","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2368c9a31ac52269c854f105795cf28c","filepath":""},{"id":"cmudc57a26jgiad07w4k18dvs","source":"vettd","category":"best-practices","label":"Validation loop referenced","detail":"Instructions for the agent to validate its own work before proceeding","severity":"info","ruleId":"VTD-0105","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e5a31b775d1df438cbeb1e3fcb2ff503","filepath":""},{"id":"cmudc57a26jgkad07d1c4ykl3","source":"vettd","category":"scripts","label":"No --help support","detail":"scripts/scaffold-conformance.ps1: Add argument parsing with --help output so agents know the script's interface","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"a6447f4174f3ad10491f864fec464a5e","filepath":"scripts/scaffold-conformance.ps1"},{"id":"cmudc57a26jglad076e7vrh4z","source":"vettd","category":"scripts","label":"No --help support","detail":"scripts/scaffold-conformance.sh: Add argument parsing with --help output so agents know the script's interface","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"ec7f796de2093ba63d7cfef28f3259e7","filepath":"scripts/scaffold-conformance.sh"},{"id":"cmudc57a16jgbad07nyoebl1e","source":"vettd","category":"evals","label":"No evaluation test cases","detail":"Add an evals/ directory with test prompts and expected outputs to measure skill quality","severity":"info","ruleId":"VTD-0118","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"41d019e0494a4a9763fc23c948d14e09","filepath":""}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"B","findingCount":4,"criticalCount":0,"highCount":0},{"source":"vettd","status":"success","verdict":null,"grade":"B","findingCount":17,"criticalCount":0,"highCount":0}],"user":{"name":"Justin Pacella","image":"https://avatars.githubusercontent.com/u/97124458?v=4"},"repository":{"owner":"microsoft","name":"skills"},"freshness":null,"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":null,"rows":[]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":null,"rows":[]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":27,"publisherSupplied":["name","description","author","version","license"]}