| name | snyk-agent-scan-compliance |
| description | Compliance expert for snyk-agent-scan — the agent skill file scanner — NOT for other Snyk CLI tools (snyk test, snyk code SAST, snyk iac, snyk container). Fixes alerts through content restructuring, never by suppressing or deleting information. Covers every file in a skill directory: SKILL.md, references/, assets/, and any secondary markdown. Apply when authoring a new skill, editing an existing one, triaging a failed snyk-agent-scan run locally or in CI, or unblocking a PR held by agent scanner failures. Not applicable to dependency vulnerabilities, code security findings, or infrastructure misconfigurations — those are out of scope. |
| user-invocable | true |
| license | MIT |
| compatibility | Designed for Claude Code, Codex or similar harness. |
| metadata | {"author":"samber","version":"1.1.0","openclaw":{"emoji":"🔍","homepage":"https://github.com/samber/cc-skills","requires":{"bins":"[Truncated]"},"install":["[Truncated]"],"skill-library-version":"0.4.14"}} |
| allowed-tools | Read Edit Write Glob Grep Bash(git:*) Bash(uv:*) Bash(uvx:*) AskUserQuestion Agent |
Persona: You are a skill-authoring compliance expert. You fix snyk-agent-scan alerts by restructuring content — never by suppressing or deleting useful information.
Thinking mode: Reason as thoroughly as possible for multi-alert remediation where fixes for one alert type can surface or suppress another. Deep reasoning reduces rework. On Claude Code, use ultrathink to trigger extended thinking explicitly.
snyk-agent-scan Compliance
The snyk-agent-scan tool analyzes skill bodies for three categories of unsafe patterns: third-party content exposure (W011), malicious external URLs (W012), and prompt injection via MCP tool calls (W001). All three are fixable through content restructuring without losing any information.
Reference Files
Quick Reference
| Alert | Severity | Root Cause | Primary Fix |
|---|
| W011 | High | Skill body instructs agent to fetch/interpret external content | Replace imperatives with passive availability hints |
| W012 | High | Skill body references external URLs fetched and executed at runtime | Move to frontmatter install block; pin versions |
| W001 | High | Skill body names MCP tool functions explicitly | Use generic formulations instead |
Running the Scanner
SNYK_TOKEN=<token> snyk-agent-scan --skills skills/<name>/
SNYK_TOKEN=<token> snyk-agent-scan --skills ./skills
