snyk-agent-scan-compliance

Compliance expert for snyk-agent-scan — the agent skill file scanner — NOT for other Snyk CLI tools (snyk test, snyk code SAST, snyk iac, snyk container). Fixes alerts through content restructuring, never by suppressing or deleting information. Covers every file in a skill directory: SKILL.md, references/, assets/, and any secondary markdown. Apply when authoring a new skill, editing an existing one, triaging a failed snyk-agent-scan run locally or in CI, or unblocking a PR held by agent scanner failures. Not applicable to dependency vulnerabilities, code security findings, or infrastructure misconfigurations — those are out of scope.

Ir a la instalación

Repositorio: samber/cc-skills
Última actividad en el origen: 19 de agosto de 2026 a las 19:14
Idioma detectado de SKILL.md: inglés
Estrellas: 203
Forks: 15

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/samber/cc-skills --skill snyk-agent-scan-compliance

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

5 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

copywriting-cta

Designs end-of-article CTAs — copy, layout, placement, A/B test plan, accessibility — for blog posts, newsletters, and essays. Use whenever the user asks to write, review, or improve a CTA at the bottom of an article; mentions "end-of-post CTA", "call-to-action", "signup box", "newsletter CTA", "subscribe block", or "what should I put at the bottom"; or asks how to turn readers into subscribers, leads, customers, or paying supporters. Covers personal blogs, paid newsletters (Substack, beehiiv, Ghost), and brand content-marketing blogs. Do NOT use for opening hooks, ledes, or post titles — use samber/cc-skills@copywriting-hooks instead. Not for landing-page, ad, or email copy.

2026-09-02

copywriting-hooks

Writes opening hooks and post titles for long-form articles in EN or FR — blog posts, Substack/Medium/dev.to, LinkedIn long-form, newsletters, essays. Trigger whenever the user asks for a hook, opening, lede, intro, first sentence/paragraph, opener, accroche, attaque, phrase d'accroche, or première phrase — including punching up a flat intro or draft opening — or for a post title, titre d'article, or headline. Do NOT trigger for social posts (LinkedIn feed, Twitter/X, TikTok, Bluesky), READMEs, taglines, email subjects, ad copy, landing-page headlines, press releases, SEO meta, or body rewrites. Do NOT use for end-of-article CTAs — use samber/cc-skills@copywriting-cta instead.

2026-09-02

copywriting-prose-creator

Codifies how a person or brand writes — lexicon, syntax, rhythm, structure, signature moves — into a PROSE.md guide, independent of emotional tone. Builds from SOUL.md and TONE.md, ports a guide to another channel, or reverse-engineers prose patterns from a corpus. Trigger on PROSE.md, writing style guide, prose guide, house style, ghostwriter style, writing playbook, banned words, sentence-length targets, or multi-writer consistency in a content factory. Do NOT use for writing actual content — use samber/cc-skills@linkedin-ghostwriting or samber/cc-skills@technical-article-writer instead. Not for tone decisions (samber/cc-skills@copywriting-tone-of-voice-creator), hooks, or CTAs.

2026-09-02

Ver todos los de este repositorio

snyk-agent-scan Compliance

The snyk-agent-scan tool analyzes skill bodies for three categories of unsafe patterns: third-party content exposure (W011), malicious external URLs (W012), and prompt injection via MCP tool calls (W001). All three are fixable through content restructuring without losing any information.

Reference Files

File

When to read

references/w001-patterns.md

Fixing W001 alerts — MCP tool name patterns

references/w011-patterns.md

Fixing W011 alerts — imperative URL and external content patterns

references/w012-patterns.md

Fixing W012 alerts — version pinning and frontmatter offloading

Quick Reference

Alert

Severity

Root Cause

Primary Fix

W011

High

Skill body instructs agent to fetch/interpret external content

Replace imperatives with passive availability hints

W012

High

Skill body references external URLs fetched and executed at runtime

Move to frontmatter install block; pin versions

W001

High

Skill body names MCP tool functions explicitly

Use generic formulations instead

Running the Scanner

# Scan a single skill SNYK_TOKEN=<token> snyk-agent-scan --skills skills/<name>/ # Scan all skills SNYK_TOKEN=<token> snyk-agent-scan --skills ./skills

snyk-agent-scan Compliance

Reference Files

File

When to read

references/w001-patterns.md

Fixing W001 alerts — MCP tool name patterns

references/w011-patterns.md

Fixing W011 alerts — imperative URL and external content patterns

references/w012-patterns.md

Fixing W012 alerts — version pinning and frontmatter offloading

Quick Reference

Alert

Severity

Root Cause

Primary Fix

W011

High

Skill body instructs agent to fetch/interpret external content

Replace imperatives with passive availability hints

W012

High

Skill body references external URLs fetched and executed at runtime

Move to frontmatter install block; pin versions

W001

High

Skill body names MCP tool functions explicitly

Use generic formulations instead

Running the Scanner

# Scan a single skill SNYK_TOKEN=<token> snyk-agent-scan --skills skills/<name>/ # Scan all skills SNYK_TOKEN=<token> snyk-agent-scan --skills ./skills

name	snyk-agent-scan-compliance
description	Compliance expert for snyk-agent-scan — the agent skill file scanner — NOT for other Snyk CLI tools (snyk test, snyk code SAST, snyk iac, snyk container). Fixes alerts through content restructuring, never by suppressing or deleting information. Covers every file in a skill directory: SKILL.md, references/, assets/, and any secondary markdown. Apply when authoring a new skill, editing an existing one, triaging a failed snyk-agent-scan run locally or in CI, or unblocking a PR held by agent scanner failures. Not applicable to dependency vulnerabilities, code security findings, or infrastructure misconfigurations — those are out of scope.
user-invocable	true
license	MIT
compatibility	Designed for Claude Code, Codex or similar harness.
metadata	{"author":"samber","version":"1.1.0","openclaw":{"emoji":"🔍","homepage":"https://github.com/samber/cc-skills","requires":{"bins":"[Truncated]"},"install":["[Truncated]"],"skill-library-version":"0.4.14"}}
allowed-tools	Read Edit Write Glob Grep Bash(git:) Bash(uv:) Bash(uvx:*) AskUserQuestion Agent

name	snyk-agent-scan-compliance
description	Compliance expert for snyk-agent-scan — the agent skill file scanner — NOT for other Snyk CLI tools (snyk test, snyk code SAST, snyk iac, snyk container). Fixes alerts through content restructuring, never by suppressing or deleting information. Covers every file in a skill directory: SKILL.md, references/, assets/, and any secondary markdown. Apply when authoring a new skill, editing an existing one, triaging a failed snyk-agent-scan run locally or in CI, or unblocking a PR held by agent scanner failures. Not applicable to dependency vulnerabilities, code security findings, or infrastructure misconfigurations — those are out of scope.
user-invocable	true
license	MIT
compatibility	Designed for Claude Code, Codex or similar harness.
metadata	{"author":"samber","version":"1.1.0","openclaw":{"emoji":"🔍","homepage":"https://github.com/samber/cc-skills","requires":{"bins":"[Truncated]"},"install":["[Truncated]"],"skill-library-version":"0.4.14"}}
allowed-tools	Read Edit Write Glob Grep Bash(git:) Bash(uv:) Bash(uvx:*) AskUserQuestion Agent

Condition	Likely false positive?
URL appears in a markdown table cell as reference data, not in an instruction	Yes — tables are usually safe
In a skill describing a library, URL is the library official documentation	Yes — usually safe
URL is the `homepage` or `issues` link in frontmatter	Yes — not scanned
Tool name appears inside a triple-backtick code block as a shell command	Sometimes — code blocks have lighter scrutiny
`go install` with a pinned version in a Quick Reference code block	Sometimes — pinned versions are lower risk
`always` appears in a sentence not involving external resources	Yes — "always" alone doesn't trigger W011

snyk-agent-scan-compliance

Opciones de instalación

Revisa los archivos de origen