snyk-agent-scan-compliance

Compliance expert for snyk-agent-scan — the agent skill file scanner — NOT for other Snyk CLI tools (snyk test, snyk code SAST, snyk iac, snyk container). Fixes alerts through content restructuring, never by suppressing or deleting information. Covers every file in a skill directory: SKILL.md, references/, assets/, and any secondary markdown. Apply when authoring a new skill, editing an existing one, triaging a failed snyk-agent-scan run locally or in CI, or unblocking a PR held by agent scanner failures. Not applicable to dependency vulnerabilities, code security findings, or infrastructure misconfigurations — those are out of scope.

Ir para a instalação

Repositório: samber/cc-skills
Última atividade na origem: 19 de agosto de 2026 às 19:14
Idioma detectado do SKILL.md: inglês
Estrelas: 203
Forks: 15

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/samber/cc-skills --skill snyk-agent-scan-compliance

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

5 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

copywriting-cta

Designs end-of-article CTAs — copy, layout, placement, A/B test plan, accessibility — for blog posts, newsletters, and essays. Use whenever the user asks to write, review, or improve a CTA at the bottom of an article; mentions "end-of-post CTA", "call-to-action", "signup box", "newsletter CTA", "subscribe block", or "what should I put at the bottom"; or asks how to turn readers into subscribers, leads, customers, or paying supporters. Covers personal blogs, paid newsletters (Substack, beehiiv, Ghost), and brand content-marketing blogs. Do NOT use for opening hooks, ledes, or post titles — use samber/cc-skills@copywriting-hooks instead. Not for landing-page, ad, or email copy.

2026-09-02

copywriting-hooks

Writes opening hooks and post titles for long-form articles in EN or FR — blog posts, Substack/Medium/dev.to, LinkedIn long-form, newsletters, essays. Trigger whenever the user asks for a hook, opening, lede, intro, first sentence/paragraph, opener, accroche, attaque, phrase d'accroche, or première phrase — including punching up a flat intro or draft opening — or for a post title, titre d'article, or headline. Do NOT trigger for social posts (LinkedIn feed, Twitter/X, TikTok, Bluesky), READMEs, taglines, email subjects, ad copy, landing-page headlines, press releases, SEO meta, or body rewrites. Do NOT use for end-of-article CTAs — use samber/cc-skills@copywriting-cta instead.

2026-09-02

copywriting-prose-creator

Codifies how a person or brand writes — lexicon, syntax, rhythm, structure, signature moves — into a PROSE.md guide, independent of emotional tone. Builds from SOUL.md and TONE.md, ports a guide to another channel, or reverse-engineers prose patterns from a corpus. Trigger on PROSE.md, writing style guide, prose guide, house style, ghostwriter style, writing playbook, banned words, sentence-length targets, or multi-writer consistency in a content factory. Do NOT use for writing actual content — use samber/cc-skills@linkedin-ghostwriting or samber/cc-skills@technical-article-writer instead. Not for tone decisions (samber/cc-skills@copywriting-tone-of-voice-creator), hooks, or CTAs.

2026-09-02

Ver todas deste repositório

snyk-agent-scan Compliance

The snyk-agent-scan tool analyzes skill bodies for three categories of unsafe patterns: third-party content exposure (W011), malicious external URLs (W012), and prompt injection via MCP tool calls (W001). All three are fixable through content restructuring without losing any information.

Reference Files

File

When to read

references/w001-patterns.md

Fixing W001 alerts — MCP tool name patterns

references/w011-patterns.md

Fixing W011 alerts — imperative URL and external content patterns

references/w012-patterns.md

Fixing W012 alerts — version pinning and frontmatter offloading

Quick Reference

Alert

Severity

Root Cause

Primary Fix

W011

High

Skill body instructs agent to fetch/interpret external content

Replace imperatives with passive availability hints

W012

High

Skill body references external URLs fetched and executed at runtime

Move to frontmatter install block; pin versions

W001

High

Skill body names MCP tool functions explicitly

Use generic formulations instead

Running the Scanner

# Scan a single skill SNYK_TOKEN=<token> snyk-agent-scan --skills skills/<name>/ # Scan all skills SNYK_TOKEN=<token> snyk-agent-scan --skills ./skills

snyk-agent-scan Compliance

Reference Files

File

When to read

references/w001-patterns.md

Fixing W001 alerts — MCP tool name patterns

references/w011-patterns.md

Fixing W011 alerts — imperative URL and external content patterns

references/w012-patterns.md

Fixing W012 alerts — version pinning and frontmatter offloading

Quick Reference

Alert

Severity

Root Cause

Primary Fix

W011

High

Skill body instructs agent to fetch/interpret external content

Replace imperatives with passive availability hints

W012

High

Skill body references external URLs fetched and executed at runtime

Move to frontmatter install block; pin versions

W001

High

Skill body names MCP tool functions explicitly

Use generic formulations instead

Running the Scanner

# Scan a single skill SNYK_TOKEN=<token> snyk-agent-scan --skills skills/<name>/ # Scan all skills SNYK_TOKEN=<token> snyk-agent-scan --skills ./skills

name	snyk-agent-scan-compliance
description	Compliance expert for snyk-agent-scan — the agent skill file scanner — NOT for other Snyk CLI tools (snyk test, snyk code SAST, snyk iac, snyk container). Fixes alerts through content restructuring, never by suppressing or deleting information. Covers every file in a skill directory: SKILL.md, references/, assets/, and any secondary markdown. Apply when authoring a new skill, editing an existing one, triaging a failed snyk-agent-scan run locally or in CI, or unblocking a PR held by agent scanner failures. Not applicable to dependency vulnerabilities, code security findings, or infrastructure misconfigurations — those are out of scope.
user-invocable	true
license	MIT
compatibility	Designed for Claude Code, Codex or similar harness.
metadata	{"author":"samber","version":"1.1.0","openclaw":{"emoji":"🔍","homepage":"https://github.com/samber/cc-skills","requires":{"bins":"[Truncated]"},"install":["[Truncated]"],"skill-library-version":"0.4.14"}}
allowed-tools	Read Edit Write Glob Grep Bash(git:) Bash(uv:) Bash(uvx:*) AskUserQuestion Agent

name	snyk-agent-scan-compliance
description	Compliance expert for snyk-agent-scan — the agent skill file scanner — NOT for other Snyk CLI tools (snyk test, snyk code SAST, snyk iac, snyk container). Fixes alerts through content restructuring, never by suppressing or deleting information. Covers every file in a skill directory: SKILL.md, references/, assets/, and any secondary markdown. Apply when authoring a new skill, editing an existing one, triaging a failed snyk-agent-scan run locally or in CI, or unblocking a PR held by agent scanner failures. Not applicable to dependency vulnerabilities, code security findings, or infrastructure misconfigurations — those are out of scope.
user-invocable	true
license	MIT
compatibility	Designed for Claude Code, Codex or similar harness.
metadata	{"author":"samber","version":"1.1.0","openclaw":{"emoji":"🔍","homepage":"https://github.com/samber/cc-skills","requires":{"bins":"[Truncated]"},"install":["[Truncated]"],"skill-library-version":"0.4.14"}}
allowed-tools	Read Edit Write Glob Grep Bash(git:) Bash(uv:) Bash(uvx:*) AskUserQuestion Agent

Condition	Likely false positive?
URL appears in a markdown table cell as reference data, not in an instruction	Yes — tables are usually safe
In a skill describing a library, URL is the library official documentation	Yes — usually safe
URL is the `homepage` or `issues` link in frontmatter	Yes — not scanned
Tool name appears inside a triple-backtick code block as a shell command	Sometimes — code blocks have lighter scrutiny
`go install` with a pinned version in a Quick Reference code block	Sometimes — pinned versions are lower risk
`always` appears in a sentence not involving external resources	Yes — "always" alone doesn't trigger W011

snyk-agent-scan-compliance

Opções de instalação

Revise os arquivos de origem