·
Last changedVersion:
This version did not pass the hardening gate. Hardening applied 28 targeted changes, deleted the lines high-severity poisoning findings flagged in 1 file before any model saw the skill, and preserved all other text. Classified findings before hardening: 20. Classified findings closed: 3. Classified findings remaining: 18 (1 introduced by hardening). Unclassified scanner findings remaining: 1. Review findings closed: 29. Review findings remaining: 6.
5
13
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
scripts/alert-notify/requirements.txt | Supply Chain & Install-Time Trust | Dependency or plugin compromise | High | Open | |
SKILL.md | Obfuscation & Evasion | Trigger-based activation | High | Closed | |
references/alert-notify.md | Supply Chain & Install-Time Trust | Dependency or plugin compromise | High | Closed | |
evals/subscriptions_lifecycle.json | Tool & MCP Manipulation | Unauthorized tool use | High | Open | |
evals/evals.json | Sensitive Data & Secret Exposure | Data exfiltration | High | Closed | |
evals/subscriptions_lifecycle.json | Excessive Agency & Rogue Autonomy | — | Medium | Open | |
references/alert-notify.md | Excessive Agency & Rogue Autonomy | — | Medium | Open | |
SKILL.md | Sensitive Data & Secret Exposure | Hardcoded secret | Medium | Open |
21 findings
No skill file found.
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/nvidia/skills/vss-manage-alerts:latest
Apache-2.0
HARDENING.md