chore(deps): update trailofbits/skills digest to 7b9bd5f

[renovate]

This PR contains the following updates:

Package	Update	Change
trailofbits/skills	digest	696dee5 → 7b9bd5f

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🛡️ Skill Security Scan Results

✅ agentic-actions-auditor

• Status: Passed
• Findings: 6
• Allowed (not blocking): 3
  • LLM_PROMPT_INJECTION (Allowed: FP: security audit skill whose reference files contain detailed attack patterns by design. The skill teaches agents to FIND these patterns in user workflows, not to execute them.)
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)
  • LLM_PROMPT_INJECTION (Allowed: FP: security audit skill whose reference files contain detailed attack patterns by design. The skill teaches agents to FIND these patterns in user workflows, not to execute them.)

✅ codeql

• Status: Passed
• Findings: 8
• Allowed (not blocking): 6
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)
  • LLM_COMMAND_INJECTION (Allowed: Risk accepted by maintainer (danbarr, 2026-08-25): workflows/build-database.md and references/macos-arm64e-workaround.md construct and execute the target codebase's own build commands (make/cmake/gradle/etc., including a make --dry-run compile-command extraction for the macOS arm64e workaround) in order to trace compilation for CodeQL database creation. Building the analyzed codebase — including running whatever build system it uses — is CodeQL's documented, required mechanism for compiled-language analysis; there is no way to trace compilation without executing the project's own build scripts. Same class of inherent domain risk as running any CI/build pipeline against the target codebase, not a new injection primitive introduced by the skill.)
  • LLM_PROMPT_INJECTION (Allowed: FP: same as policy_violation above — all pattern matches are on documentation, code examples, or attack pattern descriptions for detection purposes, not agent instructions.)
  • LLM_COMMAND_INJECTION (Allowed: Risk accepted by maintainer (danbarr, 2026-08-25): workflows/build-database.md and references/macos-arm64e-workaround.md construct and execute the target codebase's own build commands (make/cmake/gradle/etc., including a make --dry-run compile-command extraction for the macOS arm64e workaround) in order to trace compilation for CodeQL database creation. Building the analyzed codebase — including running whatever build system it uses — is CodeQL's documented, required mechanism for compiled-language analysis; there is no way to trace compilation without executing the project's own build scripts. Same class of inherent domain risk as running any CI/build pipeline against the target codebase, not a new injection primitive introduced by the skill.)
  • LLM_COMMAND_INJECTION (Allowed: Risk accepted by maintainer (danbarr, 2026-08-25): workflows/build-database.md and references/macos-arm64e-workaround.md construct and execute the target codebase's own build commands (make/cmake/gradle/etc., including a make --dry-run compile-command extraction for the macOS arm64e workaround) in order to trace compilation for CodeQL database creation. Building the analyzed codebase — including running whatever build system it uses — is CodeQL's documented, required mechanism for compiled-language analysis; there is no way to trace compilation without executing the project's own build scripts. Same class of inherent domain risk as running any CI/build pipeline against the target codebase, not a new injection primitive introduced by the skill.)
  • LLM_PROMPT_INJECTION (Allowed: FP: same as policy_violation above — all pattern matches are on documentation, code examples, or attack pattern descriptions for detection purposes, not agent instructions.)

✅ constant-time-analysis

• Status: Passed
• Findings: 5
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)

✅ differential-review

• Status: Passed
• Findings: 6
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)

✅ fp-check

• Status: Passed
• Findings: 4
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)

✅ property-based-testing

• Status: Passed
• Findings: 2
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)

✅ sarif-parsing

• Status: Passed
• Findings: 7
• Allowed (not blocking): 2
  • ALLOWED_TOOLS_WRITE_VIOLATION (Allowed: SKILL.md declares Bash in allowed-tools, which transitively permits filesystem writes (e.g. via redirection); the scanner flags bundled scripts as writing without recognizing Bash as the intended mechanism.)
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)

✅ semgrep

• Status: Passed
• Findings: 7
• Allowed (not blocking): 4
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)
  • LLM_COMMAND_INJECTION (Allowed: FP: [TARGET] and [OUTPUT_DIR] in references/scanner-task-prompt.md's bash templates are the codebase path being scanned and the skill's own resolved output directory (Step 1 of SKILL.md) — values the user/agent already controls locally, not attacker-supplied external input. The agent already has full Bash execution on the user's behalf; substituting the same user-provided path into a semgrep command doesn't cross a new trust boundary. Same reasoning already accepted for skills/huggingface-tool-builder and skills/huggingface-paper-publisher.)
  • LLM_PROMPT_INJECTION (Allowed: Risk accepted by maintainer (danbarr, 2026-08-25): the skill clones curated third-party Semgrep ruleset repos (Trail of Bits, 0xdea, Decurity) by GitHub URL to supplement official registry coverage. The rulesets are fixed, skill-selected repos (not arbitrary user-supplied URLs), the content is declarative Semgrep YAML rules rather than executable code, and the user explicitly approves the exact ruleset list at the Step 3 hard gate before any clone happens. Same class of accepted third-party-content exposure as skills/hf-mcp and skills/huggingface-tool-builder.)
  • LLM_COMMAND_INJECTION (Allowed: FP: [TARGET] and [OUTPUT_DIR] in references/scanner-task-prompt.md's bash templates are the codebase path being scanned and the skill's own resolved output directory (Step 1 of SKILL.md) — values the user/agent already controls locally, not attacker-supplied external input. The agent already has full Bash execution on the user's behalf; substituting the same user-provided path into a semgrep command doesn't cross a new trust boundary. Same reasoning already accepted for skills/huggingface-tool-builder and skills/huggingface-paper-publisher.)

✅ semgrep-rule-creator

• Status: Passed
• Findings: 4
• Allowed (not blocking): 2
  • LLM_PROMPT_INJECTION (Allowed: FP: same as policy_violation above — all pattern matches are on documentation, code examples, or attack pattern descriptions for detection purposes, not agent instructions.)
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)

✅ semgrep-rule-variant-creator

• Status: Passed
• Findings: 5
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)

✅ sharp-edges

• Status: Passed
• Findings: 5
• Allowed (not blocking): 2
  • LLM_PROMPT_INJECTION (Allowed: FP: same as policy_violation above — all pattern matches are on documentation, code examples, or attack pattern descriptions for detection purposes, not agent instructions.)
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)

✅ supply-chain-risk-auditor

• Status: Passed
• Findings: 3
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)

✅ variant-analysis

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)

✅ yara-rule-authoring

• Status: Passed
• Findings: 81
• Allowed (not blocking): 77
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00063 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00063 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00063 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00063 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00063 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00099 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00096 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00161 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00063 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00063 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00063 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00063 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00099 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00096 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00099 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00099 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00063 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00064 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00091 (Allowed: FP: same as policy_violation above — all pattern matches are on documentation, code examples, or attack pattern descriptions for detection purposes, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00064 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00099 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00202 (Allowed: FP: same as policy_violation above — all pattern matches are on documentation, code examples, or attack pattern descriptions for detection purposes, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)
  • ATR_2026_00061 (Allowed: FP: yara-rule-authoring is a security analysis skill whose reference files intentionally describe YARA detection patterns, testing commands, and deployment procedures. All ATR pattern matches are documentation of detection rule authoring, not agent instructions.)

✅ zeroize-audit

• Status: Passed
• Findings: 8

---

Summary: Scanned 15 skill(s), all passed security checks. ✅

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[danbarr]

This PR bundles 3 unrelated skills; handling them separately rather than merging as one unit.

Fixed — pushed a follow-up commit allowlisting the `skill-security-scan` finding on `skills/supply-chain-risk-auditor/spec.yaml`. The blocking finding (`ATR_2026_00051`, "For each") matches ordinary dependency-audit workflow prose (SKILL.md:47, 52) — the same class of false positive already allowlisted under this rule ID in ~10 other skills in this repo.

Needs a maintainer decision, not touched here:

• `skills/insecure-defaults/spec.yaml` — genuine breakage, not a scanner issue. Upstream restructured this trailofbits plugin at the new digest and it no longer has a `skills/` subdirectory at all (no SKILL.md anywhere under `plugins/insecure-defaults/`). The vendored path in spec.yaml doesn't exist upstream anymore. Recommend holding this file back at its old ref (`696dee5717bdb976772466c067b60d89d644260d`) until trailofbits ships a working skill-shaped path, or splitting it out of the digest bump entirely.
• `skills/semgrep/spec.yaml` — the `LLM_PROMPT_INJECTION` finding here describes real, unchanged behavior (the skill clones third-party GitHub-URL rulesets), not a keyword false positive. It's a legitimate design tradeoff (declarative Semgrep YAML rules, not arbitrary code; user picks the ruleset by name beforehand) but should get an honest "accepted risk" allowlist reason if you're comfortable with it, not a false-positive one. Leaving this for a maintainer call.

[danbarr]

Status update — several rounds of scanner findings addressed since the last comment:

Removed:

• skills/insecure-defaults/spec.yaml — trailofbits restructured this plugin at the new digest; it no longer has a skills/ subdirectory anywhere under plugins/insecure-defaults/, so there's nothing left to package.

Allowlisted:

• semgrep: LLM_PROMPT_INJECTION (accepted risk — clones curated third-party rulesets, same class as hf-mcp/huggingface-tool-builder) and LLM_COMMAND_INJECTION (FP — [TARGET]/[OUTPUT_DIR] are locally-resolved values, not attacker input).
• zeroize-audit: BEHAVIOR_EVAL_SUBPROCESS — carried forward from fix(skills): update trailofbits/skills to cfe5d7b, fix zeroize-audit #740 (now closed as superseded), revalidated against this ref.
• codeql: two LLM_COMMAND_INJECTION findings in build-database.md — one is an accepted, inherent risk (tracing compilation requires running the target codebase's own build system, including a make --dry-run compile-command extraction for the macOS arm64e workaround), the other is the same locally-resolved-variable FP as semgrep's.

Still open, needs a maintainer call:

• No outstanding item currently — all previously-flagged blocking findings across the 16 skills in this digest bump have been allowlisted or resolved as of the latest push.

Note: this PR's scan results have shown real run-to-run nondeterminism (new/different findings surfacing on skills that previously passed clean) — worth keeping an eye on before merge in case another rescan surfaces something new.