{
  "schemaVersion": 1,
  "skillId": "sentry-skill-scanner",
  "revision": "f57ada2d0b640406ea7e25b11d636c530e77c58b",
  "runAt": "2026-10-19",
  "mode": "source-review",
  "summary": "Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.",
  "sourceManifest": [
    {
      "path": "skills/skill-scanner/SKILL.md",
      "sha256": "b0fdcbb9cd0d11e0425815fa37bb5483b13e6dce5fe5f3aeb4529dc8f80708bd",
      "sourceUrl": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/skills/skill-scanner/SKILL.md"
    },
    {
      "path": "LICENSE",
      "sha256": "96e78a9ce85795b117c8929887bdb78f88bf23f7b85a31f0872cde4dff7e92cd",
      "sourceUrl": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/LICENSE"
    }
  ],
  "cases": [
    {
      "id": "allowed-tools",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/skills/skill-scanner/SKILL.md",
      "expected": "allowed-tools: Read Grep Glob Bash",
      "observed": "The skill requests Bash alongside read tools.",
      "passed": true
    },
    {
      "id": "bundled-script",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/skills/skill-scanner/SKILL.md",
      "expected": "uv run scripts/scan_skill.py <skill-directory>",
      "observed": "Scanning runs a bundled Python script.",
      "passed": true
    },
    {
      "id": "false-positives",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/skills/skill-scanner/SKILL.md",
      "expected": "**False positive awareness is critical.**",
      "observed": "It warns about false positives on security content.",
      "passed": true
    },
    {
      "id": "license",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/LICENSE",
      "expected": "Apache License",
      "observed": "The repository license is Apache-2.0.",
      "passed": true
    }
  ],
  "results": {
    "passed": 4,
    "failed": 0,
    "total": 4
  },
  "findings": [
    {
      "severity": "attention",
      "title": "The scanner runs code on your machine",
      "detail": "Scanning uses a bundled script and requests Bash. Review the script or run it in a sandbox before scanning untrusted material."
    },
    {
      "severity": "attention",
      "title": "No findings is not proof of safety",
      "detail": "Static patterns and model review can both miss malicious behavior. Keep reading scripts and limiting tool access."
    },
    {
      "severity": "info",
      "title": "False positives addressed",
      "detail": "The skill tells the agent to judge intent, since security skills may document attack patterns."
    }
  ],
  "limitations": [
    "Source review of SKILL.md and the repository license only. The scanner script and its reference pattern files were not reviewed or run.",
    "No skill was scanned. No detection-rate result is claimed."
  ],
  "methodology": "Each source check records the exact source condition and the scoped observation it supports. Counts measure reviewed conditions, not completed user tasks, security assurance or model effectiveness."
}