Scan evidence

blader/humanizer

Admission blocked. A reviewer-selected Python smoke-test entrypoint is required. Other runtimes are not yet supported.

This is the complete, redacted record for one scan. It describes an exact commit and archive, not the repository in general, and it expires: admission requires evidence no older than seven days. Everything below is what ran, what version of it ran, and what it did not cover.

What was scanned

Commit: 9862685f575c65a8247f90369951df1b3416e3d6
Archive SHA-256: 4f4abbd690ba326fac501c991bd10e946283d4b3c8cdeccc0964aa244f9890ad
Scanner image: sha256:ba557d6d0e9cbc57dd2b87b4b0b66f6d304439ef6bfc3ba3a31b4b4a2b134b62
Toolchain image: sha256:dd30c3b1a1744912e512bc543b12ad804c9fe6ebb45ad2aabb022c2258d182ed
Policy version: 2026-09-11.3
Run: Sep 11, 2026 · finished 23:27:32 UTC

Checks

Source rules (prompt injection, secrets, dangerous code)

complete

9 files · ruleset 2026-09-11.3 · coverage complete. Heuristic source rules only; not comprehensive malware detection.

prompt injection: complete
secrets: complete
dangerous code: complete

Exposed secrets (Gitleaks)

complete

Version v8.30.1. Findings are redacted; repository allow-comments cannot suppress a check.

Suspicious code (Semgrep)

complete

Rules githunt-reviewed-v1 · 1 files. Python/JavaScript/TypeScript: dynamic evaluation, shell execution and unsafe YAML.

Skill instructions (Cisco Skill Scanner)

complete

1 skill files. Static skill analysis only; no cloud analyzers.

Malware (ClamAV)

clean

Engine ClamAV 1.4.3/28120/Fri Sep 11 06:27:14 2026. Signatures dated Sep 11, 2026 — admission requires signatures no older than 24 hours.

Known dependency vulnerabilities (OSV)

complete

0 pinned dependencies resolved via OSV. Nothing resolvable was found, so this check proves nothing about this repository’s dependencies.

Runtime behaviour (isolated smoke test)

not run

Not run. Runtime checks currently support only a reviewer-selected Python standard-library entrypoint; no other runtime recipe is implemented, so runtime behaviour is uncovered for this repository.

Findings (2)

Tool	Rule	Path	Severity
Cisco Skill Scanner	HIDDEN_DATA_FILE	.claude-plugin/marketplace.json	medium
Cisco Skill Scanner	HIDDEN_DATA_FILE	.claude-plugin/plugin.json	medium

What this does not tell you

A completed check is not proof of safety. These tools can miss attacks and flag benign code. This record covers one commit at one moment; it says nothing about later commits, the project's maintainers, or its transitive dependencies beyond those listed above.