Read a report
What a scan asserts, what each grade is derived from, and the one result that looks like a pass and is not.
Two checks, one report #
There are two things you can check, and they produce the same report. Checking a repository reads its whole agent surface: the skills in it, and the project instructions, settings, hooks and MCP configuration around them. Checking a skill reads one skill and nothing else — paste the text of a SKILL.md, or upload a zip of a single skill directory.
Same axes, same rules, same grades. What differs is how much was read, which is worth knowing before you read a grade: a clean skill inside a repository whose settings grant a broad shell permission is a clean skill and a repository with a finding, and only the repository check sees the second half.
If a repository is just one skill, either check works. Pasted text is checked and then deleted, and the report names that scan "Pasted SKILL.md" — there is no URL to name it by.
The axes #
Every finding is tagged with exactly one axis, and every axis carries its own grade. There is no single overall score being hidden from you: a package can be clean on two axes and F on the third, and that is the honest shape of the result.
| Axis | What lands here |
|---|---|
| Security | Code or instructions that can act against you: injection, exfiltration, persistence, a reverse shell. |
| Permission hygiene | Reach the package grants itself: broad shell permissions, credential access, path traversal, a hardcoded secret. |
| Transparency | Behaviour the package does not declare — dependencies fetched and executed without being named. |
How a grade is reached #
Worst-finding-wins. An axis grade is set by the most severe finding on that axis, not by an average and not by a count — ten low findings do not add up to one high one.
An axis with no findings grades A. Every grade carries a one-line rationale and the rule identifiers behind it, so a grade you disagree with is a conversation about a specific rule.
The full rule list, with the false positive each rule knowingly accepts, is on the methodology page.
The raw scan JSON carries a fourth axis, quality, that this page and the report itself do not show: no rule assigns it, so a grade there would describe nothing.
"No agent files" is not a pass #
When a scan reads no file any rule applies to, the report says no agent files and shows no grade. Nothing was examined, so nothing was cleared.
This is worth a branch in your own automation: a repository that has not yet adopted any agent configuration and a repository whose configuration moved somewhere we do not read look identical from the outside, and neither is a clean result.