Scanned skills

everyinc/compound-engineering-plugin ce-polish

Checked the catalogued skill at ce-polish.

SkillTrust corpus scan 8 November 2026 v0.13.0 via skillsh Verify on GitHub
F AI-triaged 23
F Security

F; retained sample includes a critical finding · SD-001 · what this rule accepts as a false positive →

D Permissions

D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →

A Transparency

A set by no findings on this axis

showing 10 of 23
securityhigh SD-007
references/live-loop.md
securityhigh SD-007
references/live-loop.md
securityhigh SD-022
references/live-remote.md
permission_hygienehigh SD-003
references/live-start.md
securityhigh SD-022
references/live-start.md
securityhigh SD-022
references/live-stream-contract.md
securitycritical SD-001
scripts/detect-project-type.sh
securitycritical SD-001
scripts/detect-project-type.sh
securityhigh SD-007
scripts/detect-riffrec.sh
securityhigh SD-007
scripts/live-endpoint.js
1 suppressed by AI triage
securityhigh SD-022 benign_example
references/install-riffrec.md

The content references standard npm install syntax for a dependency, not malicious DNS tunneling.