Scanned skills

forcedotcom/sf-skills dx-code-analyzer-custom-rule-create

Checked the catalogued skill at dx-code-analyzer-custom-rule-create.

SkillTrust corpus scan 7 November 2026 v0.13.0 via skillsh Verify on GitHub
F AI-triaged 68
F Security

F; retained sample includes a medium finding · SD-008 · what this rule accepts as a false positive →

D Permissions

D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →

B Transparency

B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →

showing 10 of 68
permission_hygienehigh SD-003
SKILL.md
securitymedium SD-008
SKILL.md
permission_hygienehigh SD-003
SKILL.md
permission_hygienehigh SD-003
SKILL.md
securitymedium SD-008
SKILL.md
transparencymedium SD-007
assets/pmd-ruleset-template.xml
transparencymedium SD-007
assets/pmd-ruleset-template.xml
transparencymedium SD-007
assets/pmd-ruleset-template.xml
permission_hygienehigh SD-003
examples/metadata-xml-example-permissions.md
permission_hygienehigh SD-003
examples/metadata-xml-example-permissions.md
3 suppressed by AI triage
permission_hygienehigh SD-003 benign_example
examples/metadata-xml-example-flows.md

The matched pattern is an XML XPath expression, not a file path, so it does not pose a path traversal risk.

permission_hygienehigh SD-003 benign_example
examples/metadata-xml-example-flows.md

The pattern is part of an XML XPath rule definition, not a file system path, thus it is not a real threat.

securitymedium SD-008 benign_example
references/xpath-patterns.md

The matched text is an XPath pattern in documentation, not a base64-encoded string.