Scanned skills

modelstudioai/skills bailian-model-recommend

Checked the catalogued skill at bailian-model-recommend.

SkillTrust corpus scan 8 November 2026 v0.13.0 via skillsh Verify on GitHub
F AI-triaged 28
F Security

F; retained sample includes a critical finding · SD-013 · what this rule accepts as a false positive →

D Permissions

D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →

A Transparency

A set by no findings on this axis

showing 10 of 28
permission_hygienehigh SD-003
references/requirement-schema.md
permission_hygienehigh SD-003
references/requirement-schema.md
permission_hygienehigh SD-003
references/requirement-schema.md
permission_hygienehigh SD-003
references/requirement-schema.md
securitycritical SD-013
scripts/lib/catalog.mjs
securityhigh SD-007
scripts/lib/catalog.mjs
securityhigh SD-007
scripts/lib/catalog.mjs
securityhigh SD-007
scripts/lib/catalog.mjs
securityhigh SD-007
scripts/lib/catalog.mjs
securitycritical SD-013
scripts/lib/engine.mjs
6 suppressed by AI triage
permission_hygienehigh SD-003 benign_example
README.md

The README references a relative path to another skill directory, not an attempt to traverse system files.

permission_hygienehigh SD-003 benign_example
README.zh.md

The relative path is a documentation link, not a file system traversal that can be executed by a skill.

securityhigh SD-007 benign_example
references/samples-format.md

The content is a documentation example of curl usage, not an executed outbound call or a configuration that authorizes such calls.

securitycritical SD-013 benign_example
scripts/lib/catalog.mjs

The flagged text appears to be a placeholder in documentation, not an actual persistence mechanism.

securitymedium SD-008 benign_example
scripts/recall-rank.mjs

Scanner flagged a comment; no base64 string is present in the code.

securitymedium SD-008 benign_example
scripts/recall-rank.mjs

Scanner flagged a comment; no base64 string is present in the code.