Scanned skills

oracle/skills apex

Checked the catalogued skill at apex.

SkillTrust corpus scan 3 November 2026 v0.13.0 via skillsh Verify on GitHub
F AI-triaged 332
F Security

F; retained sample includes a critical finding · SD-013 · what this rule accepts as a false positive →

F Permissions

F; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →

B Transparency

B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →

showing 10 of 332
transparencymedium SD-007
apexlang/26.1/apexlang-generation/release-notes.json
transparencymedium SD-007
apexlang/26.1/apexlang-generation/release-notes.json
permission_hygienehigh SD-003
apexlang/26.1/apexlang-generation/runtime/grammar_contract.mjs
securitycritical SD-013
apexlang/26.1/apexlang-generation/runtime/lib/catalogs.mjs
securitycritical SD-013
apexlang/26.1/apexlang-generation/runtime/lib/catalogs.mjs
permission_hygienehigh SD-003
apexlang/26.1/apexlang-generation/runtime/lib/common.mjs
securityhigh SD-007
apexlang/26.1/apexlang-generation/runtime/runtime.bundle.mjs
securityhigh SD-007
apexlang/26.1/apexlang-generation/runtime/runtime.bundle.mjs
securityhigh SD-007
apexlang/26.1/apexlang-generation/runtime/runtime.bundle.mjs
securityhigh SD-007
apexlang/26.1/apexlang-generation/runtime/runtime.bundle.mjs
15 suppressed by AI triage
securitymedium SD-008 benign_example
apexlang/26.1/apexlang-example-applications/SKILL.md

The excerpt contains no base64 string; the match likely a false positive.

securitymedium SD-008 benign_example
apexlang/26.1/apexlang-generation/assets/validator-fix-recipes.json

No base64-encoded payload present, only normal textual content

permission_hygienehigh SD-003 benign_example
apexlang/26.1/apexlang-generation/manifest.json

The path pattern is part of a configuration blacklist, not an actual path traversal.

permission_hygienecritical SD-006 benign_example
apexlang/26.1/apexlang-generation/manifest.json

No secret string is present; the snippet only lists file paths.

permission_hygienecritical SD-006 benign_example
apexlang/26.1/apexlang-generation/manifest.json

No secret string is present; the snippet only lists file paths.

permission_hygienecritical SD-006 benign_example
apexlang/26.1/apexlang-generation/manifest.json

No secret string is present; the snippet only lists file paths.

permission_hygienecritical SD-006 benign_example
apexlang/26.1/apexlang-generation/manifest.json

No secret string is present; the snippet only lists file paths.

permission_hygienecritical SD-006 benign_example
apexlang/26.1/apexlang-generation/manifest.json

No secret string is present; the snippet only lists file paths.

permission_hygienecritical SD-006 benign_example
apexlang/26.1/apexlang-generation/manifest.json

No secret string is present; the snippet only lists file paths.

permission_hygienecritical SD-006 benign_example
apexlang/26.1/apexlang-generation/references/domains/page-components/page-patterns/templates.md

The line lists a file path, not a secret string.

securitymedium SD-008 benign_example
apexlang/26.1/apexlang-generation/references/domains/page-components/regions/chart/workflow-charts.md

No Base64 string appears in the file content; the scanner likely produced a false positive.

securitymedium SD-008 benign_example
apexlang/26.1/apexlang-generation/references/policies/memory-bank/30-pages/apex.chart-page.md

The base64 string appears within documentation and is not used to obfuscate code or data.

permission_hygienecritical SD-004 benign_example
apexlang/26.1/apexlang-generation/templates/workspace-components/credentials/credentials-for-open-ai.example.md

Documentation file only references a template path; no actual credentials or sensitive data are present.

securitymedium SD-008 benign_example
apexlang/26.2/apexlang-example-applications/SKILL.md

The excerpt contains no base64 string; the match likely a false positive.

securityhigh SD-022 benign_example
apexlang/26.2/apexlang-inventory/assets/rest-enabled-sql-database/rest-enabled-sql-database.md

The text appears to describe an alert message in documentation, not an actual exfiltration activity.