Skip to content
Back to skills

Runs

ASecurity

Date: 2026-07-11 Run: treatment with the skill. | # | Assertion | Result | Evidence | | --- | --- | --- | --- | | 1 | One material R4 finding | PASS | The output reports one material R4 finding. | | 2 | Retain the shared trigger | PASS | The phase rewrite begins “Before publishing a package.” | | 3 | Present the grouping meaning as an author decision | PASS | It presents workflow-phase and transaction-or-command alternatives. | | 4 | Do not discard or invent grouping semantics | PASS | It req...

  • 3 stars
  • 0 votes
  • 0 copies
  • 3 views
  • Added September 3, 2026
ai-agents

Security analysis

A100/100

Pro scans all 20 files and shows the line behind each finding

Scanned September 3, 2026

npx -y skills add briandconnelly/codex-in-claude --skill runs --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Runs?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Runs
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/briandconnelly-runs-bd4f1a1d/badge)](https://www.skillsdirectory.com/skills/briandconnelly-runs-bd4f1a1d)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
# Scenario 7 — With-Skill Scoring

Date: 2026-07-11
Run: treatment with the skill.

| # | Assertion | Result | Evidence |
| --- | --- | --- | --- |
| 1 | One material R4 finding | PASS | The output reports one material R4 finding. |
| 2 | Retain the shared trigger | PASS | The phase rewrite begins “Before publishing a package.” |
| 3 | Present the grouping meaning as an author decision | PASS | It presents workflow-phase and transaction-or-command alternatives. |
| 4 | Do not discard or invent grouping semantics | PASS | It requires the author to name any literal mechanism. |

Total: 4/4.

## Scored Output

## Findings

**R4 Atomic obligations**
Location: line 5.
Quoted text: “Before publishing a package, validate its checksum, sign the artifact, and upload its provenance in one operation.”
Why it fails: this bundles three independently checkable obligations into one statement, while “in one operation” does not establish whether they must occur in one transaction, one command, or merely one workflow phase.
Severity: material.
Suggested rewrite: this requires an author decision about what “one operation” means.
If it means one workflow phase: “Before publishing a package, complete this preparation phase: (1) Validate the package checksum. (2) Sign the artifact. (3) Upload its provenance.”
If it means one transaction or command: name that mechanism and require it to produce all three observable results before publication.

## Summary

Counts per rule: R1 0, R2 0, R3 0, R4 1, R5 0.
Counts per severity: material 1, minor 0.

The document clearly distinguishes its mandatory rule from context, but the rule combines three independently verifiable obligations and leaves the required meaning of “one operation” undefined.

Files in this skill

  • 2026-07-11-scenario1-baseline.md2.7 KB
  • 2026-07-11-scenario1-with-skill.md3.5 KB
  • 2026-07-11-scenario2-baseline.md2.5 KB
  • 2026-07-11-scenario2-with-skill.md1.2 KB
  • 2026-07-11-scenario3-baseline.md1.8 KB
  • 2026-07-11-scenario3-with-skill.md2.1 KB
  • 2026-07-11-scenario4-baseline.md1.6 KB
  • 2026-07-11-scenario4-with-skill.md1.4 KB
  • 2026-07-11-scenario5-baseline.md1.5 KB
  • 2026-07-11-scenario5-with-skill.md1004 B
  • 2026-07-11-scenario6-baseline.md1.6 KB
  • 2026-07-11-scenario6-with-skill.md2.7 KB
  • 2026-07-11-scenario7-baseline.md1.4 KB
  • 2026-07-11-scenario7-with-skill.md1.7 KB
  • 2026-07-11-scenario8-baseline.md1 KB
  • 2026-07-11-scenario8-with-skill.md1.8 KB
  • 2026-07-11-scenario9-trigger.md695 B
  • 2026-08-06-scenario1-with-skill.md13.2 KB
  • 2026-08-06-scenario6-with-skill.md6.8 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.