Skip to content
Back to skills

Site Map Gap Analysis

ASecurity

Turn the graph invariants and verification verdicts into stable SM-* findings and a gap report, so the map's problems are triaged, evidenced, and each carry a concrete fix.

  • 8 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added September 2, 2026
ai-agentsgo

Security analysis

A100/100

Pro scans all 3 files and shows the line behind each finding

Scanned September 2, 2026

npx -y skills add Eliyce/paqad-ai --skill site-map-gap-analysis --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Site Map Gap Analysis?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Site Map Gap Analysis
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/eliyce-site-map-gap-analysis/badge)](https://www.skillsdirectory.com/skills/eliyce-site-map-gap-analysis)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: site-map-gap-analysis
description: Turn the graph invariants and verification verdicts into stable SM-* findings and a gap report, so the map's problems are triaged, evidenced, and each carry a concrete fix.
model_tier: medium
triggers:
  - workflow:
      - site-map
cacheable: false
cache_key_inputs: []
output_format: json
input_schema:
  run_bundle:
    type: path
    required: true
    description: The run bundle whose invariants and verdicts become SM-* findings.
---

## What It Does

Converts the engine's graph invariants (orphans, dead ends, guard-less backstage surfaces,
broken cross-references) and the verifier's confirmed verdicts into `SM-*` findings, then
composes the gap report. Every finding is content-addressed, evidenced, and carries a concrete
fix — nothing here is a vague observation.

## Use This When

Use this after verification, once invariants and verdicts exist. It produces the findings the
receipt and the retest depend on.

## Inputs

- The engine's graph invariants and the finding index in the run bundle.
- The verifier's confirmed verdicts from `map-verification`.
- Read `references/finding-composition.md` before writing a finding.

## Procedure

The findings come from the engine's invariants and the confirmed verdicts — never from your own
fresh reading of the code.

1. Read the engine's invariants and finding index; each already carries a category and evidence.
2. Fold in the confirmed Tier-B verdicts, dedup against the existing findings, and reuse
   `finding-normalizer` so ids and severities follow the shared vocabulary.
3. Compose the gap report: findings ordered by severity, each with its `SM-<hash8>` id, category,
   evidence, and a concrete fix.

## Output Contract

- A JSON object `{ findings: [{ id, category, severity, evidence, suggestion, affected_files }], summary }`.
- Every finding id is a content-addressed `SM-<hash8>`; the category is a field
  (`SM-ADD | SM-REMOVE | SM-EDGE-STALE | SM-GUARD-DRIFT | SM-ORPHAN | SM-DEADEND | …`).
- Every finding carries resolving evidence and a concrete `suggestion`.

## Escalate / Stop Conditions

- Never restate a finding the engine or a confirmed verdict did not produce. Absence of a finding
  is not a finding.
- Never expose a secret's bytes in evidence — cite `file:line`, rule, and fingerprint only.
- A finding with no concrete fix is incomplete; state the exact remediation or do not ship it.

## Resources

- `references/finding-composition.md`
- `agents/openai.yaml`

Files in this skill

  • SKILL.md2.4 KB
  • agents/openai.yaml155 B
  • references/finding-composition.md1.5 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.