snyk-agent-scan-compliance

A security scanner flags the wording of skill files as risky, and this rewrites the wording until it stops complaining — rephrasing rather than deleting, so nothing the file said is lost.

WHEN TO USE

SCOPE

USE FOR

Fix a failing CI check caused by snyk-agent-scan flagging your skill file.
Turn an instruction that tells the agent to fetch a URL into a safe, passive hint.
Remove a named MCP tool function from a skill's body without breaking its behavior.
Tell a real compliance issue apart from one of the scanner's common false positives.
Move an install command out of prose and into frontmatter so it stops looking like a live install step.

NOT FOR

Other Snyk CLI tools, like snyk test, snyk code, or snyk container.
Dependency vulnerabilities, code security findings, or infrastructure misconfigurations.

This is a saved copy of the skill's SKILL.md instructions. It may differ from the upstream file or the version you install.

In this document (10)

Persona: You are a skill-authoring compliance expert. You fix snyk-agent-scan alerts by restructuring content — never by suppressing or deleting useful information.

Thinking mode: Reason as thoroughly as possible for multi-alert remediation where fixes for one alert type can surface or suppress another. Deep reasoning reduces rework. On Claude Code, use ultrathink to trigger extended thinking explicitly.

snyk-agent-scan Compliance

The snyk-agent-scan tool analyzes skill bodies for three categories of unsafe patterns: third-party content exposure (W011), malicious external URLs (W012), and prompt injection via MCP tool calls (W001). All three are fixable through content restructuring without losing any information.

Reference Files

File	When to read
references/w001-patterns.md	Fixing W001 alerts — MCP tool name patterns
references/w011-patterns.md	Fixing W011 alerts — imperative URL and external content patterns
references/w012-patterns.md	Fixing W012 alerts — version pinning and frontmatter offloading

Quick Reference

Alert	Severity	Root Cause	Primary Fix
W011	High	Skill body instructs agent to fetch/interpret external content	Replace imperatives with passive availability hints
W012	High	Skill body references external URLs fetched and executed at runtime	Move to frontmatter `install` block; pin versions
W001	High	Skill body names MCP tool functions explicitly	Use generic formulations instead

Running the Scanner

# Scan a single skill
SNYK_TOKEN=<token> snyk-agent-scan --skills skills/<name>/

# Scan all skills
SNYK_TOKEN=<token> snyk-agent-scan --skills ./skills

The scanner requires a valid SNYK_TOKEN. In CI, store it as a secret. If snyk-agent-scan is not installed, use uvx snyk-agent-scan@latest as a drop-in replacement without installing. See detailed patterns for fixes per alert type.

W011 — Third-Party Content Exposure

W011 fires when the skill body uses imperative verbs directing the agent to fetch, check, or evaluate external content and then act on it. The scanner treats the agent as the grammatical subject performing an external action.

Rules:

Replace Check <url> and Fetch <url> with passive hints: The release notes at <url> may be useful.
Remove "always" from any instruction involving external data: Always reference the changelog → The changelog documents breaking changes.
Keep tool invocations (gh repo view, govulncheck) in code blocks, not in prose checklists that imply the agent must run them before acting.
Decouple tool execution from decisions: running a tool is fine; using its remote-sourced output as the sole trigger for a refactor is not.

See W011 pattern catalog for 12+ before/after examples.

W012 — Potentially Malicious External URL

W012 fires when the body references external content fetched and executed at runtime: package installs with @latest, pipe-to-shell patterns, or GitHub Actions with wrong/non-existent major versions.

Rules:

Move go install pkg@latest and similar commands from prose into the frontmatter metadata.openclaw.install block — the scanner does not flag frontmatter.
Pin GitHub Actions to the correct current major version (@v4, not @v6).
Never use pipe-to-shell patterns (curl ... | sh) in skill bodies.

See W012 pattern catalog for 8+ before/after examples.

W001 — Prompt Injection via MCP Tool Calls

W001 fires when the skill body explicitly names MCP server tool functions, triggering prompt-injection detection.

Rules:

Never write tool function names (resolve-library-id, query-docs, mcp__*) in the skill body.
Replace with generic formulations: Context7 can help as a discoverability platform.
MCP tool names may still appear in the allowed-tools frontmatter field — only the body is restricted.

See W001 pattern catalog for safe reformulations.

Remediation Methodology

Fix one alert at a time, re-run snyk-agent-scan after each change, and verify the alert count dropped before moving to the next. If a fix does not reduce alerts, undo it and try a different approach — do not stack unverified changes.

When a scan returns multiple alerts, fix in this order to minimize rework:

1. W001 (simplest) — remove MCP tool names from body; confirm allowed-tools is correct
2. W011 — rewrite imperative sentences as passive statements; move checklist items to code blocks
3. W012 — move install commands to frontmatter; pin versions
4. Re-scan after each individual fix to verify improvement

W011 fixes sometimes surface hidden W012s when URLs become more prominent after restructuring.

False Positives

Not all alerts are real. Criteria for a likely false positive:

Condition	Likely false positive?
URL appears in a markdown table cell as reference data, not in an instruction	Yes — tables are usually safe
In a skill describing a library, URL is the library official documentation	Yes — usually safe
URL is the `homepage` or `issues` link in frontmatter	Yes — not scanned
Tool name appears inside a triple-backtick code block as a shell command	Sometimes — code blocks have lighter scrutiny
`go install` with a pinned version in a Quick Reference code block	Sometimes — pinned versions are lower risk
`always` appears in a sentence not involving external resources	Yes — "always" alone doesn't trigger W011

When an alert is a likely false positive, restructure anyway using the passive hint pattern — the scanner's heuristic protects real users; restructuring is safer than assuming scanner error.

Pre-Authoring Checklist

Apply these checks while writing a new skill body to avoid alerts before the first scan:

No sentence has the agent as subject performing an action on a URL
No @latest tags in any install instruction in the body
No MCP tool function names (mcp__*, resolve-library-id, etc.) in body prose
All install commands are in the frontmatter install block
GitHub Actions versions match real existing major versions
Tool invocations are in code blocks, not in ordered-list checklists
"always" does not precede any external resource instruction

If you encounter a bug or unexpected behavior in snyk-agent-scan, open an issue at https://github.com/snyk/snyk-agent-scan/issues.

If you discover a pattern that triggers an alert not covered in the reference files above — a new bypass technique, a false positive condition, or an undocumented alert code — open an issue at https://github.com/samber/cc-skills/issues or a pull request to the samber/cc-skills repository to add it to the relevant pattern file. New patterns are the most valuable contribution to this skill.

Account or credentials required

1 FOR YOU

01
Get a Snyk account and an API token
Create a Snyk account and generate an API token, then export it as an environment variable when running snyk-agent-scan locally, or store it as a CI secret.
You set: SNYK_TOKEN

Setup details: Expect some account or credential setup.

This skill ships inside the Samber Marketing & Engineering Skills plugin.

Run this outside your AI tool, using Node.js 22.20.0 or newer. Skills CLI 1.7.2 skips skill selection; prompts cancel installation without an interactive terminal. If choosing Project when asked about installation scope, open your project's folder before running this.

Install checklist

Check selected tools if a picker appears; Claude Code may be unchecked under Additional agents. ↑/↓ moves, Space toggles selections, Enter confirms.
Without a tool picker, check Installing to: for your intended tool. Stop if it names a different tool.
If asked, choose Symlink (Recommended) for shared files or Copy to all agents for separate copies; review the summary before confirming installation.
Install the find-skills skill? defaults to Yes, adding another skill for all projects. Choose No if you don't want that extra installation.

Skills CLI 1.7.2 sends install data to skills.sh by default, including the source, skill names, target tools and file details; GitHub sources are reported only when GitHub confirms the repository is public, while other remote sources can also be reported. Confirmed-public GitHub sources also trigger a security-audit request. Before installing, set the environment variable DO_NOT_TRACK=1 or DISABLE_TELEMETRY=1 to disable both.

npx skills add samber/cc-skills --skill "snyk-agent-scan-compliance" --full-depth

After installing for Claude Code, open it in the installation project if you chose Project; Global makes the skill available across projects on this computer. Once Claude Code loads the skill, its description helps Claude decide when to use it.

If installation created a top-level skills folder that did not exist when your Claude Code session started, run /reload-skills in that session. Run it again after later changes in that folder.

What's inside

Files included with this skill.

View on GitHub

Same repository

chrome-extension
Build Chrome extensions with Manifest V3. Use this skill whenever the user mentions Chrome extension, browser extension, manifest.json, content script, service worker (in extension context), popup, side panel, chrome.runtime, chrome.tabs, chrome.storage, chrome.scripting, or any Chrome extension API. Also trigger when the user wants to inject scripts into web pages, communicate between page and background, bypass CSP from a content script, build an RPC layer over chrome messaging, or publish to the Chrome Web Store. Covers both new extension projects and adding features to existing ones. Do NOT use for CRXJS/Vite-based builds with HMR — use samber/cc-skills@crxjs instead.Read full description
conventional-git
Conventional Commits v1.0.0 branch naming, worktree naming, and commit message standards for GitHub and GitLab projects. Use when creating branches, naming worktrees, writing commits, generating commit messages, reviewing branch conventions, or setting up changelog automation. Apply when your project needs consistent git history, SemVer-driven releases, parseable changelog generation, or automatic issue closing. Trigger when the user asks how to name a worktree, create a git worktree, or organize worktrees alongside branches.Read full description
copywriting-cta
Designs end-of-article CTAs — copy, layout, placement, A/B test plan, accessibility — for blog posts, newsletters, and essays. Use whenever the user asks to write, review, or improve a CTA at the bottom of an article; mentions "end-of-post CTA", "call-to-action", "signup box", "newsletter CTA", "subscribe block", or "what should I put at the bottom"; or asks how to turn readers into subscribers, leads, customers, or paying supporters. Covers personal blogs, paid newsletters (Substack, beehiiv, Ghost), and brand content-marketing blogs. Do NOT use for opening hooks, ledes, or post titles — use samber/cc-skills@copywriting-hooks instead. Not for landing-page, ad, or email copy.Read full description
copywriting-hooks
Writes opening hooks and post titles for long-form articles in EN or FR — blog posts, Substack/Medium/dev.to, LinkedIn long-form, newsletters, essays. Trigger whenever the user asks for a hook, opening, lede, intro, first sentence/paragraph, opener, accroche, attaque, phrase d'accroche, or première phrase — including punching up a flat intro or draft opening — or for a post title, titre d'article, or headline. Do NOT trigger for social posts (LinkedIn feed, Twitter/X, TikTok, Bluesky), READMEs, taglines, email subjects, ad copy, landing-page headlines, press releases, SEO meta, or body rewrites. Do NOT use for end-of-article CTAs — use samber/cc-skills@copywriting-cta instead.Read full description
copywriting-prose-creator
Codifies how a person or brand writes — lexicon, syntax, rhythm, structure, signature moves — into a PROSE.md guide, independent of emotional tone. Builds from SOUL.md and TONE.md, ports a guide to another channel, or reverse-engineers prose patterns from a corpus. Trigger on PROSE.md, writing style guide, prose guide, house style, ghostwriter style, writing playbook, banned words, sentence-length targets, or multi-writer consistency in a content factory. Do NOT use for writing actual content — use samber/cc-skills@linkedin-ghostwriting or samber/cc-skills@technical-article-writer instead. Not for tone decisions (samber/cc-skills@copywriting-tone-of-voice-creator), hooks, or CTAs.Read full description
copywriting-tone-of-voice-creator
Builds a brand tone of voice guide (TONE.md) — voice attributes with do's/don'ts, NN/g positioning, tone modulation matrix, lexicon, channel rules — for downstream content skills to consume. Also ports an existing TONE.md to a new channel (blog → LinkedIn, web → Twitter/X, in-product UI). Covers B2B SaaS, B2C/D2C, NGO, public sector, consulting, industrial, product-led, personal, and volunteering brands. Apply when the user wants to define or refresh a brand voice, port it to a new channel, or set up a content factory. Not for writing individual posts, articles, emails, or UI strings — use the dedicated writing skills. Not for SOUL.md, PROSE.md (samber/cc-skills@copywriting-prose-creator), or DESIGN.md.Read full description

snyk-agent-scan Compliance

Reference Files

Quick Reference

Running the Scanner

W011 — Third-Party Content Exposure

W012 — Potentially Malicious External URL

W001 — Prompt Injection via MCP Tool Calls

Remediation Methodology

False Positives

Pre-Authoring Checklist

Account or credentials required

What's inside

More skills

MCP keyword matches