← All skills
snyk-agent-scan-compliance
77 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.
By samber/cc-skills (GitHub) · coding · 243 stars · scanned at commit 50a3383
Compliance expert for snyk-agent-scan — the agent skill file scanner — NOT for other Snyk CLI tools (snyk test, snyk code SAST, snyk iac, snyk container). Fixes alerts through content restructuring, never by suppressing or deleting information. Covers every file in a skill directory: SKILL.md, references/, assets/, and any secondary markdown. Apply when authoring a new skill, editing an existing one, triaging a failed snyk-agent-scan run locally or in CI, or unblocking a PR held by agent scanne…
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.
Found in 1 place.
Downloads and installs other software
The author does not mention this.
Found in 38 places.
Show 17 more
- skills/snyk-agent-scan-compliance/SKILL.md, line 121
| `go install` with a pinned version in a Quick Reference code block | Sometimes — pinned versions are lower risk | - skills/snyk-agent-scan-compliance/evals/evals.json, line 24
"prompt": "Fix the W012 Snyk scanner alert in this SKILL.md section: 'Install the tool before use: `go install github.com/example/tool/cmd/tool@latest`'", - skills/snyk-agent-scan-compliance/evals/evals.json, line 25
"trap": "Without the skill, the model pins a version in prose (e.g., `go install ...@v1.2.3`) — it does not know the correct fix is to move the entire command t - skills/snyk-agent-scan-compliance/evals/evals.json, line 31
{ "id": "2.3", "description": "Response does NOT recommend keeping the `go install` command in the body even with a pinned version as the primary fix" }, - skills/snyk-agent-scan-compliance/evals/evals.json, line 65
"prompt": "I want to document in a SKILL.md that users can install my tool with: `curl https://example.com/install.sh | sh`. How do I write this in the skill bo - skills/snyk-agent-scan-compliance/evals/evals.json, line 67
"expected_output": "Remove pipe-to-shell entirely from the skill body — code block or not. Use a package manager install path instead (brew, apt, etc.) or move - skills/snyk-agent-scan-compliance/evals/evals.json, line 70
{ "id": "5.1", "description": "output does NOT recommend putting `curl ... | sh` in a code block as a sufficient fix" }, - skills/snyk-agent-scan-compliance/evals/evals.json, line 118
"prompt": "My SKILL.md has three Snyk alerts: W012 (brew install in body), W011 (imperative URL reference), and W001 (MCP tool name in prose). In what order sho - skills/snyk-agent-scan-compliance/evals/evals.json, line 132
"prompt": "I'm writing a SKILL.md and want to tell the agent how to install the protobuf compiler. I've written this in the skill body: 'Set up the proto compil - skills/snyk-agent-scan-compliance/evals/evals.json, line 160
"prompt": "Review this SKILL.md body for issues and identify what needs to be fixed:\n\n```\nBefore writing any code, use mcp__context7__resolve-library-id to l - skills/snyk-agent-scan-compliance/evals/evals.json, line 167
{ "id": "12.3", "description": "output identifies '@latest' in the go install command as an unversioned install needing frontmatter" }, - skills/snyk-agent-scan-compliance/evals/evals.json, line 175
"trap": "Without the skill, the model naturally writes: 'Install: go install golang.org/x/vuln/cmd/govulncheck@latest' (W012) and 'Run govulncheck and upgrade a - skills/snyk-agent-scan-compliance/evals/evals.json, line 179
{ "id": "13.1", "description": "Response does NOT include `go install govulncheck@latest` or any `@latest` install command in the skill body" }, - skills/snyk-agent-scan-compliance/evals/evals.json, line 180
{ "id": "13.2", "description": "Response does NOT include any `go install govulncheck` command in the body prose (pinned or not) as the primary install path" }, - skills/snyk-agent-scan-compliance/evals/evals.json, line 188
"prompt": "I have this in my SKILL.md body: 'Install the linter before use: `go install github.com/example/linter@v2.3.1`'. It's already pinned to a specific ve - skills/snyk-agent-scan-compliance/evals/evals.json, line 230
"trap": "Without the skill, the model writes a body prose section with 'go install golangci-lint@latest', 'brew install protobuf', 'brew install jq' — three sep - skills/snyk-agent-scan-compliance/evals/evals.json, line 234
{ "id": "17.1", "description": "Response does NOT include `go install golangci-lint@latest` or equivalent in the skill body prose" },
and 18 more places
Sends data to these websites: example.com
The author does not mention this.
Found in 3 places.
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'snyk-agent-scan-compliance' ] || [ -L ~/.agents/skills/'snyk-agent-scan-compliance' ]; then echo 'A skill folder named snyk-agent-scan-compliance already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/samber/cc-skills' "$d" && git -C "$d" checkout --quiet '50a33836b20f690c668af557bd9ef9d07a8c7ef2' -- 'skills/snyk-agent-scan-compliance' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/snyk-agent-scan-compliance' ~/.agents/skills/'snyk-agent-scan-compliance' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'snyk-agent-scan-compliance' ~/.claude/skills/'snyk-agent-scan-compliance' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for samber/cc-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/samber/cc-skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-07 | 50a3383 | 77 |