{
  "name": "aikido — 4 skills",
  "slug": "source-skills-35e45f03219bdd6e7000e974",
  "type": "skills",
  "category": "developer-tools",
  "example": false,
  "evidence_state": "pinned_source_listing",
  "stamp": "Pinned source listing — machine-checked",
  "summary": "Pinned source declarations and file hashes were listed.",
  "outcome": "Listed 4 skill declarations. Ran 15 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
  "rule_results": [
    "The retained source tree matches its acquisition manifest.",
    "Declared skill names (listing.json): aikido-issues; pr-comments; scan; setup"
  ],
  "task": "What declarations and files are present in this pinned source?",
  "setup": "Git blob acquisition followed by static source inspection.",
  "limitations": "Scope: acquisition and static inspection. Command results: commands.json.",
  "source_url": "https://github.com/AikidoSec/aikido-claude-plugin.git",
  "documentation_url": "https://github.com/AikidoSec/aikido-claude-plugin.git",
  "commit": "8fdc995a44102a30ad54164e0bdd249d158c725c",
  "tree_sha256": "792375f50d2218252575a1e084226b978406182977dc8455a7a74d38f26cca2d",
  "file_sha256": {
    ".claude-plugin/marketplace.json": "d28be05a9c87e75807e26d8976f57000befdb45375b734693e1c6f326b15da1d",
    ".claude-plugin/plugin.json": "15756a8fe154e732fc51a1abe48f7faaf33e1232fdecf076d9363b02af5d937f",
    ".mcp.json": "ca246ab4c551de10a899021208e924565196312d627ac18aea7588ee3aa7cde2",
    "README.md": "a43a3bc011de5ec7ec275e382fe71f6b71949b5fc9afc944034cda8a46c642f4",
    "skills/issues/SKILL.md": "549e7f2450e63a1c7d39c56fc11eabe249ca60252d7c875bc15fa4fc35423118",
    "skills/pr-comments/SKILL.md": "270ff28a67c252db5de9fbfceae5caa0ab41e5d6b869b9a99c1fb4bc3959553c",
    "skills/pr-comments/reference.md": "af15ec82e2e9852ceae150a0134a8db1a4de47ad6bfc1074bd136ac4c2d00a9a",
    "skills/scan/SKILL.md": "ba898de64eb400fad63875503bb0be54ffef2c7a4ed7e3910e9528d60313d72a",
    "skills/scan/reference.md": "dbece5939f348089656547c6d5e8dc25d3374c9752ba26c719f390bf4819f586",
    "skills/setup/SKILL.md": "199d45889512f571d3e2b38bf1d81aeebe23de2aedd62fb53aec536914daaa15"
  },
  "lockfiles": [
    "LOCK.json"
  ],
  "utc_date": "2026-10-17T12:23:59Z",
  "source_date": "2026-10-16",
  "discovered_date": "2026-10-16",
  "retested_date": "2026-10-17",
  "reviewed_date": "2026-10-17",
  "published_date": "2026-10-17",
  "modified_date": "2026-10-17",
  "reviewer": "machine pipeline",
  "harness_version": "toolwitness harness at commit 5a286f05b93bfbf27b15f403e41e3a1525edc32f",
  "claude_code_version": "Not applicable: static source inspection (commands.json).",
  "model_id": "Not applicable: static source inspection (commands.json).",
  "scanner_version": "Not applicable: static source inspection.",
  "rulepack_version": "Not applicable: static source inspection.",
  "agents": [],
  "disclaimer": "This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.",
  "commands": [
    "Ran 15 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."
  ],
  "prompt_list": [
    "Not applicable: static source inspection (commands.json)."
  ],
  "history": [
    "2026-10-17T12:23:59Z: pinned source inspection"
  ],
  "application": {
    "name": "aikido — 4 skills",
    "softwareVersion": "8fdc995a44102a30ad54164e0bdd249d158c725c",
    "applicationCategory": "DeveloperApplication",
    "operatingSystem": "Not exercised"
  },
  "artifacts": {
    "transcript": "Ran 15 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
    "sinkhole_log": "Not applicable: static source inspection (commands.json).",
    "canary_log": "Not applicable: static source inspection (commands.json).",
    "scanner_output": "Not applicable: static source inspection (commands.json).",
    "normalized_text": "{\n  \"listing\": {\n    \"skills\": [\n      {\n        \"path\": \"skills/issues/SKILL.md\",\n        \"name\": \"aikido-issues\",\n        \"description\": \"List, count, summarize, or triage security issues from the Aikido security feed. Use when the user asks about Aikido findings, vulnerabilities, leaked secrets, SAST/IaC/SCA results, cloud or container security issues, or EOL/license/malware alerts surfaced by Aikido.\",\n        \"files\": {\n          \"skills/issues/SKILL.md\": \"549e7f2450e63a1c7d39c56fc11eabe249ca60252d7c875bc15fa4fc35423118\"\n        }\n      },\n      {\n        \"path\": \"skills/pr-comments/SKILL.md\",\n        \"name\": \"pr-comments\",\n        \"description\": \"Fetches comments already posted on a GitHub/GitLab/Azure DevOps pull or merge request (e.g. CI bot results, review feedback, Aikido's own scan-result comment). Use when the user asks what CI/CD said, wants to read/check/summarize PR or MR comments, mentions \\\"pipeline comments\\\", or asks about \\\"Aikido comments\\\"/\\\"Aikido feedback\\\"/what Aikido said or found on a PR — this reads via the native SCM CLI (gh/glab/az), not the Aikido MCP server.\",\n        \"files\": {\n          \"skills/pr-comments/SKILL.md\": \"270ff28a67c252db5de9fbfceae5caa0ab41e5d6b869b9a99c1fb4bc3959553c\",\n          \"skills/pr-comments/reference.md\": \"af15ec82e2e9852ceae150a0134a8db1a4de47ad6bfc1074bd136ac4c2d00a9a\"\n        }\n      },\n      {\n        \"path\": \"skills/scan/SKILL.md\",\n        \"name\": \"scan\",\n        \"description\": \"Runs an Aikido security scan on generated, added, or modified code files to detect SAST vulnerabilities and exposed secrets. Use when the user wants to scan code for security issues, after writing or modifying code, or when they mention Aikido, security scan, or SAST. Always run an Aikido scan after generating code to verify the generated code is free of security issues.\",\n        \"files\": {\n          \"skills/scan/SKILL.md\": \"ba898de64eb400fad63875503bb0be54ffef2c7a4ed7e3910e9528d60313d72a\",\n          \"skills/scan/reference.md\": \"dbece5939f348089656547c6d5e8dc25d3374c9752ba26c719f390bf4819f586\"\n        }\n      },\n      {\n        \"path\": \"skills/setup/SKILL.md\",\n        \"name\": \"setup\",\n        \"description\": \"Configures the Aikido plugin by signing the user in through the MCP login tool and verifying the MCP server. Use when the user wants to set up or verify the Aikido plugin, after installing it, when aikido mcp tool call fails or is unavailable, or when the user wants to switch Aikido accounts or re-authenticate.\",\n        \"files\": {\n          \"skills/setup/SKILL.md\": \"199d45889512f571d3e2b38bf1d81aeebe23de2aedd62fb53aec536914daaa15\"\n        }\n      }\n    ],\n    \"hooks\": [],\n    \"executions\": []\n  }\n}"
  },
  "review_input": {
    "identity_artifact": "identity.json",
    "evidence_sha256": {
      "LOCK.json": "a0cf8447c4d8d4b9d0b91508472a6ee62806431138dd8567874a7d4f94ee8cce",
      "commands.json": "11b7a2bed27bfd0bd0cd21c18384fb9c0e77a05e3a2290172e4c1b7b39739e42",
      "complete.json": "91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f",
      "identity.json": "b44818d374da7ccbc31647ba97c545ecac6f05bee8cd7cacdfe85f1a2f7ce5e6",
      "listing.json": "aa3b22da3fe25590091caf7293d360adc9ecd21b98364bf199502a38ae983b1e",
      "selection.json": "0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"
    },
    "claims": [
      {
        "id": "acquired",
        "field": "summary",
        "text": "Pinned source declarations and file hashes were listed.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "listed",
        "field": "outcome",
        "text": "Listed 4 skill declarations. Ran 15 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "tree",
        "field": "rule_results.0",
        "text": "The retained source tree matches its acquisition manifest.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "declared",
        "field": "rule_results.1",
        "text": "Declared skill names (listing.json): aikido-issues; pr-comments; scan; setup",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      }
    ]
  },
  "review": {
    "kind": "machine-checked",
    "date": "2026-10-17",
    "reviewed_sha256": "159cac8a7714ba38ddee21f13adaf79460877b5e7a7bfb131788faba235a24f7",
    "gates": "15d04b6c4e8e5455078c1d32aec871085b0edebfb181ca33b5dad3e88441d883",
    "codex": "745eb95af39700477a3a7ad459137f3708186ed6f715ac414034b56144df1eff",
    "grok": "6b3fe4c55628bea7ba14e39141959db1699eeee5de2c71bfcd7f59375e540421",
    "summary": "Deterministic gates passed; Codex confirmed all outcome claims; Grok reported no standing refutation."
  }
}