{
  "name": "42crunch-api-security-testing — 5 skills",
  "slug": "source-skills-70101be1146d1f99d01410c8",
  "type": "skills",
  "category": "developer-tools",
  "example": false,
  "evidence_state": "pinned_source_listing",
  "stamp": "Pinned source listing — machine-checked",
  "summary": "Pinned source declarations and file hashes were listed.",
  "outcome": "Listed 5 skill declarations. Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
  "rule_results": [
    "The retained source tree matches its acquisition manifest.",
    "Declared skill names (listing.json): 42crunch-api-security-testing; 42crunch-audit; 42crunch-scan; 42crunch-setup; code-to-oas"
  ],
  "task": "What declarations and files are present in this pinned source?",
  "setup": "Git blob acquisition followed by static source inspection.",
  "limitations": "Scope: acquisition and static inspection. Command results: commands.json.",
  "source_url": "https://github.com/42Crunch-AI/claude-plugins.git",
  "documentation_url": "https://github.com/42Crunch-AI/claude-plugins.git",
  "commit": "faf5305385de8afed9468904e8639be737aff39e",
  "tree_sha256": "faa6f2645b55df9ac9772a6dfd7942b560c5f379a0a4eb786678fd692c43de24",
  "file_sha256": {
    ".claude-plugin/marketplace.json": "84c797029ddc0d1712baae85b007597e8c9756be6e8c1f22a3d00c5afce15db2",
    "README.md": "4a8970ff9a006c5fb519f1be081b85ec29ec477130bf063508e4aa26ac5667d8",
    "plugins/api-security-testing/.claude-plugin/plugin.json": "7529acee7d2239f68b2945de98b94b328e84d5bcf44fe2bb85eb910c76c32020",
    "plugins/api-security-testing/LICENSE": "95632db32748eadf2acaf1ae235b6df6080c6b21b3e1f07e8c4ad3f01f70d632",
    "plugins/api-security-testing/README.md": "c6ea69ede7d475adbef66f2a865c0bc6f46eb03a1118b3b5aea57971fadb62ef",
    "plugins/api-security-testing/references/audit-rule-translations.md": "39a49b88e7c087a1dde2f0988e25df09c2abe370df2bac681d6b162cfb9e60aa",
    "plugins/api-security-testing/references/audit-workflow.md": "85ff1cff5957a261e7d8777231554a47c45cfa9e10f05130e5f970ba8614bebb",
    "plugins/api-security-testing/references/binary-setup.md": "f687ef8f39c3ccc8ffa5ae5abad3f9e76904f7a8233d1b2598d66be93e339784",
    "plugins/api-security-testing/references/credential-setup.md": "3f901ebee3437b21aac0339c8b7fda0664b8c1e2a7f19775ed0e814652a0dc61",
    "plugins/api-security-testing/references/pre-flight.md": "6222cf067ada86b4fd05b7e7802c9c89a5a8b991b1f6d5c44dc4ec9a8f26c6bd",
    "plugins/api-security-testing/references/scan-workflow.md": "791dab618f3e6a68550c7cdce041f1ee7c2d0d2e85bc770147102a9a8766716a",
    "plugins/api-security-testing/references/tag-detection.md": "4affb1c8b1368984569d163369c2f7177d0c46f814e9a07e7d8e2c4788bf7bf0",
    "plugins/api-security-testing/skills/42crunch-api-security-testing/SKILL.md": "5453f765f5e92b368fe4e06ffa60eef84d808517821f277bca1fb472079aa229",
    "plugins/api-security-testing/skills/42crunch-audit/SKILL.md": "63ab241317b5e7e464aba3bad0d62ffa1c52ad76d4abed69c42741aa6f2a16e1",
    "plugins/api-security-testing/skills/42crunch-scan/SKILL.md": "21dbacbcac9bed5f4abd71311721f3794c1318f5a41bc0d8e8bc8953f99cbaac",
    "plugins/api-security-testing/skills/42crunch-setup/SKILL.md": "849589b1b5098e157051a3940389b9c891aa7d4c9ec77907d857399c68f0b6b9",
    "plugins/api-security-testing/skills/code-to-oas/SKILL.md": "7d25b8329e1d5b489606c6c9dca2fd20a09d23c6fd65dee3436698d5b906244a"
  },
  "lockfiles": [
    "LOCK.json"
  ],
  "utc_date": "2026-10-17T11:02:31Z",
  "source_date": "2026-10-16",
  "discovered_date": "2026-10-16",
  "retested_date": "2026-10-17",
  "reviewed_date": "2026-10-17",
  "published_date": "2026-10-17",
  "modified_date": "2026-10-17",
  "reviewer": "machine pipeline",
  "harness_version": "toolwitness harness at commit 4795a352bbc24419d7d6389f3d607fd938a08916",
  "claude_code_version": "Not applicable: static source inspection (commands.json).",
  "model_id": "Not applicable: static source inspection (commands.json).",
  "scanner_version": "Not applicable: static source inspection.",
  "rulepack_version": "Not applicable: static source inspection.",
  "agents": [],
  "disclaimer": "This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.",
  "commands": [
    "Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."
  ],
  "prompt_list": [
    "Not applicable: static source inspection (commands.json)."
  ],
  "history": [
    "2026-10-17T11:02:31Z: pinned source inspection"
  ],
  "application": {
    "name": "42crunch-api-security-testing — 5 skills",
    "softwareVersion": "faf5305385de8afed9468904e8639be737aff39e",
    "applicationCategory": "DeveloperApplication",
    "operatingSystem": "Not exercised"
  },
  "artifacts": {
    "transcript": "Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
    "sinkhole_log": "Not applicable: static source inspection (commands.json).",
    "canary_log": "Not applicable: static source inspection (commands.json).",
    "scanner_output": "Not applicable: static source inspection (commands.json).",
    "normalized_text": "{\n  \"listing\": {\n    \"skills\": [\n      {\n        \"path\": \"plugins/api-security-testing/skills/42crunch-api-security-testing/SKILL.md\",\n        \"name\": \"42crunch-api-security-testing\",\n        \"description\": \"Run both a 42Crunch Audit and a live Scan together in a single pipeline. Use this skill when the user wants to run audit and scan together, complete the full security pipeline, or when the request is ambiguous about which phase to run. Triggers on phrases like \\\"run audit and scan\\\", \\\"full 42crunch pipeline\\\", \\\"full security check\\\", \\\"audit then scan\\\", \\\"42crunch\\\", or \\\"SQG\\\". Do NOT use this skill if the user explicitly requests only an audit (use 42crunch-audit) or only a scan (use 42crunch-scan).\\n\",\n        \"files\": {\n          \"plugins/api-security-testing/skills/42crunch-api-security-testing/SKILL.md\": \"5453f765f5e92b368fe4e06ffa60eef84d808517821f277bca1fb472079aa229\"\n        }\n      },\n      {\n        \"path\": \"plugins/api-security-testing/skills/42crunch-audit/SKILL.md\",\n        \"name\": \"42crunch-audit\",\n        \"description\": \"Run a 42Crunch API Security Audit and fix SQG-blocking issues in an OpenAPI Specification file. Use this skill whenever the user wants to audit an OAS file for security issues, fix SQG-blocking issues, score an API, apply data dictionary enrichment, or remediate audit findings. Triggers on phrases like \\\"run audit\\\", \\\"audit only\\\", \\\"fix audit issues\\\", \\\"SQG audit\\\", \\\"42crunch audit\\\", \\\"audit score\\\", or any request focused on static OAS analysis and remediation without running a live scan.\\n\",\n        \"files\": {\n          \"plugins/api-security-testing/skills/42crunch-audit/SKILL.md\": \"63ab241317b5e7e464aba3bad0d62ffa1c52ad76d4abed69c42741aa6f2a16e1\"\n        }\n      },\n      {\n        \"path\": \"plugins/api-security-testing/skills/42crunch-scan/SKILL.md\",\n        \"name\": \"42crunch-scan\",\n        \"description\": \"Run a 42Crunch live conformance and authorization scan against an API and fix SQG-blocking scan findings. Use this skill whenever the user wants to run a conformance test, authorization scan, BOLA test, BFLA test, generate or configure a scan config, or fix scan-reported issues. Triggers on phrases like \\\"run scan\\\", \\\"scan only\\\", \\\"conformance test\\\", \\\"BOLA test\\\", \\\"BFLA test\\\", \\\"42crunch scan\\\", \\\"scan config\\\", or any request focused on live API testing without running a static audit. Use 42crunch-api-security-testing when the user wants both audit and scan together.\\n\",\n        \"files\": {\n          \"plugins/api-security-testing/skills/42crunch-scan/SKILL.md\": \"21dbacbcac9bed5f4abd71311721f3794c1318f5a41bc0d8e8bc8953f99cbaac\"\n        }\n      },\n      {\n        \"path\": \"plugins/api-security-testing/skills/42crunch-setup/SKILL.md\",\n        \"name\": \"42crunch-setup\",\n        \"description\": \"Set up the 42Crunch environment so that audit and scan skills can run without friction. Use this skill whenever the user wants to configure 42Crunch for the first time, install or update the 42c-ast binary, configure an API key, or troubleshoot missing credentials or binary errors. Triggers on phrases like \\\"setup 42crunch\\\", \\\"configure 42crunch\\\", \\\"install 42c-ast\\\", \\\"update 42c-ast\\\", \\\"set api key\\\", \\\"42crunch not working\\\", \\\"binary not found\\\", or any request to prepare the environment before running an audit or scan.\\n\",\n        \"files\": {\n          \"plugins/api-security-testing/skills/42crunch-setup/SKILL.md\": \"849589b1b5098e157051a3940389b9c891aa7d4c9ec77907d857399c68f0b6b9\"\n        }\n      },\n      {\n        \"path\": \"plugins/api-security-testing/skills/code-to-oas/SKILL.md\",\n        \"name\": \"code-to-oas\",\n        \"description\": \"Analyze an entire API codebase and generate an accurate OpenAPI Specification (OAS 3.0) file from the source code. Use this skill whenever the user wants to generate, create, or derive an OpenAPI spec from code, reverse-engineer an API definition, or document an existing API. Triggers on phrases like \\\"generate OAS from code\\\", \\\"create OpenAPI spec\\\", \\\"document my API\\\", \\\"reverse-engineer spec\\\", \\\"write openapi.json from my codebase\\\", or any request to produce an OAS file by reading source files rather than an existing spec.\\n\",\n        \"files\": {\n          \"plugins/api-security-testing/skills/code-to-oas/SKILL.md\": \"7d25b8329e1d5b489606c6c9dca2fd20a09d23c6fd65dee3436698d5b906244a\"\n        }\n      }\n    ],\n    \"hooks\": [],\n    \"executions\": []\n  }\n}"
  },
  "review_input": {
    "identity_artifact": "identity.json",
    "evidence_sha256": {
      "LOCK.json": "2db60ed9bbd39483e987a2b0a81c6e14df1d4b3616ce97199693c87c283427d5",
      "commands.json": "30c1b45bb476369fd52aaa8389f59bf653f71c0fab1d3d14049fead21b26fa6e",
      "complete.json": "91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f",
      "identity.json": "7fe3f9055cc635c9a1a1b2430217ea765b87d6f35792c2ff51876b1261a7d6e8",
      "listing.json": "e96fbcd6593ac7c6f354bfebaaea962a564c5d14ee539d5b7a58b078e58d6812",
      "selection.json": "0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"
    },
    "claims": [
      {
        "id": "acquired",
        "field": "summary",
        "text": "Pinned source declarations and file hashes were listed.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "listed",
        "field": "outcome",
        "text": "Listed 5 skill declarations. Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "tree",
        "field": "rule_results.0",
        "text": "The retained source tree matches its acquisition manifest.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "declared",
        "field": "rule_results.1",
        "text": "Declared skill names (listing.json): 42crunch-api-security-testing; 42crunch-audit; 42crunch-scan; 42crunch-setup; code-to-oas",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      }
    ]
  },
  "review": {
    "kind": "machine-checked",
    "date": "2026-10-17",
    "reviewed_sha256": "2c259683c3f90f3710d21af641080569cb01a043e197758a17e70426089ac59f",
    "gates": "285b8997ba5e86b8142fb8f13bf301683981d807a302d8abc3fff1c9a5289a22",
    "codex": "dc0714d22090662a0ac904833af1aaa1a77c5802c4011943e76fce6c43e8b723",
    "grok": "bce0559aeec15b0908ec3091ec4f7cdcb7ac972136d7b3c7d9e541e8861c8b75",
    "summary": "Deterministic gates passed; Codex confirmed all outcome claims; Grok reported no standing refutation."
  }
}