{
  "name": "sonatype-guide — 1 skill",
  "slug": "source-skills-893518af006a7049d9e33a8e",
  "type": "skills",
  "category": "developer-tools",
  "example": false,
  "evidence_state": "pinned_source_listing",
  "stamp": "Pinned source listing — machine-checked",
  "summary": "Pinned source declarations and file hashes were listed.",
  "outcome": "Listed 1 skill declaration. Ran 10 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
  "rule_results": [
    "The retained source tree matches its acquisition manifest.",
    "Declared skill names (listing.json): sonatype-guide"
  ],
  "task": "What declarations and files are present in this pinned source?",
  "setup": "Git blob acquisition followed by static source inspection.",
  "limitations": "Scope: acquisition and static inspection. Command results: commands.json.",
  "source_url": "https://github.com/sonatype/sonatype-guide-claude-plugin.git",
  "documentation_url": "https://github.com/sonatype/sonatype-guide-claude-plugin.git",
  "commit": "1dae73980f591d3196f5532ac72186513563d028",
  "tree_sha256": "1b3791c46004f15b237b9a74bc6e5d6d63e9243b47a216270357ba0e9f88ba5d",
  "file_sha256": {
    ".claude-plugin/plugin.json": "942bbd2a9e7c86f6fa01e432a7f45c2bf1a0ca270fa7b67c717b85a3fce744f1",
    ".mcp.json": "af070da4a64a44e96f8c580de9d586744c63f17df86ddfd9b416bc8b6dd74b52",
    "README.md": "553be73bd23bf189736b20585f565736a285963b5dfbd5036e563738328ef3ac",
    "skills/sonatype-guide/SKILL.md": "941b3481e431086ce50c376870e033a35039def54d6fa4b0754600b304a46ece",
    "skills/sonatype-guide/references/purl-ecosystems.md": "47df4896e848116c0a336a2835b68099539539fdf785f8efc517d78813c621d7"
  },
  "lockfiles": [
    "LOCK.json"
  ],
  "utc_date": "2026-10-19T18:07:27Z",
  "source_date": "2026-10-16",
  "discovered_date": "2026-10-16",
  "retested_date": "2026-10-19",
  "reviewed_date": "2026-10-19",
  "published_date": "2026-10-19",
  "modified_date": "2026-10-19",
  "reviewer": "machine pipeline",
  "harness_version": "toolwitness harness at commit 11dde7217ae6f8e4ac4d18a6380b18ba01450122",
  "claude_code_version": "Not applicable: static source inspection (commands.json).",
  "model_id": "Not applicable: static source inspection (commands.json).",
  "scanner_version": "Not applicable: static source inspection.",
  "rulepack_version": "Not applicable: static source inspection.",
  "agents": [],
  "disclaimer": "This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.",
  "commands": [
    "Ran 10 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."
  ],
  "prompt_list": [
    "Not applicable: static source inspection (commands.json)."
  ],
  "history": [
    "2026-10-19T18:07:27Z: pinned source inspection"
  ],
  "application": {
    "name": "sonatype-guide — 1 skill",
    "softwareVersion": "1dae73980f591d3196f5532ac72186513563d028",
    "applicationCategory": "DeveloperApplication",
    "operatingSystem": "Not exercised"
  },
  "artifacts": {
    "transcript": "Ran 10 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
    "sinkhole_log": "Not applicable: static source inspection (commands.json).",
    "canary_log": "Not applicable: static source inspection (commands.json).",
    "scanner_output": "Not applicable: static source inspection (commands.json).",
    "normalized_text": "{\n  \"listing\": {\n    \"skills\": [\n      {\n        \"path\": \"skills/sonatype-guide/SKILL.md\",\n        \"name\": \"sonatype-guide\",\n        \"description\": \"MUST use before installing, adding, or upgrading any dependency. Trigger when: running pip install, npm install, cargo add, go get, or any package manager command; adding a package to requirements.txt, package.json, pyproject.toml, Cargo.toml, go.mod, pom.xml, build.gradle, or Gemfile; choosing which library to use for a task; upgrading or changing dependency versions; or auditing existing dependencies. Uses the Sonatype Guide MCP server to check vulnerabilities, Developer Trust Scores, license risks, malicious package detection, and policy compliance. Do not install or recommend a dependency without checking it here first.\",\n        \"files\": {\n          \"skills/sonatype-guide/SKILL.md\": \"941b3481e431086ce50c376870e033a35039def54d6fa4b0754600b304a46ece\",\n          \"skills/sonatype-guide/references/purl-ecosystems.md\": \"47df4896e848116c0a336a2835b68099539539fdf785f8efc517d78813c621d7\"\n        }\n      }\n    ],\n    \"hooks\": [],\n    \"executions\": []\n  }\n}"
  },
  "review_input": {
    "identity_artifact": "identity.json",
    "evidence_sha256": {
      "LOCK.json": "34a10f475f75058f03c476a17bc9f649ea0846177094d096bc3b3c7d607c6fb7",
      "commands.json": "2e223b478433ddb6afe4ac6cf00753236473920183d8de49c97703ef8165cc00",
      "complete.json": "91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f",
      "identity.json": "b3c39381dc59c2b9c8368af68d45dacf48e0347439f023b5e66a0ff2f7110b15",
      "listing.json": "c5932d256c4f59e7bda60137f9effe20d6604781fc3881a86173c3bf0ede1fe5",
      "selection.json": "0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"
    },
    "claims": [
      {
        "id": "acquired",
        "field": "summary",
        "text": "Pinned source declarations and file hashes were listed.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "listed",
        "field": "outcome",
        "text": "Listed 1 skill declaration. Ran 10 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "tree",
        "field": "rule_results.0",
        "text": "The retained source tree matches its acquisition manifest.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "declared",
        "field": "rule_results.1",
        "text": "Declared skill names (listing.json): sonatype-guide",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      }
    ]
  },
  "review": {
    "kind": "machine-checked",
    "date": "2026-10-19",
    "reviewed_sha256": "4e58167ef50a29f72d924e072eb66fd114be67b2f2f6530af5004d3fca5b2ceb",
    "gates": "21e99b34014325c17abd090ba11239c935fb4f6c88037f16b08bf8f0263ff248",
    "codex": "81a98efa608f094b98e626fd9c430331b60971d30b918e46e1e58bd48e691946",
    "grok": "170073721b133ac94441c41430e2706ed06172cfd705175a22d67d7190d3ef96",
    "summary": "Deterministic gates passed; every claim rebuilt from evidence with a reviewed template; Grok reported no standing refutation."
  }
}