aikido — 4 skills

Pinned source listing — machine-checked

What declarations and files are present in this pinned source?

Pinned source declarations and file hashes were listed.

Review

Machine-checked · 2026-10-17

Run UTC: 2026-10-17T12:23:59Z
Reviewed: 2026-10-17
Published: 2026-10-17
Updated: 2026-10-17

Observations · Limitations · Evidence

What we ran

Git blob acquisition followed by static source inspection.

What we saw

Listed 4 skill declarations. Ran 15 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

Limits

Scope: acquisition and static inspection. Command results: commands.json.

developer-tools · skills · Upstream source · Upstream documentation

Pinned source inspection only; no runtime platform was exercised. UTC 2026-10-17T12:23:59Z, tree 792375f50d2218252575a1e084226b978406182977dc8455a7a74d38f26cca2d.

No browser or computer-use tools. Pin this exact version; the stamp does not follow updates.

Full record

name: aikido — 4 skills
slug: source-skills-35e45f03219bdd6e7000e974
type: skills
category: developer-tools
example: false
evidence state: pinned_source_listing
stamp: Pinned source listing — machine-checked
summary: Pinned source declarations and file hashes were listed.
outcome: Listed 4 skill declarations. Ran 15 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.
rule results: ["The retained source tree matches its acquisition manifest.","Declared skill names (listing.json): aikido-issues; pr-comments; scan; setup"]
task: What declarations and files are present in this pinned source?
setup: Git blob acquisition followed by static source inspection.
limitations: Scope: acquisition and static inspection. Command results: commands.json.
source url: https://github.com/AikidoSec/aikido-claude-plugin.git
documentation url: https://github.com/AikidoSec/aikido-claude-plugin.git
commit: 8fdc995a44102a30ad54164e0bdd249d158c725c
tree sha256: 792375f50d2218252575a1e084226b978406182977dc8455a7a74d38f26cca2d
file sha256: {".claude-plugin/marketplace.json":"d28be05a9c87e75807e26d8976f57000befdb45375b734693e1c6f326b15da1d",".claude-plugin/plugin.json":"15756a8fe154e732fc51a1abe48f7faaf33e1232fdecf076d9363b02af5d937f",".mcp.json":"ca246ab4c551de10a899021208e924565196312d627ac18aea7588ee3aa7cde2","README.md":"a43a3bc011de5ec7ec275e382fe71f6b71949b5fc9afc944034cda8a46c642f4","skills/issues/SKILL.md":"549e7f2450e63a1c7d39c56fc11eabe249ca60252d7c875bc15fa4fc35423118","skills/pr-comments/SKILL.md":"270ff28a67c252db5de9fbfceae5caa0ab41e5d6b869b9a99c1fb4bc3959553c","skills/pr-comments/reference.md":"af15ec82e2e9852ceae150a0134a8db1a4de47ad6bfc1074bd136ac4c2d00a9a","skills/scan/SKILL.md":"ba898de64eb400fad63875503bb0be54ffef2c7a4ed7e3910e9528d60313d72a","skills/scan/reference.md":"dbece5939f348089656547c6d5e8dc25d3374c9752ba26c719f390bf4819f586","skills/setup/SKILL.md":"199d45889512f571d3e2b38bf1d81aeebe23de2aedd62fb53aec536914daaa15"}
lockfiles: ["LOCK.json"]
utc date: 2026-10-17T12:23:59Z
source date: 2026-10-16
discovered date: 2026-10-16
retested date: 2026-10-17
reviewed date: 2026-10-17
published date: 2026-10-17
modified date: 2026-10-17
reviewer: Machine-checked
harness version: toolwitness harness at commit 5a286f05b93bfbf27b15f403e41e3a1525edc32f
claude code version: Not applicable: static source inspection (commands.json).
model id: Not applicable: static source inspection (commands.json).
scanner version: Not applicable: static source inspection.
rulepack version: Not applicable: static source inspection.
agents: []
commands: ["Ran 15 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."]
prompt list: ["Not applicable: static source inspection (commands.json)."]
history: ["2026-10-17T12:23:59Z: pinned source inspection"]
application: {"applicationCategory":"DeveloperApplication","name":"aikido — 4 skills","operatingSystem":"Not exercised","softwareVersion":"8fdc995a44102a30ad54164e0bdd249d158c725c"}
review input: {"claims":[{"field":"summary","id":"acquired","sources":["LOCK.json","listing.json","commands.json"],"text":"Pinned source declarations and file hashes were listed."},{"field":"outcome","id":"listed","sources":["LOCK.json","listing.json","commands.json"],"text":"Listed 4 skill declarations. Ran 15 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."},{"field":"rule_results.0","id":"tree","sources":["LOCK.json","listing.json","commands.json"],"text":"The retained source tree matches its acquisition manifest."},{"field":"rule_results.1","id":"declared","sources":["LOCK.json","listing.json","commands.json"],"text":"Declared skill names (listing.json): aikido-issues; pr-comments; scan; setup"}],"evidence_sha256":{"LOCK.json":"a0cf8447c4d8d4b9d0b91508472a6ee62806431138dd8567874a7d4f94ee8cce","commands.json":"11b7a2bed27bfd0bd0cd21c18384fb9c0e77a05e3a2290172e4c1b7b39739e42","complete.json":"91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f","identity.json":"b44818d374da7ccbc31647ba97c545ecac6f05bee8cd7cacdfe85f1a2f7ce5e6","listing.json":"aa3b22da3fe25590091caf7293d360adc9ecd21b98364bf199502a38ae983b1e","selection.json":"0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"},"identity_artifact":"identity.json"}
review: {"codex":"745eb95af39700477a3a7ad459137f3708186ed6f715ac414034b56144df1eff","date":"2026-10-17","gates":"15d04b6c4e8e5455078c1d32aec871085b0edebfb181ca33b5dad3e88441d883","grok":"6b3fe4c55628bea7ba14e39141959db1699eeee5de2c71bfcd7f59375e540421","kind":"machine-checked","reviewed_sha256":"159cac8a7714ba38ddee21f13adaf79460877b5e7a7bfb131788faba235a24f7","summary":"Deterministic gates passed; Codex confirmed all outcome claims; Grok reported no standing refutation."}

Downloadable evidence

transcript

Download complete transcript

Ran 15 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

sinkhole log

Download complete sinkhole log

Not applicable: static source inspection (commands.json).

canary log

Download complete canary log

Not applicable: static source inspection (commands.json).

scanner output

Download complete scanner output

Not applicable: static source inspection (commands.json).

normalized text

Download complete normalized text

{
  "listing": {
    "skills": [
      {
        "path": "skills/issues/SKILL.md",
        "name": "aikido-issues",
        "description": "List, count, summarize, or triage security issues from the Aikido security feed. Use when the user asks about Aikido findings, vulnerabilities, leaked secrets, SAST/IaC/SCA results, cloud or container security issues, or EOL/license/malware alerts surfaced by Aikido.",
        "files": {
          "skills/issues/SKILL.md": "549e7f2450e63a1c7d39c56fc11eabe249ca60252d7c875bc15fa4fc35423118"
        }
      },
      {
        "path": "skills/pr-comments/SKILL.md",
        "name": "pr-comments",
        "description": "Fetches comments already posted on a GitHub/GitLab/Azure DevOps pull or merge request (e.g. CI bot results, review feedback, Aikido's own scan-result comment). Use when the user asks what CI/CD said, wants to read/check/summarize PR or MR comments, mentions \"pipeline comments\", or asks about \"Aikido comments\"/\"Aikido feedback\"/what Aikido said or found on a PR — this reads via the native SCM CLI (gh/glab/az), not the Aikido MCP server.",
        "files": {
          "skills/pr-comments/SKILL.md": "270ff28a67c252db5de9fbfceae5caa0ab41e5d6b869b9a99c1fb4bc3959553c",
          "skills/pr-comments/reference.md": "af15ec82e2e9852ceae150a0134a8db1a4de47ad6bfc1074bd136ac4c2d00a9a"
        }
      },
      {
        "path": "skills/scan/SKILL.md",
        "name": "scan",
        "description": "Runs an Aikido security scan on generated, added, or modified code files to detect SAST vulnerabilities and exposed secrets. Use when the user wants to scan code for security issues, after writing or modifying code, or when they mention Aikido, security scan, or SAST. Always run an Aikido scan after generating code to verify the generated code is free of security issues.",
        "files": {
          "skills/scan/SKILL.md": "ba898de64eb400fad63875503bb0be54ffef2c7a4ed7e3910e9528d60313d72a",
          "skills/scan/reference.md": "

Excerpt shown; complete evidence is in the download.

Download full record JSON

Disclaimer

This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.

Template placeholders refer to the snapshot metadata above.

Page updated 2026-10-17