42crunch-api-security-testing — 5 skills

Pinned source listing — machine-checked

What declarations and files are present in this pinned source?

Pinned source declarations and file hashes were listed.

Review

Machine-checked · 2026-10-17

Run UTC: 2026-10-17T11:02:31Z
Reviewed: 2026-10-17
Published: 2026-10-17
Updated: 2026-10-17

Observations · Limitations · Evidence

What we ran

Git blob acquisition followed by static source inspection.

What we saw

Listed 5 skill declarations. Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

Limits

Scope: acquisition and static inspection. Command results: commands.json.

developer-tools · skills · Upstream source · Upstream documentation

Pinned source inspection only; no runtime platform was exercised. UTC 2026-10-17T11:02:31Z, tree faa6f2645b55df9ac9772a6dfd7942b560c5f379a0a4eb786678fd692c43de24.

No browser or computer-use tools. Pin this exact version; the stamp does not follow updates.

Full record

name: 42crunch-api-security-testing — 5 skills
slug: source-skills-70101be1146d1f99d01410c8
type: skills
category: developer-tools
example: false
evidence state: pinned_source_listing
stamp: Pinned source listing — machine-checked
summary: Pinned source declarations and file hashes were listed.
outcome: Listed 5 skill declarations. Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.
rule results: ["The retained source tree matches its acquisition manifest.","Declared skill names (listing.json): 42crunch-api-security-testing; 42crunch-audit; 42crunch-scan; 42crunch-setup; code-to-oas"]
task: What declarations and files are present in this pinned source?
setup: Git blob acquisition followed by static source inspection.
limitations: Scope: acquisition and static inspection. Command results: commands.json.
source url: https://github.com/42Crunch-AI/claude-plugins.git
documentation url: https://github.com/42Crunch-AI/claude-plugins.git
commit: faf5305385de8afed9468904e8639be737aff39e
tree sha256: faa6f2645b55df9ac9772a6dfd7942b560c5f379a0a4eb786678fd692c43de24
file sha256: {".claude-plugin/marketplace.json":"84c797029ddc0d1712baae85b007597e8c9756be6e8c1f22a3d00c5afce15db2","README.md":"4a8970ff9a006c5fb519f1be081b85ec29ec477130bf063508e4aa26ac5667d8","plugins/api-security-testing/.claude-plugin/plugin.json":"7529acee7d2239f68b2945de98b94b328e84d5bcf44fe2bb85eb910c76c32020","plugins/api-security-testing/LICENSE":"95632db32748eadf2acaf1ae235b6df6080c6b21b3e1f07e8c4ad3f01f70d632","plugins/api-security-testing/README.md":"c6ea69ede7d475adbef66f2a865c0bc6f46eb03a1118b3b5aea57971fadb62ef","plugins/api-security-testing/references/audit-rule-translations.md":"39a49b88e7c087a1dde2f0988e25df09c2abe370df2bac681d6b162cfb9e60aa","plugins/api-security-testing/references/audit-workflow.md":"85ff1cff5957a261e7d8777231554a47c45cfa9e10f05130e5f970ba8614bebb","plugins/api-security-testing/references/binary-setup.md":"f687ef8f39c3ccc8ffa5ae5abad3f9e76904f7a8233d1b2598d66be93e339784","plugins/api-security-testing/references/credential-setup.md":"3f901ebee3437b21aac0339c8b7fda0664b8c1e2a7f19775ed0e814652a0dc61","plugins/api-security-testing/references/pre-flight.md":"6222cf067ada86b4fd05b7e7802c9c89a5a8b991b1f6d5c44dc4ec9a8f26c6bd","plugins/api-security-testing/references/scan-workflow.md":"791dab618f3e6a68550c7cdce041f1ee7c2d0d2e85bc770147102a9a8766716a","plugins/api-security-testing/references/tag-detection.md":"4affb1c8b1368984569d163369c2f7177d0c46f814e9a07e7d8e2c4788bf7bf0","plugins/api-security-testing/skills/42crunch-api-security-testing/SKILL.md":"5453f765f5e92b368fe4e06ffa60eef84d808517821f277bca1fb472079aa229","plugins/api-security-testing/skills/42crunch-audit/SKILL.md":"63ab241317b5e7e464aba3bad0d62ffa1c52ad76d4abed69c42741aa6f2a16e1","plugins/api-security-testing/skills/42crunch-scan/SKILL.md":"21dbacbcac9bed5f4abd71311721f3794c1318f5a41bc0d8e8bc8953f99cbaac","plugins/api-security-testing/skills/42crunch-setup/SKILL.md":"849589b1b5098e157051a3940389b9c891aa7d4c9ec77907d857399c68f0b6b9","plugins/api-security-testing/skills/code-to-oas/SKILL.md":"7d25b8329e1d5b489606c6c9dca2fd20a09d23c6fd65dee3436698d5b906244a"}
lockfiles: ["LOCK.json"]
utc date: 2026-10-17T11:02:31Z
source date: 2026-10-16
discovered date: 2026-10-16
retested date: 2026-10-17
reviewed date: 2026-10-17
published date: 2026-10-17
modified date: 2026-10-17
reviewer: Machine-checked
harness version: toolwitness harness at commit 4795a352bbc24419d7d6389f3d607fd938a08916
claude code version: Not applicable: static source inspection (commands.json).
model id: Not applicable: static source inspection (commands.json).
scanner version: Not applicable: static source inspection.
rulepack version: Not applicable: static source inspection.
agents: []
commands: ["Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."]
prompt list: ["Not applicable: static source inspection (commands.json)."]
history: ["2026-10-17T11:02:31Z: pinned source inspection"]
application: {"applicationCategory":"DeveloperApplication","name":"42crunch-api-security-testing — 5 skills","operatingSystem":"Not exercised","softwareVersion":"faf5305385de8afed9468904e8639be737aff39e"}
review input: {"claims":[{"field":"summary","id":"acquired","sources":["LOCK.json","listing.json","commands.json"],"text":"Pinned source declarations and file hashes were listed."},{"field":"outcome","id":"listed","sources":["LOCK.json","listing.json","commands.json"],"text":"Listed 5 skill declarations. Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."},{"field":"rule_results.0","id":"tree","sources":["LOCK.json","listing.json","commands.json"],"text":"The retained source tree matches its acquisition manifest."},{"field":"rule_results.1","id":"declared","sources":["LOCK.json","listing.json","commands.json"],"text":"Declared skill names (listing.json): 42crunch-api-security-testing; 42crunch-audit; 42crunch-scan; 42crunch-setup; code-to-oas"}],"evidence_sha256":{"LOCK.json":"2db60ed9bbd39483e987a2b0a81c6e14df1d4b3616ce97199693c87c283427d5","commands.json":"30c1b45bb476369fd52aaa8389f59bf653f71c0fab1d3d14049fead21b26fa6e","complete.json":"91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f","identity.json":"7fe3f9055cc635c9a1a1b2430217ea765b87d6f35792c2ff51876b1261a7d6e8","listing.json":"e96fbcd6593ac7c6f354bfebaaea962a564c5d14ee539d5b7a58b078e58d6812","selection.json":"0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"},"identity_artifact":"identity.json"}
review: {"codex":"dc0714d22090662a0ac904833af1aaa1a77c5802c4011943e76fce6c43e8b723","date":"2026-10-17","gates":"285b8997ba5e86b8142fb8f13bf301683981d807a302d8abc3fff1c9a5289a22","grok":"bce0559aeec15b0908ec3091ec4f7cdcb7ac972136d7b3c7d9e541e8861c8b75","kind":"machine-checked","reviewed_sha256":"2c259683c3f90f3710d21af641080569cb01a043e197758a17e70426089ac59f","summary":"Deterministic gates passed; Codex confirmed all outcome claims; Grok reported no standing refutation."}

Downloadable evidence

transcript

Download complete transcript

Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

sinkhole log

Download complete sinkhole log

Not applicable: static source inspection (commands.json).

canary log

Download complete canary log

Not applicable: static source inspection (commands.json).

scanner output

Download complete scanner output

Not applicable: static source inspection (commands.json).

normalized text

Download complete normalized text

{
  "listing": {
    "skills": [
      {
        "path": "plugins/api-security-testing/skills/42crunch-api-security-testing/SKILL.md",
        "name": "42crunch-api-security-testing",
        "description": "Run both a 42Crunch Audit and a live Scan together in a single pipeline. Use this skill when the user wants to run audit and scan together, complete the full security pipeline, or when the request is ambiguous about which phase to run. Triggers on phrases like \"run audit and scan\", \"full 42crunch pipeline\", \"full security check\", \"audit then scan\", \"42crunch\", or \"SQG\". Do NOT use this skill if the user explicitly requests only an audit (use 42crunch-audit) or only a scan (use 42crunch-scan).\n",
        "files": {
          "plugins/api-security-testing/skills/42crunch-api-security-testing/SKILL.md": "5453f765f5e92b368fe4e06ffa60eef84d808517821f277bca1fb472079aa229"
        }
      },
      {
        "path": "plugins/api-security-testing/skills/42crunch-audit/SKILL.md",
        "name": "42crunch-audit",
        "description": "Run a 42Crunch API Security Audit and fix SQG-blocking issues in an OpenAPI Specification file. Use this skill whenever the user wants to audit an OAS file for security issues, fix SQG-blocking issues, score an API, apply data dictionary enrichment, or remediate audit findings. Triggers on phrases like \"run audit\", \"audit only\", \"fix audit issues\", \"SQG audit\", \"42crunch audit\", \"audit score\", or any request focused on static OAS analysis and remediation without running a live scan.\n",
        "files": {
          "plugins/api-security-testing/skills/42crunch-audit/SKILL.md": "63ab241317b5e7e464aba3bad0d62ffa1c52ad76d4abed69c42741aa6f2a16e1"
        }
      },
      {
        "path": "plugins/api-security-testing/skills/42crunch-scan/SKILL.md",
        "name": "42crunch-scan",
        "description": "Run a 42Crunch live conformance and authorization scan against an API and fix SQG-blocking scan findings. Use this

Excerpt shown; complete evidence is in the download.

Download full record JSON

Disclaimer

This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.

Template placeholders refer to the snapshot metadata above.

Page updated 2026-10-17