sonatype-guide — 1 skill

Pinned source listing — machine-checked

What declarations and files are present in this pinned source?

Pinned source declarations and file hashes were listed.

Review

Machine-checked · 2026-10-19

Run UTC: 2026-10-19T18:07:27Z
Reviewed: 2026-10-19
Published: 2026-10-19
Updated: 2026-10-19

Observations · Limitations · Evidence

Works with:

Works with Claude Code

Works with Codex

Works with Gemini CLI

Works with Grok Build

What we ran

Git blob acquisition followed by static source inspection.

What we saw

Listed 1 skill declaration. Ran 10 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

Limits

Scope: acquisition and static inspection. Command results: commands.json.

developer-tools · skills · Upstream source · Upstream documentation

Pinned source inspection only; no runtime platform was exercised. UTC 2026-10-19T18:07:27Z, tree 1b3791c46004f15b237b9a74bc6e5d6d63e9243b47a216270357ba0e9f88ba5d.

No browser or computer-use tools. Pin this exact version; the stamp does not follow updates.

Full record

name: sonatype-guide — 1 skill
slug: source-skills-893518af006a7049d9e33a8e
type: skills
category: developer-tools
example: false
evidence state: pinned_source_listing
stamp: Pinned source listing — machine-checked
summary: Pinned source declarations and file hashes were listed.
outcome: Listed 1 skill declaration. Ran 10 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.
rule results: ["The retained source tree matches its acquisition manifest.","Declared skill names (listing.json): sonatype-guide"]
task: What declarations and files are present in this pinned source?
setup: Git blob acquisition followed by static source inspection.
limitations: Scope: acquisition and static inspection. Command results: commands.json.
source url: https://github.com/sonatype/sonatype-guide-claude-plugin.git
documentation url: https://github.com/sonatype/sonatype-guide-claude-plugin.git
commit: 1dae73980f591d3196f5532ac72186513563d028
tree sha256: 1b3791c46004f15b237b9a74bc6e5d6d63e9243b47a216270357ba0e9f88ba5d
file sha256: {".claude-plugin/plugin.json":"942bbd2a9e7c86f6fa01e432a7f45c2bf1a0ca270fa7b67c717b85a3fce744f1",".mcp.json":"af070da4a64a44e96f8c580de9d586744c63f17df86ddfd9b416bc8b6dd74b52","README.md":"553be73bd23bf189736b20585f565736a285963b5dfbd5036e563738328ef3ac","skills/sonatype-guide/SKILL.md":"941b3481e431086ce50c376870e033a35039def54d6fa4b0754600b304a46ece","skills/sonatype-guide/references/purl-ecosystems.md":"47df4896e848116c0a336a2835b68099539539fdf785f8efc517d78813c621d7"}
lockfiles: ["LOCK.json"]
utc date: 2026-10-19T18:07:27Z
source date: 2026-10-16
discovered date: 2026-10-16
retested date: 2026-10-19
reviewed date: 2026-10-19
published date: 2026-10-19
modified date: 2026-10-19
reviewer: Machine-checked
harness version: toolwitness harness at commit 11dde7217ae6f8e4ac4d18a6380b18ba01450122
claude code version: Not applicable: static source inspection (commands.json).
model id: Not applicable: static source inspection (commands.json).
scanner version: Not applicable: static source inspection.
rulepack version: Not applicable: static source inspection.
agents: []
commands: ["Ran 10 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."]
prompt list: ["Not applicable: static source inspection (commands.json)."]
history: ["2026-10-19T18:07:27Z: pinned source inspection"]
application: {"applicationCategory":"DeveloperApplication","name":"sonatype-guide — 1 skill","operatingSystem":"Not exercised","softwareVersion":"1dae73980f591d3196f5532ac72186513563d028"}
review input: {"claims":[{"field":"summary","id":"acquired","sources":["LOCK.json","listing.json","commands.json"],"text":"Pinned source declarations and file hashes were listed."},{"field":"outcome","id":"listed","sources":["LOCK.json","listing.json","commands.json"],"text":"Listed 1 skill declaration. Ran 10 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."},{"field":"rule_results.0","id":"tree","sources":["LOCK.json","listing.json","commands.json"],"text":"The retained source tree matches its acquisition manifest."},{"field":"rule_results.1","id":"declared","sources":["LOCK.json","listing.json","commands.json"],"text":"Declared skill names (listing.json): sonatype-guide"}],"evidence_sha256":{"LOCK.json":"34a10f475f75058f03c476a17bc9f649ea0846177094d096bc3b3c7d607c6fb7","commands.json":"2e223b478433ddb6afe4ac6cf00753236473920183d8de49c97703ef8165cc00","complete.json":"91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f","identity.json":"b3c39381dc59c2b9c8368af68d45dacf48e0347439f023b5e66a0ff2f7110b15","listing.json":"c5932d256c4f59e7bda60137f9effe20d6604781fc3881a86173c3bf0ede1fe5","selection.json":"0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"},"identity_artifact":"identity.json"}
review: {"codex":"81a98efa608f094b98e626fd9c430331b60971d30b918e46e1e58bd48e691946","date":"2026-10-19","gates":"21e99b34014325c17abd090ba11239c935fb4f6c88037f16b08bf8f0263ff248","grok":"170073721b133ac94441c41430e2706ed06172cfd705175a22d67d7190d3ef96","kind":"machine-checked","reviewed_sha256":"4e58167ef50a29f72d924e072eb66fd114be67b2f2f6530af5004d3fca5b2ceb","summary":"Deterministic gates passed; every claim rebuilt from evidence with a reviewed template; Grok reported no standing refutation."}

Downloadable evidence

transcript

Download complete transcript

Ran 10 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

sinkhole log

Download complete sinkhole log

Not applicable: static source inspection (commands.json).

canary log

Download complete canary log

Not applicable: static source inspection (commands.json).

scanner output

Download complete scanner output

Not applicable: static source inspection (commands.json).

normalized text

Download complete normalized text

{
  "listing": {
    "skills": [
      {
        "path": "skills/sonatype-guide/SKILL.md",
        "name": "sonatype-guide",
        "description": "MUST use before installing, adding, or upgrading any dependency. Trigger when: running pip install, npm install, cargo add, go get, or any package manager command; adding a package to requirements.txt, package.json, pyproject.toml, Cargo.toml, go.mod, pom.xml, build.gradle, or Gemfile; choosing which library to use for a task; upgrading or changing dependency versions; or auditing existing dependencies. Uses the Sonatype Guide MCP server to check vulnerabilities, Developer Trust Scores, license risks, malicious package detection, and policy compliance. Do not install or recommend a dependency without checking it here first.",
        "files": {
          "skills/sonatype-guide/SKILL.md": "941b3481e431086ce50c376870e033a35039def54d6fa4b0754600b304a46ece",
          "skills/sonatype-guide/references/purl-ecosystems.md": "47df4896e848116c0a336a2835b68099539539fdf785f8efc517d78813c621d7"
        }
      }
    ],
    "hooks": [],
    "executions": []
  }
}

Download full record JSON

Disclaimer

This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.

Template placeholders refer to the snapshot metadata above.

Page updated 2026-10-19