Quoted version metadata creates a false missing-file reference and changes score 0 from SAFE to CAUTION
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 17.9k
- Forks
- 1.5k
- Avg merge
- 5d 10h
- Merged PRs (30d)
- 66
Description
SkillSpector 2.11.2 treats metadata.version: "1.2" in SKILL.md frontmatter as a missing local-file reference. This marks an otherwise complete, harmless scan as partial and changes its recommendation to CAUTION despite score 0 and zero findings.
Reproduction needs no API credentials:
---
name: greeting
description: Write a friendly greeting.
metadata:
version: "1.2"
---
# Greeting
Write a friendly greeting for the user.
Save that as version-reference-fixture/SKILL.md, then run:
skillspector scan ./version-reference-fixture --no-llm --format json --output report.json
Repeat after removing just the metadata and version lines.
| Input | Score | Findings | Recommendation | Complete |
|---|---|---|---|---|
| No version metadata | 0 | 0 | SAFE | true |
metadata.version: "1.2" |
0 | 0 | CAUTION | false |
Both runs finish successfully with 100% component coverage. The failing variant has exactly one ledger exception: reference_resolution / reference_unresolved at SKILL.md:5. Its analysis_completeness.references entry is:
{
"source_path": "SKILL.md",
"line": 5,
"column": 13,
"evidence": "version: \"1.2\"",
"target_path": null,
"status": "missing",
"disposition": "partial"
}
Expected: quoted version metadata should not be classified as a local-file dependency. The risk score and findings should remain unchanged, and this metadata alone should not make analysis partial.
This also occurs in the API Gateway skill on ClawHub. That larger skill has additional completeness exceptions, so this reproduction isolates the metadata bug rather than claiming it is the only cause of its CAUTION result.
Related: #510 concerns output-file references, and #450 / #451 concern slash-separated prose. This case is a quoted version value in YAML frontmatter.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by creating the described version-reference-fixture/SKILL.md and running the provided skillspector scan command, then inspect how YAML frontmatter values enter reference_resolution. The change is done when metadata.version: "1.2" is not recorded as reference_unresolved, while score, findings, recommendation, and analysis completeness remain unchanged; repeat the comparison without the metadata.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 74/100