Quoted version metadata creates a false missing-file reference and changes score 0 from SAFE to CAUTION

Open Beginner friendly
#524 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
74/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
security

Research direction

Start by creating the described version-reference-fixture/SKILL.md and running the provided skillspector scan command, then inspect how YAML frontmatter values enter reference_resolution. The change is done when metadata.version: "1.2" is not recorded as reference_unresolved, while score, findings, recommendation, and analysis completeness remain unchanged; repeat the comparison without the metadata.

Written by the indexing model from the issue text.

Description

SkillSpector 2.11.2 treats metadata.version: "1.2" in SKILL.md frontmatter as a missing local-file reference. This marks an otherwise complete, harmless scan as partial and changes its recommendation to CAUTION despite score 0 and zero findings.

Reproduction needs no API credentials:

---
name: greeting
description: Write a friendly greeting.
metadata:
  version: "1.2"
---

# Greeting
Write a friendly greeting for the user.

Save that as version-reference-fixture/SKILL.md, then run:

skillspector scan ./version-reference-fixture --no-llm --format json --output report.json

Repeat after removing just the metadata and version lines.

Input Score Findings Recommendation Complete
No version metadata 0 0 SAFE true
metadata.version: "1.2" 0 0 CAUTION false

Both runs finish successfully with 100% component coverage. The failing variant has exactly one ledger exception: reference_resolution / reference_unresolved at SKILL.md:5. Its analysis_completeness.references entry is:

{
  "source_path": "SKILL.md",
  "line": 5,
  "column": 13,
  "evidence": "version: \"1.2\"",
  "target_path": null,
  "status": "missing",
  "disposition": "partial"
}

Expected: quoted version metadata should not be classified as a local-file dependency. The risk score and findings should remain unchanged, and this metadata alone should not make analysis partial.

This also occurs in the API Gateway skill on ClawHub. That larger skill has additional completeness exceptions, so this reproduction isolates the metadata bug rather than claiming it is the only cause of its CAUTION result.

Related: #510 concerns output-file references, and #450 / #451 concern slash-separated prose. This case is a quoted version value in YAML frontmatter.

Dominant language
Python
Stars
17.9k
Forks
1.5k
Avg merge
4d 18h
Merged PRs (30d)
63

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from NVIDIA/SkillSpector

All issues in NVIDIA/SkillSpector

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.