Quoted version metadata creates a false missing-file reference and changes score 0 from SAFE to CAUTION
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 74/100
Research direction
Start by creating the described version-reference-fixture/SKILL.md and running the provided skillspector scan command, then inspect how YAML frontmatter values enter reference_resolution. The change is done when metadata.version: "1.2" is not recorded as reference_unresolved, while score, findings, recommendation, and analysis completeness remain unchanged; repeat the comparison without the metadata.
Written by the indexing model from the issue text.
Description
SkillSpector 2.11.2 treats metadata.version: "1.2" in SKILL.md frontmatter as a missing local-file reference. This marks an otherwise complete, harmless scan as partial and changes its recommendation to CAUTION despite score 0 and zero findings.
Reproduction needs no API credentials:
---
name: greeting
description: Write a friendly greeting.
metadata:
version: "1.2"
---
# Greeting
Write a friendly greeting for the user.
Save that as version-reference-fixture/SKILL.md, then run:
skillspector scan ./version-reference-fixture --no-llm --format json --output report.json
Repeat after removing just the metadata and version lines.
| Input | Score | Findings | Recommendation | Complete |
|---|---|---|---|---|
| No version metadata | 0 | 0 | SAFE | true |
metadata.version: "1.2" |
0 | 0 | CAUTION | false |
Both runs finish successfully with 100% component coverage. The failing variant has exactly one ledger exception: reference_resolution / reference_unresolved at SKILL.md:5. Its analysis_completeness.references entry is:
{
"source_path": "SKILL.md",
"line": 5,
"column": 13,
"evidence": "version: \"1.2\"",
"target_path": null,
"status": "missing",
"disposition": "partial"
}
Expected: quoted version metadata should not be classified as a local-file dependency. The risk score and findings should remain unchanged, and this metadata alone should not make analysis partial.
This also occurs in the API Gateway skill on ClawHub. That larger skill has additional completeness exceptions, so this reproduction isolates the metadata bug rather than claiming it is the only cause of its CAUTION result.
Related: #510 concerns output-file references, and #450 / #451 concern slash-separated prose. This case is a quoted version value in YAML frontmatter.
- Dominant language
- Python
- Stars
- 17.9k
- Forks
- 1.5k
- Avg merge
- 4d 18h
- Merged PRs (30d)
- 63
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from NVIDIA/SkillSpector
-
Difficulty 2/5 Half a day Newbie friendliness 84/100
NVIDIA/SkillSpector#592 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
NVIDIA/SkillSpector#587 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
NVIDIA/SkillSpector#485 · 3 comments ·
-
Difficulty 2/5 Half a day Newbie friendliness 78/100
NVIDIA/SkillSpector#482 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
NVIDIA/SkillSpector#444 · 1 comment ·
All issues in NVIDIA/SkillSpector
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100