> For the complete documentation index, see [llms.txt](https://docs.skillplus.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.skillplus.xyz/reports-ratings-ai-audit.md).
# Reports, Ratings, and AI Audit
SkillPlus reports are designed to make AI skill risk understandable.
A good report should not only say that something looks suspicious. It should explain what was found, where the evidence is, whether independent review confirmed it, what the supply chain looks like, and what to do about it.
## Report anatomy
A SkillPlus report page is organized top-down, most decisive signal first:
```mermaid
%%{init: {'flowchart': {'wrappingWidth': 420, 'nodeSpacing': 24, 'rankSpacing': 70}}}%%
flowchart LR
A[SkillPlus Report]
A --> B[Header
skill identity · content hash · rating badge]
A --> C[Summary tiles
issue counts by severity · files · audit time]
A --> D[Supply Chain
dependency & endpoint counts · confirmed-malicious links
poisoned versions named · red when hit]
A --> E[AI Security Audit
executive summary · risk level · 8 categories · recommendations]
A --> F[Agent Analysis
5 agents · severity lights · findings with evidence]
A --> G[Traditional Rule Analysis
deterministic checks by category]
```
### Summary tiles
When the AI audit has completed, the tiles reflect the **AI verdict**: total failed categories, split by severity (critical/high, medium, low), plus files scanned and AI audit time. Before AI completion they reflect the rule layer.
### Supply Chain section
Shows the extracted dependency and endpoint counts, and — most importantly — any **confirmed-malicious links**: the package coordinate, match strength (*affected* vs. *possibly affected* for unpinned dependencies), the exact poisoned versions, the advisory ID, and a reference link. The whole section renders red the moment there is a hit.
### AI Security Audit
The Lead Auditor's integrated verdict:
* an executive summary written as an independent assessment
* the AI risk level
* eight fixed categories, each pass/fail with severity, description, and `file:line` evidence
* **Recommendations** — concrete remediation steps tied to the findings (e.g. *"Pin litellm to a known-safe version instead of installing unpinned"*). When a dependency is confirmed compromised, a recommendation naming that package is guaranteed by code, not model goodwill.
### Agent Analysis
The multi-agent breakdown: Structure & Capability, Supply Chain, Network & Egress, Behavior & MCP, and Synthesis (Lead Auditor). Each row carries a severity indicator light driven by the worst non-refuted finding — red for critical/high, amber for medium, green for clean — with a count breakdown visible without expanding. Findings that were refuted during adversarial verification stay visible but marked *downgraded after adversarial review*.
### Traditional Rule Analysis
The deterministic layer's results, grouped by check category. When the AI audit judged a rule finding to be a false positive (for example a documentation link flagged as an external script), that correction is applied and explained.
## Ratings
SkillPlus summarizes risk with a single calibrated verdict. There are exactly **three** of them:
| Rating | Meaning | Typical decision |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------- |
| **Safe** | No meaningful risk; capabilities match stated purpose. Low-severity notes and ecosystem-normal patterns may be listed as context — they do not change the verdict. | Reasonable to use, with normal caution. |
| **Caution** | A concrete concern worth reviewing | Inspect findings and decide in context. |
| **High Risk** | Serious risk — including any confirmed-compromised dependency | Avoid, or remediate before approval. |
Content that is not a valid skill (no `SKILL.md`) is shown as **Unrated** rather than given a verdict.
These three verdict words never overlap with the finding-severity words below, so a label is never ambiguous. Internally the analysis distinguishes finer finding severities, but they always fold into the verdict: low-severity findings fold into **Safe**, critical folds into **High Risk**. You will never see a fourth verdict on a badge, list, or report header.
Individual findings (inside a report) carry their own severity on a separate scale — **Critical · High · Medium · Low** — plus **Pass** for a check that passed or a rule finding the AI audit dismissed. Traditional rule severities map onto it (danger → High, warning → Medium, info → Low).
Ratings are decision-support signals based on the scanned content and current threat intelligence — and they are **live**: a rating can change when new intelligence lands, even if the skill itself never changed.
## How the effective rating is decided
```mermaid
flowchart TD
A{Admin whitelist entry?} -- yes --> W[Safe]
A -- no --> B{Active supply-chain
blacklist hit?}
B -- yes --> H[High — forced, code-enforced]
B -- no --> C{AI audit completed?}
C -- yes --> D[AI risk level
critical→high · medium→medium · low/safe→safe]
C -- no --> E[Rule-layer rating]
```
The same precedence is applied on every surface — report page, badge, homepage list, and search — so no surface ever contradicts another.
## Severity calibration: score behavior, not capability
A report full of inflated warnings trains users to ignore it. SkillPlus agents follow an explicit calibration contract:
* Severity **medium or higher requires a concrete threat path** — which input, which action, what effect. "Could theoretically" is not a finding.
* **Ecosystem-normal patterns are context**, reported at low severity: invoking a well-known CLI via `npx` without a pinned version, installing a package the user explicitly asked for, `-y` flags in agent-run commands (agents have no interactive terminal), documentation links, and gaps that belong to the ecosystem rather than the skill.
* The calibration **never** applies to known-compromised packages, purpose-anomalous patterns (typosquat-like names, piping remote scripts to a shell, obfuscated payloads), or content that manipulates the agent itself.
The payoff is contrast: when a SkillPlus report says **High**, it means something.
## Guarantees behind the verdict
The displayed verdict is protected by code-enforced invariants, independent of any model output:
1. High/critical specialist findings are never dropped by synthesis.
2. Adversarially refuted findings are downgraded, never deleted.
3. A confirmed poisoned dependency forces the risk level to at least **High** and forces a remediation step naming the package.
4. The risk level is floored to the worst confirmed finding.
5. If the AI stage fails entirely, a conservative fallback is built from the specialists — a broken pipeline can never produce a false "safe".
6. If the model **declines to analyze** the material — which happens with offensive-security and pentesting skills, where content policies block the analysis — its opinion is discarded rather than counted as "nothing found". The rule engine and supply-chain verdict stand on their own, so such a skill still reads High Risk with its findings visible.
## Badges and sharing
Reports can be shared directly, and badges can be embedded in projects or marketplaces:
```md
```
[](https://skillplus.xyz/report/f17faaf8-239c-47fc-ab95-0d4bf5fc94ab)
Every report page carries a share card that previews the badge and copies the Markdown, HTML, or URL in one click:
The badge is computed by the same pipeline as the report — including supply-chain overrides and whitelist decisions — so it never claims "safe" for a skill whose report shows a poisoned dependency.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.skillplus.xyz/reports-ratings-ai-audit.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.