ci: baseline one skillspector false positive - #80
Merged
Conversation
`oss-harden` cites GitLab's personal access tokens page as the source for the `read_api` and `api` scopes an audit run needs. Skillspector reads the page title as credential access and reports PE3 at HIGH, which carries the score from 34 to 52 and fails the scan. The suppression is a glob rule scoped to that rule, that file, and that phrase. A fingerprint would hash the line span and expire on the next edit to the file, returning the finding with nobody having re-read it. Every other finding still scores, so a new one still fails the build.
svyatov
force-pushed
the
ci/skillspector-baseline
branch
from
August 11, 2026 16:02
b2ff52f to
519ea2a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
.skillspector-baseline.yamlholds one suppression, and the scan in CI and in theCONTRIBUTING.mdcheck sequence passes--baselineto read it.Why this way
oss-hardencites GitLab's personal access tokens page as the source for theread_apiandapiscopes an audit run needs. Skillspector matches the phrase in the link title, reports PE3 Credential Access at HIGH with confidence 0.7, and the score moves from 34 MEDIUM to 52 HIGH, which exits 1. The skill reads no credential file. Rewording the citation would clear the scan by misnaming the source the claim rests on, so the suppression is the honest fix.The entry is a glob rule scoped to that rule id, that file, and that phrase, not a fingerprint. A fingerprint hashes the line span and the message, so it expires on the next edit to the file and returns the finding with nobody having re-read it. Its
reasonsays what would make the suppression wrong:oss-hardentelling a reader to read a token from disk.Baselining every current finding was the alternative. It was rejected because it would suppress all 18 findings scoring today, including two untriaged HIGH ones in
oss-skill/references/hosts.md.Verification
bun testat 327 pass andskills/oss-writing/scripts/prose.mjsclean on the files touched. The suppression itself is not verified here. The finding it suppresses comes from #78, which is not in this branch, so this branch scores 34 with or without the rule. Re-running #78 against this baseline is the first run that tests it.Known gaps
The 18 findings that score today are untriaged, and two of them are HIGH. This change leaves every one of them scoring exactly as it does now.
Affects