snyk-agent-scan-compliance

Rewrite imperative sentences where the agent acts on a URL into passive or factual statements, such as changing 'Check the changelog' to 'The changelog documents breaking changes.' Remove 'always' modifiers and move tool invocations from checklists into code blocks.

Move the install command out of the body into the metadata.openclaw.install frontmatter block with kind, package, and bins fields, since the scanner does not flag frontmatter. Pinning a version in prose is not the canonical fix.

Explicit MCP tool function names like resolve-library-id or mcp__* in body prose are treated as a prompt injection vector. Use generic formulations such as 'Context7 can help as a discoverability platform' and keep tool names only in the allowed-tools frontmatter.

No, it only covers the snyk-agent-scan skill file scanner. Dependency vulnerabilities, SAST code findings, container issues, and infrastructure misconfigurations from other Snyk CLI tools are explicitly out of scope.

Fix W001 first since it is simplest, then W011, then W012, re-running the scanner after each change. W011 restructuring can surface hidden W012 alerts when URLs become more prominent in prose.

No, pipe-to-shell patterns like curl ... | sh must be removed entirely from skill bodies regardless of formatting. Use a package manager install path or the frontmatter install block instead.