explain-report

Explain SkillGuard Report

Reads a SkillGuard JSON report and explains each finding in context, helping users understand what the risks actually mean and which findings need attention vs which are false positives.

Usage

1. First generate a JSON report:

   npx skillguard <target> --json report.json
   

2. Then ask to explain the report — read report.json and analyze each finding.

How to Analyze

For each finding, evaluate:

1. Context — Is this pattern in actual executable code, or in documentation/comments?
2. Intent — Is the pattern used for a legitimate purpose (e.g., eval() in a build tool)?
3. Scope — Is the finding isolated or part of a broader pattern (e.g., multiple exfiltration signals)?
4. Severity — Does the assigned severity match the actual risk given the context?

Common False Positives

• eval() in documentation explaining what NOT to do
• API key patterns in .env.example with placeholder values
• rm -rf in cleanup scripts with proper path validation
• sudo in installation instructions (README)
• shell=True with hardcoded safe commands (no user input)

Red Flags That Need Attention

• Combined signals: env var reading + outbound HTTP in same skill
• dangerouslyDisableSandbox — almost always a real risk
• Base64-encoded strings in markdown files (possible payload hiding)
• Missing allowed-tools with shell access patterns in code

Output Format

For each finding group by dimension, explain:

• What was detected and why it matters
• Whether it's likely a real risk or false positive
• What action (if any) the user should take