[velzepooz]

Change

Pin the released detector v0.13.0 and update telemetry, user guidance, changelog, and release contract checks. SD-027 inventories command-valued nested bare Git config; it does not prove execution or exposure.

VerificationLocal README candidate and focused Bats tests pass. Full macOS Bats: 120/122; two known GNU grep/Bash-version host failures. Workspace make verify-clone passed. Release requires full PR CI across Linux/macOS/Windows before tagging v1.15.0. Linear: ST-131.

[github-actions]

SkillTrust — Clean — no findings

SkillTrust check passes — no findings.

If this check is required, failure blocks merging.

Comparison off; new, existing and fixed status is unknown.

Next: No finding remediation is needed in the scanned scope. Review the rest of the PR as usual.

Current findings (0)

None.

Grades for the current scan

Grades describe findings, not whether this check fails. The policy above determines the check result.

Axis	Grade
Security	A
Permission hygiene	A
Transparency	A

Scan details and scope

Run	Value
Scope	tests/fixtures/clean-repo
Checkout	Workflow checkout
Engine	skill-detector 0.13.0
Mode	Gate policy
Files scanned	1
Comparison	Off

Supported boundary

SkillTrust checks supported agent configuration files in the selected scope. A clean result means no supported rule matched; it is not a guarantee that the repository is safe.

Complete result

The validated, unmodified JSON is retained at the scan-json-path output. To retrieve it after the job, upload that path with actions/upload-artifact; see the Action docs.

---

SkillTrust Action docs · scan-action@v1 · Detector 0.13.0