Evidence: northwind/sql-runner
31/100 · Medium risk
seed data Pre-batch sample. Verified maintainers re-score weekly.
- Pinned revision
- b7e91c02f4a3d5e6f708192a3b4c5d6e7f8091a2
- Analyzer
- v1 (static pass + bounded judge call)
- Scored
- 9/8/2026, 8:00:00 PM
- Freshness
- stale
Findings
| Rule | Severity | Line | Detail |
|---|---|---|---|
| shell-out | high | 118 | shell exec primitive |
| manifest-overbroad-env | medium | — | env reads sensitive-named vars: DATABASE_URL |
| oast-dns | info | — | no callback observed |
Rule definitions, severity weights, and grade bands: methodology.
Consent
This skill appears here because its maintainer opted in to public scoring. Consent proof: opt-in issue. Only opted-in skills get pages. Opt-out withdraws the badge within 1 hour.
Dispute this score
Disputes are handled by a person, not a form queue. Email opens a ticket with the four fields needed for review: skill, contact, contested findings, proposed correction.
- The badge is withdrawn within 1 hour of filing and stays down until the dispute resolves.
- We acknowledge every dispute within 24 hours.
- You get a resolution — a re-score or an upheld score with written rationale — within 5 business days.
We never debate scores in public threads and never publish a paid “untrusted” badge — suspension replaces shaming.