Function scanSkillMetadata

layers/foundation-scan.ts:554–581

(
  skill: Skill,
  llmContext: LlmCallContext,
  logger?: LoggerLike,
)

}

async function scanSkillMetadata(
  skill: Skill,
  llmContext: LlmCallContext,
  logger?: LoggerLike,
): Promise<{ metadataSummary: string; warning: Warning | null }> {
  const metadataDetection = await detectSkillMetadataRisk(skill, llmContext, logger);
  if (!metadataDetection) {
    return { metadataSummary: "", warning: null };
  }

  if (metadataDetection.metadataRisk) {
    logger?.warn(`[FoundationScan] metadata blocked: skill=${skill.name ?? "(unknown)"}, reason=${metadataDetection.reason || "metadata judged as risky"}`);
    return {
      metadataSummary: "",
      warning: createMaliciousWarning(
        `[METADATA ANALYSIS] Skill '${skill.name}' contains malicious intent in its definition.\n` +
        `📋 Skill File: ${skill.filePath}\n` +
        `⚠️  Detection Type: Metadata Risk (Semantic Analysis)\n` +
        `🔍 Specific Reason: ${metadataDetection.reason || "Unspecified malicious intent detected in skill metadata"}\n` +
        `💡 Impact: This skill's definition suggests it may attempt to bypass security controls or perform unauthorized actions.`
      ),
    };
  }

  const metadataSummary = metadataDetection.capabilitySummary || "";
  logger?.info(`[FoundationScan] metadata summary generated: skill=${skill.name ?? "(unknown)"}, summaryLength=${metadataSummary.length}`);
  return { metadataSummary, warning: null };
}

async function scanSkillFile(
  skill: Skill,