stale reports whether the source's cached payload is missing or older than its TTL as of now.

syncCVSSScore keeps cvss_score in lock-step with cvss_vector. The vector is the canonical input (analyst form, disclose skill), the score is a pure fu

syncCVSSv4Score is the v4 twin of syncCVSSScore. CVSS v4 changes the metric set and the base-score formula, so it lives in its own vector/score column

teardownHardenedScan runs at the end of a hardened scan: it forwards the egress proxy sidecar's noteworthy logs (allowlist denials, failures) into the

unsatisfiedPrereqs classifies declared prereqs against the repository's scan history. A name lands in pending when it has at least one in-flight scan

upsertFindingReferences inserts any reference URLs not already on the finding. Used in the dedup branch so a re-observed finding picks up new or migra

validEmail is a pragmatic filter. Anything without an @ or containing "noreply" gets dropped.

validateFindingField rejects values that must follow a fixed format before they reach the column. Most fields are free text and pass through untouched

validateFlags runs the value-validators shared with the YAML config so an invalid --clone / --runtime / --selinux fails the same way whether it came f

validateMetadata checks the scrutineer.* keys strictly. agentskills.io spec violations stay as warnings (see validate); scrutineer-specific keys are a

verifyHostProxyReachable runs probe (b) for the host-proxy path: a throwaway container on the --internal network, wiring the gateway alias exactly as

verifyProxySidecarReachable runs probe (b) for the sidecar path: a throwaway container on the --internal network must reach the egress proxy sidecar a

walkMarkerPresent searches for a file named filepath.Base(m.Path) anywhere under filepath.Dir(m.Path) (relative to srcDir), bounded by markerWalkMaxDe

workbenchSeed returns the report to seed the editor with when the operator has not saved an override yet. Only a root-scoped threat-model scan qualifi

writeFindingReportHeader mirrors the scan report's header (writeScanReportHeader) so a finding-scoped report opens the same way: a title line, the sou

writeReportSummary emits a five-line block a maintainer can read in thirty seconds: severity counts, top findings, sink coverage, where to start, and

writeSSEEvent emits one SSE event per the spec. Embedded newlines in data are expressed as multiple `data:` lines so the browser's EventSource parser

writeScanReportFreeform renders a scan's report.json as the best markdown the shape allows: top-level scalar keys become a metadata table, top-level a

CWECategoryID returns the View-1400 category CWE-ID for a given weakness CWE-ID (e.g. "CWE-352" -> "CWE-1411"). Returns "" when the weakness is unknow

CategoryLabel formats a View-1400 category label with its CWE-ID prefix, e.g. "Injection" becomes "CWE-1409 — Injection". The pseudo-category Uncatego

FirstIfaceIPv4 returns the IPv4 of the sidecar's first up, non-loopback interface. The sidecar always runs in a Linux container (rootless podman is th

RunSkill runs claude against a staged skill in a local workspace. The workspace layout is: {DataDir}/scan-{id}/src/ clone (read-only

SkillDir is fixed at claude's discovery path: the no-container fallback is claude-only by design.

Summary gives a one-paragraph digest of the finding: first paragraph of Trace when present, else the Title. Kept as a method so templates can treat it

TestAPIFindingChildCollections covers the POST-then-GET round trip for the three sibling child collections (notes, communications, references). They s

The 422 paths differ per collection (notes reject empty body, references reject empty url, communications accept anything), so they get their own targ