AG-SKILL-MANIFEST-GAP: Undeclared Capabilities (Capability Disclosure Report)

What this rule means

A skill uses capabilities in its bundled scripts that are not declared in the `allowed-tools` or `compatibility` frontmatter.

Why it matters

Skills claiming to only 'read local files' that actually open network sockets are hiding their behavior from security teams.

How to fix it

Ensure the SKILL.md frontmatter lists all required capabilities.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-SKILL-MANIFEST-GAP          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules