arize-instrumentation
github.com/github/awesome-copilot
Scanned Thu, 28 May 2026 17:18:29 GMT
Scan ID crawl-o1o4djuob9cn2bxu2vlh89bb · 4ms
B
SCORE 75 / 100
Verdict: Safe to install

3 medium findings.

This skill ships without a capability manifest plus 2 other issues listed below.

0 critical0 high3 medium9 rules passed

Why grade B?

score · 75 / 100

The current grade reflects 3 medium findings (3+ MEDs → B).

0 CRIT0 HIGH3 MED0 LOW
To reach a higher grade
  • A
    Reach Atarget score 95

    Resolve 1 of 3 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Findings · ordered by severity

med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
med
Link text shows "prompt.md" but points at arize.com
The visible link text contains the domain `prompt.md`, but the URL actually targets `arize.com`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.
rule: anchor-href-mismatchline: 98CWE-601
96- **Fallback:** [Manual instrumentation](https://arize.com/docs/ax/instrument/manual-instrumentation), [All integrations](https://arize.com/docs/ax/integrations).
97
98**Fetch the matched doc pages** from the [full routing table in PROMPT.md](https://arize.com/docs/PROMPT.md) for exact installation and code snippets. Use [llms.txt](https://arize.com/docs/llms.txt) as a fallback for doc discovery if needed.text→prompt.md · href→arize.com
99
100> **Note:** `arize.com/docs/PROMPT.md` and `arize.com/docs/llms.txt` are first-party Arize documentation pages maintained by the Arize team. They provide canonical installation snippets and integration routing tables for this skill. These are trusted, same-organization URLs — not third-party content.
med
Link text shows "llms.txt" but points at arize.com
The visible link text contains the domain `llms.txt`, but the URL actually targets `arize.com`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.
rule: anchor-href-mismatchline: 98CWE-601
96- **Fallback:** [Manual instrumentation](https://arize.com/docs/ax/instrument/manual-instrumentation), [All integrations](https://arize.com/docs/ax/integrations).
97
98**Fetch the matched doc pages** from the [full routing table in PROMPT.md](https://arize.com/docs/PROMPT.md) for exact installation and code snippets. Use [llms.txt](https://arize.com/docs/llms.txt) as a fallback for doc discovery if needed.text→llms.txt · href→arize.com
99
100> **Note:** `arize.com/docs/PROMPT.md` and `arize.com/docs/llms.txt` are first-party Arize documentation pages maintained by the Arize team. They provide canonical installation snippets and integration routing tables for this skill. These are trusted, same-organization URLs — not third-party content.
Scan another →Share
skillox.io/r/crawl-o1o4djuob9cn2bxu2vlh89bb