fix(examples): scan-dependencies curl example contains malformed JSON #410

Summary

The scan-dependencies skill's Step 2 instructs the reader to execute a curl POST, but its literal -d body is not valid JSON: nested request objects and the root object are not closed, and the body includes a literal .... Step 1 provides a valid complete payload, so this is a documentation defect in the displayed command, not evidence of an API service failure.

Runtime or environment

Verified from a fresh checkout of default branch main at 7bac2db56a63e32030d96651767a6d77d8b8324b. The repository publishes no GitHub releases or tags at the time of verification; this report concerns the repository example, not an installed scanner runtime. The local syntax check used Python 3.14.8 on Linux x86_64.

Steps to reproduce

From the repository root at the stated baseline, run this local-only check. It extracts the first JSON example as a control and the exact single-quoted curl body as the test input; it sends no HTTP request.

import json
import re
import shlex
from pathlib import Path

text = Path("examples/skills/scan-dependencies/SKILL.md").read_text()
schema = re.search(r"```json\n(.*?)\n```", text, re.S).group(1)
block = re.search(r"```bash\n(.*?)\n```", text, re.S).group(1)
args = shlex.split(block[block.index("curl "):].replace("\\\n", ""))
body = args[args.index("-d") + 1]
for name, value in [("Step 1", schema), ("Step 2", body)]:
    try:
        parsed = json.loads(value)
        print(f'{name}: valid JSON; {len(parsed["requests"])} requests')
    except json.JSONDecodeError as error:
        print(f"{name}: {error}")

Expected behavior

The command under “Execute the Live Lookup,” immediately following “Execute the HTTP POST query using curl,” should demonstrate a syntactically complete JSON body consistent with Step 1's request structure, or explicitly use the constructed payload instead of malformed inline JSON.

Actual behavior

The local parser check produced:

Step 1: valid JSON; 2 requests
Step 2: Expecting property name enclosed in double quotes: line 8 column 9 (char 164)

The -d value also contains a literal ellipsis and omits closing braces. Replacing that value with the preceding Step 1 schema passes the same JSON parser. No live endpoint execution or agent-run failure was measured.

Evidence

• Expected source: The skill's Execution Protocol, especially Step 1's complete schema and Step 2's execution instruction.
• Failure source: The exact Step 2 -d argument in that source, extracted and checked by the script above.
• Evidence provenance: observed
• Local verification: reproduced
• Reproduction completeness: complete

Restoration check

The body demonstrated by Step 2 should parse as JSON and preserve the two request objects illustrated by Step 1. The Step 1 control should continue to parse. This verifies the example's syntax; it does not claim to validate endpoint availability or response behavior.

References

Open PR #404 proposes a correction for this same command. This report records the remaining defect on current main; no PR comment is requested. The earlier merged PR #356 removed trailing commas but left the incomplete object structure and ellipsis in Step 2.

Triage assessment

• Impact level: P3
• Assessment status: supported
• Impact basis: This is a malformed documentation example; the observed failure is a local JSON syntax check, with no measured service or agent workflow failure.
• Workaround status: available
• Workaround basis: The preceding Step 1 schema parses successfully as a complete request body and can be used as the curl payload; live API behavior was not tested.