The v1 validator inspects repository content as data. It checks metadata and review manifests, local Markdown references, exact optional-bundle contents, duplicate skills, and a finite set of credential, exfiltration, unsafe execution, safeguard-override, and persistence patterns. It does not install or execute skill code, evaluate behavior with an AI model, fetch external links, or run manifest cases. A passing result means only that the implemented static checks found no unexcepted blocking issue; it is not a safety guarantee.

The scan cannot reliably detect paraphrased or obfuscated instructions, undisclosed behavior on remote sites, future changes to external resources, or every cross-language attack. Recommended third-party skills and their URLs are outside first-party certification. External URLs in a first-party skill are not fetched or verified. A future disposable behavioral sandbox is a separate design item and is not part of v1.

Blocking error findings need a source correction or a valid exception before a green result. review findings are deliberately visible and need maintainer context and disposition in the pull request; they are not automatically suppressed and do not become safe merely because a skill declares the access. Review alerts may be benign in context, but a PR author should identify why. The current catalog retains the following seven contextual review alerts from the baseline scan:

• ai-memory-obsidian/SKILL.md:59 (SEC002): a protective instruction not to assume a vault path is detected as possible sensitive-storage access.
• ai-memory-obsidian/SKILL.md:25 (SEC006): /clear and discarded conversation history describe ordinary session behavior; the line is still reviewed because of the finite safeguard detector.
• ai-memory-obsidian/SKILL.md:1 and references/cross-platform-setup.md:15, references/mcp-setup-guide.md:27 (SEC007): agent/MCP configuration guidance is legitimate setup content that overlaps the persistence/configuration detector.
• grill-me/SKILL.md:38 and skillpper-saver/SKILL.md:37 (SEC007): execution-guideline wording is not an instruction to persist startup behavior, but remains visible for review.

The report redacts matching source values and command bodies. Do not put real credentials in test content or issue reports. Use synthetic values generated in memory for detector tests. Report suspected vulnerabilities privately to the repository maintainers rather than publishing exploitable details.

An exception is trusted only from the base revision. It must bind one exact rule, normalized path, and content SHA-256, include a rationale, issue URL, approving maintainer, and expiry no more than 30 days away. No globs are allowed. V1 permits waivers only for SEC003 and DUP001; parser, input, bundle/resource, credential, and all other unknown finding classes remain non-waivable. Changes to the exception file must be reviewed separately on the trusted base before they can affect a candidate scan. Ordinary PR approval cannot waive a blocking error.

The required workflow is designed to use the base revision's validator, policy, exceptions, and locked dependencies with read-only permissions and no secrets. The workflow itself still requires code-owner review because pull request workflows are contributor-controlled. Candidate regression tests run separately and are contributor code, not trusted static inspection. Merge enforcement remains pending administrator activation of the skill-validation and validator-tests required checks and code-owner review. Bootstrap requires manual review because the initial base revision has no validator; no candidate-code fallback is allowed. A second verified code owner is needed to review changes authored by the current owner.