Found while building #10618's docs gate (the corpus census covered both prose roots before scoping the gate to content/docs/** per the card).
The defect
4 ObjectSchema.create() examples inside <!-- os:check -->-marked blocks in the published skills catalog omit sharingModel. Same class as #10581/#10618: the omission type-checks clean (z.enum([...]).optional(), no .default()), while os validate rejects it as severity: 'error' (SECURITY_OWD_UNSET, packages/lint/src/validate-security-posture.ts). Skills are copied verbatim by AI authors, so the cost multiplies per reader — and the skills catalog is the surface the maintainer has ruled the platform's highest-value one.
| Site | object |
|---|
skills/objectstack-data/SKILL.md:214 | account |
skills/objectstack-data/SKILL.md:254 | invoice |
skills/objectstack-data/SKILL.md:321 | support_case |
skills/objectstack-upgrade/SKILL.md:635 | crm_lead |
(Line numbers at origin/main58563be; re-derive at fix time.)
Why it is not fixed in #10618's PR
skills/** is a governed surface (AGENTS.md Prime Directive #14) — the fix cannot ride a code PR and must land through a human merge. Fix shape is pinned by the merged #10714 sweep: an explicit sharingModel per literal ('private' is the rule's own recommended default; mirror a real example app counterpart where one exists).
Second half: extend the gate
Once the 4 sites are fixed, extend packages/lint/scripts/check-doc-security-posture.mjs (landed by #10618): add the skills/ root with the <!-- os:check --> marker spelling (the script's header records this as the deferred extension; check-skill-examples.ts's SOURCE_ROOTS shows the two-root/two-marker pattern). Sequencing matters — extending the roots before the fixes makes the gate born red, the same trap #10618's own sequencing note avoided.
Dedupe: search_issues zero-hit on two phrasings ("skills SKILL.md ObjectSchema.create sharingModel missing os:check example", "objectstack-data SKILL sharingModel owd security posture example missing"). Back-links: #10618, #10581, #10714.
Found while building #10618's docs gate (the corpus census covered both prose roots before scoping the gate to
content/docs/**per the card).The defect
4
ObjectSchema.create()examples inside<!-- os:check -->-marked blocks in the published skills catalog omitsharingModel. Same class as #10581/#10618: the omission type-checks clean (z.enum([...]).optional(), no.default()), whileos validaterejects it asseverity: 'error'(SECURITY_OWD_UNSET,packages/lint/src/validate-security-posture.ts). Skills are copied verbatim by AI authors, so the cost multiplies per reader — and the skills catalog is the surface the maintainer has ruled the platform's highest-value one.skills/objectstack-data/SKILL.md:214accountskills/objectstack-data/SKILL.md:254invoiceskills/objectstack-data/SKILL.md:321support_caseskills/objectstack-upgrade/SKILL.md:635crm_lead(Line numbers at
origin/main58563be; re-derive at fix time.)Why it is not fixed in #10618's PR
skills/**is a governed surface (AGENTS.md Prime Directive #14) — the fix cannot ride a code PR and must land through a human merge. Fix shape is pinned by the merged #10714 sweep: an explicitsharingModelper literal ('private'is the rule's own recommended default; mirror a real example app counterpart where one exists).Second half: extend the gate
Once the 4 sites are fixed, extend
packages/lint/scripts/check-doc-security-posture.mjs(landed by #10618): add theskills/root with the<!-- os:check -->marker spelling (the script's header records this as the deferred extension;check-skill-examples.ts'sSOURCE_ROOTSshows the two-root/two-marker pattern). Sequencing matters — extending the roots before the fixes makes the gate born red, the same trap #10618's own sequencing note avoided.Dedupe:
search_issueszero-hit on two phrasings ("skills SKILL.md ObjectSchema.create sharingModel missing os:check example", "objectstack-data SKILL sharingModel owd security posture example missing"). Back-links: #10618, #10581, #10714.