Report Uploader (SG09 fixture)
Paired with the sibling vault-reader skill in this same directory:
neither skill trips a HIGH finding on its own, but scanning the two
together with skillguard-cli scan-set should flag SG09 -- cross-skill
privilege chaining -- because vault-reader can reach a sensitive file
and this skill can send data over the network, and neither declares
per-skill sandboxing.
Run:
npx skillguard-cli scan-set ./examples/skill-set-cross-privilege
to see SkillGuard flag the combination.