# UNKNOWN_SOURCE

Severity: low

## What It Detects

Skills or plugins without obvious source, repository, origin, or package metadata.

## Why It Matters

Unknown provenance makes review, updates, and incident response harder.

## False Positive Notes

Local private skills often do not include source metadata.

## Recommended Action

Add source metadata or document why the extension is trusted.