scan_file uses 'local' return values via arrays but is invoked outside a function-counting context — counters work, but final exit ignores WARN; documented WARN behavior may mislead callers

Opus finding

scan_file uses 'local' return values via arrays but is invoked outside a function-counting context — counters work, but final exit ignores WARN; documented WARN behavior may mislead callers

• skills/skill-security-scan/scan.sh:13-18
• skills/skill-security-scan/scan.sh:252-257

The documented contract says exit 0 on PASS but the script also exits 0 on WARN. That’s consistent with the header comment (only HIGH is FAIL), but callers wiring this into CI will not be able to distinguish PASS from WARN via exit code alone, and SKILL.md step 6 says to notify only if FAIL — so MEDIUM findings (e.g., chmod 777, ../, base64 -d) never trigger any notification. For a security-gating skill, silent MEDIUMs are a real risk.