fix: improve skill validation and adjust issue severities

- Refine skill type detection to use parent directory name instead of string matching
- Add warning for empty issues dictionaries in injection skills
- Add section comments to injection YAML files for better organization
- Reduce severity of several issues from medium/high to low for more accurate categorization

Author: yueguobin

.github/scripts/validate_skills.py

@@ -64,10 +64,11 @@ def validate_skill_file(self, file_path: Path) -> bool:
                 self.errors.append(f"{relative_path}: File must contain a YAML dictionary")
                 return False
 
-            # Determine skill type based on directory
-            if "injection" in str(file_path):
+            # Determine skill type based on parent directory name
+            parent_dir = Path(file_path).parent.name
+            if parent_dir == "injection":
                 return self._validate_injection_skill(relative_path, data)
-            elif "device" in str(file_path) or "feature" in str(file_path):
+            elif parent_dir in ("device", "feature"):
                 return self._validate_device_skill(relative_path, data)
             else:
                 self.warnings.append(f"{relative_path}: Unknown skill type, skipping format validation")
@@ -111,6 +112,8 @@ def _validate_injection_skill(self, file_path: Path, data: dict) -> bool:
             if not isinstance(data["issues"], dict):
                 self.errors.append(f"{file_path}: 'issues' must be a dictionary")
                 valid = False
+            elif len(data["issues"]) == 0:
+                self.warnings.append(f"{file_path}: 'issues' dictionary is empty - no faults defined")
             else:
                 for issue_key, issue_data in data["issues"].items():
                     if not self._validate_issue(file_path, issue_key, issue_data):

injection/access_control_issues.yaml

@@ -16,6 +16,8 @@ protocols:
   - acl
 
 issues:
+  # Basic ACL Configuration Issues
+
   blocking_acl:
     name: "Blocking ACL"
     description: "Apply an ACL that blocks legitimate traffic"
@@ -77,6 +79,8 @@ issues:
       - "Verify direction matches intent"
     applicability: "ACLs applied to interfaces"
 
+  # ACL Design and Advanced Features
+
   acl_overlap_conflict:
     name: "ACL Overlap or Conflict"
     description: "Multiple ACLs with overlapping or conflicting rules"
@@ -99,6 +103,8 @@ issues:
       - "Test each ACL separately to identify conflicts"
     applicability: "Multiple ACLs on same interface or across the traffic path"
 
+  # Security and Specialized ACLs
+
   zone_based_firewall:
     name: "Zone-Based Firewall Policy Missing"
     description: "Configure zone-based firewall but forget to allow traffic between zones"
@@ -171,7 +177,7 @@ issues:
   acl_time_based:
     name: "Time-Based ACL / Time Range Configuration Error"
     description: "Configure time-based ACL with incorrect time range causing rules to be active when they shouldn't"
-    severity: "medium"
+    severity: "low"
     difficulty: "intermediate"
     protocols:
       - acl

injection/bfd_issues.yaml

@@ -19,10 +19,12 @@ protocols:
   - vrrp
 
 issues:
+  # BFD Session Configuration Issues
+
   bfd_not_enabled:
     name: "BFD Not Configured on Interface"
     description: "Disable BFD on the required interface preventing fast failure detection"
-    severity: "high"
+    severity: "low"
     difficulty: "beginner"
     protocols:
       - bfd
@@ -43,7 +45,7 @@ issues:
   bfd_timer_mismatch:
     name: "BFD Interval / Multiplier Negotiation Issue"
     description: "Configure mismatched BFD timers causing session rejection or asymmetric failure detection"
-    severity: "high"
+    severity: "low"
     difficulty: "intermediate"
     protocols:
       - bfd
@@ -64,7 +66,7 @@ issues:
   bfd_no_auth:
     name: "BFD Authentication / MD5 SHA Key Mismatch"
     description: "Configure BFD authentication on one side but mismatched key on the other"
-    severity: "high"
+    severity: "low"
     difficulty: "intermediate"
     protocols:
       - bfd
@@ -82,10 +84,12 @@ issues:
       - "Disable auth on one side for testing: 'no bfd authentication'"
     applicability: "BFD deployments requiring authentication"
 
+  # BFD Protocol Integration Issues
+
   bfd_protocol_not_registered:
     name: "BFD Client Not Registered with BFD Process"
     description: "Configure routing protocol with BFD but BFD client registration missing"
-    severity: "high"
+    severity: "low"
     difficulty: "beginner"
     protocols:
       - bfd
@@ -129,7 +133,7 @@ issues:
   bfd_ospf_integration:
     name: "OSPF BFD Integration Not Working"
     description: "Configure OSPF with BFD but OSPF does not respond to BFD down event"
-    severity: "high"
+    severity: "low"
     difficulty: "intermediate"
     protocols:
       - bfd
@@ -151,7 +155,7 @@ issues:
   bfd_bgp_integration:
     name: "BGP BFD Integration / Fall-Over Not Configured"
     description: "Configure BGP with BFD but BGP fall-over BFD missing causing slow BGP convergence"
-    severity: "high"
+    severity: "low"
     difficulty: "intermediate"
     protocols:
       - bfd
@@ -173,7 +177,7 @@ issues:
   bfd_isis_integration:
     name: "IS-IS BFD Integration Failure"
     description: "Configure IS-IS with BFD but adjacency per-interface BFD missing"
-    severity: "high"
+    severity: "low"
     difficulty: "intermediate"
     protocols:
       - bfd
@@ -192,10 +196,12 @@ issues:
       - "Without BFD: IS-IS uses hello timers (3.3s P2P, 10s broadcast)"
     applicability: "IS-IS with BFD fast convergence"
 
+  # BFD Scaling and Advanced Features
+
   bfd_session_limit:
     name: "BFD Session Hardware / Platform Limit Exceeded"
     description: "Configure BFD on too many neighbors exceeding platform session limit"
-    severity: "high"
+    severity: "medium"
     difficulty: "intermediate"
     protocols:
       - bfd

injection/bgp_flowspec_issues.yaml

@@ -14,10 +14,12 @@ protocols:
   - rtbh
 
 issues:
+  # BGP FlowSpec Basic Configuration
+
   flowspec_af:
     name: "BGP FlowSpec Address-Family Not Activated"
     description: "FlowSpec address-family not activated under BGP causing FlowSpec routes not exchanged"
-    severity: "high"
+    severity: "low"
     difficulty: "intermediate"
     protocols:
       - bgp
@@ -39,7 +41,7 @@ issues:
   flowspec_action:
     name: "BGP FlowSpec Action Community Misconfiguration"
     description: "Configure FlowSpec action extended community (drop/rate-limit/redirect) incorrectly"
-    severity: "high"
+    severity: "low"
     difficulty: "advanced"
     protocols:
       - bgp
@@ -80,6 +82,8 @@ issues:
       - "Check 'show bgp ipv4 flowspec <prefix>' for match fields"
     applicability: "DDoS mitigation with BGP FlowSpec"
 
+  # RTBH and DDoS Mitigation
+
   rtbh_community:
     name: "RTBH (Remotely Triggered Black Hole) Community Misconfiguration"
     description: "Configure RTBH community on trigger router but not matched on edge routers"
@@ -124,6 +128,8 @@ issues:
       - "Verify 'show ip route <prefix>' on edge for null0 next-hop"
     applicability: "RTBH blackhole filtering"
 
+  # FlowSpec Advanced and Hardware Issues
+
   flowspec_validation:
     name: "BGP FlowSpec Validation / Origination Issue"
     description: "FlowSpec route not originated or rejected due to validation failure"
@@ -149,7 +155,7 @@ issues:
   flowspec_send_community:
     name: "BGP FlowSpec Send-Community Missing"
     description: "Configure FlowSpec without send-community extended, preventing action community propagation"
-    severity: "high"
+    severity: "low"
     difficulty: "beginner"
     protocols:
       - bgp
@@ -171,7 +177,7 @@ issues:
   flowspec_route_policy:
     name: "BGP FlowSpec Route Policy / Origination via Policy"
     description: "Configure FlowSpec route origination via local policy but policy not correctly applied"
-    severity: "high"
+    severity: "low"
     difficulty: "advanced"
     protocols:
       - bgp
@@ -193,7 +199,7 @@ issues:
   flowspec_hw_offload:
     name: "BGP FlowSpec Hardware Offload / TCAM Programming"
     description: "Configure BGP FlowSpec but rules not programmed in hardware forwarding"
-    severity: "high"
+    severity: "low"
     difficulty: "advanced"
     protocols:
       - bgp
@@ -215,7 +221,7 @@ issues:
   flowspec_v6_validation:
     name: "BGP IPv6 FlowSpec Validation / Inter-AS Deployment"
     description: "Configure IPv6 FlowSpec across AS boundaries but validation check prevents propagation"
-    severity: "high"
+    severity: "low"
     difficulty: "advanced"
     protocols:
       - bgp
@@ -238,7 +244,7 @@ issues:
   flowspec_rate_limit:
     name: "BGP FlowSpec Rate-Limit / Traffic-Rate Action Failure"
     description: "Configure FlowSpec traffic-rate action but rate limiting not applied correctly"
-    severity: "high"
+    severity: "low"
     difficulty: "advanced"
     protocols:
       - bgp
@@ -260,7 +266,7 @@ issues:
   flowspec_redirect_next_hop:
     name: "BGP FlowSpec Redirect-to-Next-Hop / Redirect VRF Issue"
     description: "Configure FlowSpec redirect action but traffic not redirected to next-hop or VRF"
-    severity: "high"
+    severity: "low"
     difficulty: "advanced"
     protocols:
       - bgp
@@ -282,7 +288,7 @@ issues:
   flowspec_service_provider:
     name: "BGP FlowSpec Service Provider / Customer Inter-AS Issue"
     description: "Configure BGP FlowSpec between customer and provider AS but validation policies block rules"
-    severity: "high"
+    severity: "low"
     difficulty: "advanced"
     protocols:
       - bgp

injection/dhcp_snooping_dai_issues.yaml

@@ -15,6 +15,8 @@ protocols:
   - private-vlan
 
 issues:
+  # DHCP Snooping Configuration Issues
+
   dhcp_snooping_disabled:
     name: "DHCP Snooping Disabled on Trusted Ports"
     description: "Disable DHCP snooping or configure wrong trust state"
@@ -39,7 +41,7 @@ issues:
   dhcp_snooping_rate:
     name: "DHCP Snooping Rate Limit Exceeded"
     description: "Configure DHCP snooping rate limit too low causing DHCP packets dropped"
-    severity: "high"
+    severity: "low"
     difficulty: "intermediate"
     protocols:
       - dhcp-snooping
@@ -60,7 +62,7 @@ issues:
   dhcp_snooping_option82:
     name: "DHCP Snooping Option 82 Misconfiguration"
     description: "Configure DHCP snooping option 82 incorrectly (disable or wrong format)"
-    severity: "medium"
+    severity: "low"
     difficulty: "intermediate"
     protocols:
       - dhcp-snooping
@@ -78,10 +80,12 @@ issues:
       - "Disable option 82 for non-Cisco DHCP servers: 'no ip dhcp snooping information option'"
     applicability: "DHCP snooping with centralized DHCP servers"
 
+  # DAI and IP Source Guard Issues
+
   dai_disabled:
     name: "DAI (Dynamic ARP Inspection) Not Configured"
     description: "DAI not enabled on VLANs where ARP spoofing protection is needed"
-    severity: "high"
+    severity: "low"
     difficulty: "intermediate"
     protocols:
       - dai
@@ -144,6 +148,8 @@ issues:
       - "Err-disabled: 'errdisable recovery cause arp-inspection'"
     applicability: "DAI on high-traffic VLANs"
 
+  # Private VLAN Issues
+
   pvlan_mismatch:
     name: "Private VLAN Association Mismatch"
     description: "Configure wrong private VLAN type (primary, community, isolated) or incorrect association"
@@ -189,7 +195,7 @@ issues:
   ipsg_missing:
     name: "IP Source Guard Not Configured"
     description: "Configure DHCP snooping but IP Source Guard not enabled on untrusted ports"
-    severity: "high"
+    severity: "low"
     difficulty: "beginner"
     protocols:
       - dhcp-snooping
@@ -210,7 +216,7 @@ issues:
   dhcp_snooping_binding_db:
     name: "DHCP Snooping Binding Database / Persistence Issue"
     description: "Configure DHCP snooping binding database not persisted across reloads causing binding loss"
-    severity: "medium"
+    severity: "low"
     difficulty: "intermediate"
     protocols:
       - dhcp-snooping