{"data":{"skill":{"slug":"aaron-he-zhu-audience-mapper","name":"audience-mapper","icon":"📦","repo":"https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/influencer/discover/audience-mapper","status":"approved","author":"aaron-he-zhu","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"67ab904b-d479-4173-b31f-c58d329c7d48","skill_id":"0e4b0924-8ac2-4f61-b629-32e0cf2fd2b1","version":1,"content_hash":"8eb90b93a849250dd524c9654b9fb90b","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"I reviewed all 38 static findings against SKILL.md and references/templates.md. The alerts are false positives caused by Markdown links, inline code formatting, homepage metadata, and audience-planning wording. I found no executable code, unauthorized network behavior, or prompt-injection attempt in the cited files.","remediation":[],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"references/templates.md","line_end":3,"line_start":3},{"file":"references/templates.md","line_end":402,"line_start":402},{"file":"references/templates.md","line_end":403,"line_start":403},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":97,"line_start":97},{"file":"SKILL.md","line_end":102,"line_start":102},{"file":"SKILL.md","line_end":103,"line_start":103},{"file":"SKILL.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":105,"line_start":105},{"file":"SKILL.md","line_end":106,"line_start":106},{"file":"SKILL.md","line_end":110,"line_start":110},{"file":"SKILL.md","line_end":112,"line_start":112},{"file":"SKILL.md","line_end":113,"line_start":113},{"file":"SKILL.md","line_end":114,"line_start":114}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":32,"line_start":27},{"file":"SKILL.md","line_end":40,"line_start":32},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"SKILL.md","line_end":47,"line_start":42},{"file":"SKILL.md","line_end":57,"line_start":47},{"file":"SKILL.md","line_end":58,"line_start":57},{"file":"SKILL.md","line_end":59,"line_start":58},{"file":"SKILL.md","line_end":60,"line_start":59},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":97,"line_start":61},{"file":"SKILL.md","line_end":97,"line_start":97}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":13,"line_start":13}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":870,"audit_model":"codex","audited_at":"2026-07-04T15:49:53.88+00:00","created_at":"2026-07-05T00:39:22.899085+00:00","static_findings":[{"id":"filesystem:references/templates.md:3:path-traversal-sequence","file":"references/templates.md","pattern":"Path traversal sequence","snippet":"Fill-in templates for both modes. Mark every inferred attribute with a confidence level (High/Med/Lo","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:references/templates.md:402:path-traversal-sequence","file":"references/templates.md","pattern":"Path traversal sequence","snippet":"1. Feed these criteria to [influencer-discovery](../../influencer-discovery/SKILL.md)","category":"filesystem","line_end":402,"severity":"high","line_start":402},{"id":"filesystem:references/templates.md:403:path-traversal-sequence","file":"references/templates.md","pattern":"Path traversal sequence","snippet":"2. Score candidates with [fit-scorer](../../fit-scorer/SKILL.md)","category":"filesystem","line_end":403,"severity":"high","line_start":403},{"id":"blocker:references/templates.md:115:system-reconnaissance","file":"references/templates.md","pattern":"System reconnaissance","snippet":"- Avoid influencers who [misaligned traits]","category":"blocker","line_end":115,"severity":"low","line_start":115},{"id":"blocker:references/templates.md:211:system-reconnaissance","file":"references/templates.md","pattern":"System reconnaissance","snippet":"**Avoid or deprioritize**:","category":"blocker","line_end":211,"severity":"low","line_start":211},{"id":"blocker:references/templates.md:261:system-reconnaissance","file":"references/templates.md","pattern":"System reconnaissance","snippet":"**Avoid these approaches**:","category":"blocker","line_end":261,"severity":"low","line_start":261},{"id":"blocker:references/templates.md:385:system-reconnaissance","file":"references/templates.md","pattern":"System reconnaissance","snippet":"### Red Flags to Avoid","category":"blocker","line_end":387,"severity":"low","line_start":385},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`audience` mode** — the wide-angle read: demographic + psychographic profiles, a behavioral/medi","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`niche` mode** — the deep-dive: a community map (size, sub-niches, psychographics), a culture de","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Both feed [C3](../../../references/c3-benchmark.md) creator/content scoring downstream, but this ski","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":32,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":40,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Reads**: the mode (audience / niche, inferred if unstated); brand or product name, category, geo","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Writes**: the mode-appropriate deliverable to `memory/influencer/audience-mapper/YYYY-MM-DD-<top","category":"external_commands","line_end":42,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Promotes**: durable facts — in audience mode: target age range, priority platforms, ideal-influe","category":"external_commands","line_end":47,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Primary next skill**: use the `Next Best Skill` block below.","category":"external_commands","line_end":57,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~influencer database` — validate which creator tiers/categories the audience actually follows (a","category":"external_commands","line_end":58,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~social platform analytics` — confirm platform usage, active times, and engagement style; measur","category":"external_commands","line_end":59,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~social listening` — sample real community language, recurring topics, and sentiment toward bran","category":"external_commands","line_end":60,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~CRM` / `~~customer survey data` — replace assumed demographics/psychographics with first-party ","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~web analytics` — corroborate the decision journey and discovery method.","category":"external_commands","line_end":97,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Ask \"Save these results for future sessions?\" If yes, write to `memory/influencer/audience-mapper/YY","category":"external_commands","line_end":97,"severity":"medium","line_start":97},{"id":"network:SKILL.md:10:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://github.com/aaron-he-zhu/aaron-marketing-skills\"","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"metadata: {\"author\": \"aaron-he-zhu\", \"version\": \"13.0.0\", \"discipline\": \"influencer\", \"phase\": \"disc","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"filesystem:SKILL.md:23:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Both feed [C3](../../../references/c3-benchmark.md) creator/content scoring downstream, but this ski","category":"filesystem","line_end":23,"severity":"high","line_start":23},{"id":"filesystem:SKILL.md:51:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> Emit the standard shape from [skill-contract.md §Handoff Summary Format](../../../references/skill","category":"filesystem","line_end":51,"severity":"high","line_start":51},{"id":"filesystem:SKILL.md:63:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Lead with user-supplied data; mark every inferred attribute with a confidence level so unsupported g","category":"filesystem","line_end":63,"severity":"high","line_start":63},{"id":"filesystem:SKILL.md:93:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Scope guard**: this skill maps the audience and the community — it does **not** find or contract s","category":"filesystem","line_end":93,"severity":"high","line_start":93},{"id":"filesystem:SKILL.md:97:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Ask \"Save these results for future sessions?\" If yes, write to `memory/influencer/audience-mapper/YY","category":"filesystem","line_end":97,"severity":"high","line_start":97},{"id":"filesystem:SKILL.md:102:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [C3 Benchmark](../../../references/c3-benchmark.md) — the framework these facts feed; note the aud","category":"filesystem","line_end":102,"severity":"high","line_start":102},{"id":"filesystem:SKILL.md:103:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [C3 scoring architecture](../../../references/c3/scoring-architecture.md) — how downstream creator","category":"filesystem","line_end":103,"severity":"high","line_start":103},{"id":"filesystem:SKILL.md:104:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [skill-contract.md](../../../references/skill-contract.md) · [state-model.md](../../../references/","category":"filesystem","line_end":104,"severity":"high","line_start":104},{"id":"filesystem:SKILL.md:105:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [CONNECTORS.md](../../../CONNECTORS.md) · [SECURITY.md](../../../SECURITY.md) — free/keyless recip","category":"filesystem","line_end":105,"severity":"high","line_start":105},{"id":"filesystem:SKILL.md:106:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Sibling Discover skills: [trend-spotter](../trend-spotter/SKILL.md), [influencer-discovery](../inf","category":"filesystem","line_end":106,"severity":"high","line_start":106},{"id":"filesystem:SKILL.md:110:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Global termination applies (visited-set, `max-depth: 3`, ambiguity-stop) — see [skill-contract.md §T","category":"filesystem","line_end":110,"severity":"high","line_start":110},{"id":"filesystem:SKILL.md:112:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Primary**: [influencer-discovery](../influencer-discovery/SKILL.md) — once the selection criteri","category":"filesystem","line_end":112,"severity":"high","line_start":112},{"id":"filesystem:SKILL.md:113:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **If the audience/niche is set but you need live momentum first**: [trend-spotter](../trend-spotte","category":"filesystem","line_end":113,"severity":"high","line_start":113},{"id":"filesystem:SKILL.md:114:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **After a shortlist exists**: [fit-scorer](../fit-scorer/SKILL.md) — score candidates on ACE and r","category":"filesystem","line_end":114,"severity":"high","line_start":114}],"finding_verdicts":[{"id":"filesystem:references/templates.md:3:path-traversal-sequence","reason":"The path sequence appears only inside a Markdown cross-reference to SKILL.md. It is documentation navigation, not runtime path access or a user-controlled file operation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:references/templates.md:402:path-traversal-sequence","reason":"The path sequence is a Markdown link to a sibling influencer-discovery skill in the next-steps template. It does not execute file traversal or read arbitrary files.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/templates.md:403:path-traversal-sequence","reason":"The path sequence is a Markdown link to a sibling fit-scorer skill in the next-steps template. It is not executable code and has no user-controlled traversal sink.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/templates.md:115:system-reconnaissance","reason":"The word \"Avoid\" is used in marketing guidance about misaligned influencer traits. It is not system reconnaissance or an instruction to bypass controls.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/templates.md:211:system-reconnaissance","reason":"This line tells users to avoid or deprioritize unsuitable marketing platforms. It contains no reconnaissance behavior or security-bypass instruction.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/templates.md:261:system-reconnaissance","reason":"This is a content-planning warning about approaches that fail with an audience. It is ordinary marketing guidance, not system probing.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/templates.md:385:system-reconnaissance","reason":"The red-flags section lists influencer-selection cautions. It does not request host, network, credential, or environment reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The backticks format the literal mode name `audience` and a former skill name in Markdown. No Ruby, shell, subprocess, or command execution is present.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The backticks format the literal mode name `niche` in Markdown prose. The line describes output content and does not invoke a command interpreter.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The backticks format downstream skill names, and the relative path is a Markdown reference. This is documentation, not shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The triple backticks open a Markdown prompt-example block. They are not Ruby backticks and do not execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The triple backticks close a Markdown prompt-example block. There is no shell command or dynamic execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"Inline backticks format prior skill and memory path names in a contract section. The line describes inputs and contains no executable command.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"Inline backticks format a memory save path for user-approved output. This is a documented destination, not a shell command or Ruby execution sink.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"Inline backticks format the hot-cache memory file path. The line requires asking before writing and does not invoke external commands.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The backticks format the heading text `Next Best Skill`. It is a Markdown reference label, not executable syntax.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The backticks wrap a connector placeholder, `~~influencer database`, for optional integrations. It is not command text and has no execution mechanism.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The backticks wrap the `~~social platform analytics` connector placeholder. This is descriptive Markdown and not an external command invocation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The backticks wrap the `~~social listening` connector placeholder. The skill does not provide code that can execute it as a command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The backticks wrap `~~CRM` and `~~customer survey data` connector placeholders. They identify data categories, not shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The backticks wrap a `~~web analytics` connector placeholder and later Markdown path text. The section is documentation and contains no command execution path.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"The backticks format a memory save path and hot-cache path in user-confirmed save instructions. No shell, subprocess, or Ruby execution is present.","verdict":"false_positive","confidence":0.95},{"id":"network:SKILL.md:10:hardcoded-url","reason":"The URL is homepage metadata in frontmatter. It is not fetched, posted to, or used for network communication by executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL appears inside metadata for the OpenClaw homepage. It is static attribution, not a hardcoded outbound request endpoint.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:23:path-traversal-sequence","reason":"The traversal-looking sequence appears in a Markdown link to a repository reference file. It is not a runtime file access instruction and has no user-controlled path input.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:51:path-traversal-sequence","reason":"The line cites a shared skill-contract document through a Markdown link. It does not read or write arbitrary filesystem locations.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:63:path-traversal-sequence","reason":"The sequence appears in Markdown links to CONNECTORS.md and SECURITY.md. These are static repository references, not filesystem traversal operations.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:93:path-traversal-sequence","reason":"The line links to sibling skills to define scope boundaries. The relative paths are documentation links and do not create file traversal behavior.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:97:path-traversal-sequence","reason":"The relative sequence is in a Markdown link to the save-results template, and the memory path is a fixed user-confirmed output location. It does not direct arbitrary path traversal.","verdict":"false_positive","confidence":0.93},{"id":"filesystem:SKILL.md:102:path-traversal-sequence","reason":"The line links to the C3 benchmark reference document. It is a static Markdown citation, not runtime filesystem access.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:103:path-traversal-sequence","reason":"The line links to the C3 scoring architecture reference. It is documentation navigation and has no file read or write sink.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:104:path-traversal-sequence","reason":"The line links to shared contract and state-model reference files. The relative paths are Markdown citations, not path traversal code.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:105:path-traversal-sequence","reason":"The line links to CONNECTORS.md and SECURITY.md for safety guidance. It does not instruct the agent to traverse arbitrary filesystem paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:106:path-traversal-sequence","reason":"The line links to sibling Discover skills. These are bounded repository references and not executable filesystem operations.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:110:path-traversal-sequence","reason":"The line links to termination rules in the shared skill contract. It is static documentation, not a path traversal sink.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:112:path-traversal-sequence","reason":"The line links to the sibling influencer-discovery skill as a handoff. It is a repository-relative Markdown link with no arbitrary file access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:113:path-traversal-sequence","reason":"The line links to the sibling trend-spotter skill as a handoff. It is documentation navigation, not filesystem traversal.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:114:path-traversal-sequence","reason":"The line links to the sibling fit-scorer skill as a handoff. It does not read, write, or execute files based on user input.","verdict":"false_positive","confidence":0.95}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}