{"data":{"skill":{"slug":"aaron-he-zhu-brief-generator","name":"brief-generator","icon":"📦","repo":"https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/influencer/plan/brief-generator","status":"approved","author":"aaron-he-zhu","authorVersion":"17.0.0","skillstoreRevision":1},"audit":{"id":"871b60fa-5479-4f48-8bb2-3c7bb92b8e91","skill_id":"48635650-67a5-46e6-bfcb-396e65f5d148","version":4,"content_hash":"v3:d71c7417a35d5c2624161bd2fe8de8a41a362128:8c24fec57d195a5c2baec38bc2752679f01d549f905cdf42450ce6bfe5ddbe10:75840731ee55ea4e541ed125faf7c4fa401e7b24c53324268513b89059a49b91:736b696c6c732f6161726f6e2d68652d7a68752f62726965662d67656e657261746f72:3ebeb55507516af5c591643fdd3741d9","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 37 static findings are false positives caused by Markdown formatting, fixed repository links, template wording, or public metadata URLs. No executable commands, dynamic paths, prompt injection, unauthorized network activity, or malicious intent were found.","remediation":[],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"references/brief-templates.md","line_end":5,"line_start":5},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":86,"line_start":86},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":91,"line_start":91},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":95,"line_start":95},{"file":"SKILL.md","line_end":99,"line_start":99},{"file":"SKILL.md","line_end":101,"line_start":101},{"file":"SKILL.md","line_end":102,"line_start":102}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":30,"line_start":26},{"file":"SKILL.md","line_end":32,"line_start":30},{"file":"SKILL.md","line_end":36,"line_start":32},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":49,"line_start":37},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":58,"line_start":57},{"file":"SKILL.md","line_end":59,"line_start":58},{"file":"SKILL.md","line_end":70,"line_start":59},{"file":"SKILL.md","line_end":70,"line_start":70}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":13,"line_start":13}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":3,"total_lines":637,"audit_model":"codex","audited_at":"2026-07-12T10:57:15.539+00:00","created_at":"2026-07-14T15:53:54.237759+00:00","static_findings":[{"id":"filesystem:references/brief-templates.md:5:path-traversal-sequence","file":"references/brief-templates.md","pattern":"Path traversal sequence","snippet":"Back to the skill: [SKILL.md](../SKILL.md)","category":"filesystem","line_end":5,"severity":"high","line_start":5},{"id":"blocker:references/brief-templates.md:86:system-reconnaissance","file":"references/brief-templates.md","pattern":"System reconnaissance","snippet":"- [Avoid 1]","category":"blocker","line_end":86,"severity":"low","line_start":86},{"id":"blocker:references/brief-templates.md:87:system-reconnaissance","file":"references/brief-templates.md","pattern":"System reconnaissance","snippet":"- [Avoid 2]","category":"blocker","line_end":87,"severity":"low","line_start":87},{"id":"blocker:references/brief-templates.md:272:system-reconnaissance","file":"references/brief-templates.md","pattern":"System reconnaissance","snippet":"- \"Paid partnership with [Brand]\" (platform feature)","category":"blocker","line_end":272,"severity":"low","line_start":272},{"id":"blocker:references/brief-templates.md:292:system-reconnaissance","file":"references/brief-templates.md","pattern":"System reconnaissance","snippet":"- [ ] Use in paid advertising","category":"blocker","line_end":292,"severity":"low","line_start":292},{"id":"blocker:references/creator-voice-intake.md:66:system-reconnaissance","file":"references/creator-voice-intake.md","pattern":"System reconnaissance","snippet":"## What to Avoid","category":"blocker","line_end":68,"severity":"low","line_start":66},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":32,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":36,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Reads**: campaign/product/platform/deliverable/CTA/timeline/compensation inputs plus `memory/pro","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Writes**: a creator-ready brief in conversation and, with permission, `memory/influencer/brief-g","category":"external_commands","line_end":49,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Required fields: `narrative_canon_id`, `narrative_canon_version`, `claims_projection_offset`, and `d","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~influencer database` — pull creator handles, audience size, and past collaboration notes to per","category":"external_commands","line_end":58,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~social platform analytics` — confirm current format specs and best-performing post lengths per ","category":"external_commands","line_end":59,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~CRM` — fetch the assigned point of contact and prior brief versions for an ambassador.","category":"external_commands","line_end":70,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Generate the professional brief** — fill the master template and tune it to the platform. Deriv","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"network:SKILL.md:10:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://github.com/aaron-he-zhu/aaron-marketing-skills\"","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"metadata: {\"author\": \"aaron-he-zhu\", \"version\": \"17.0.0\", \"discipline\": \"influencer\", \"phase\": \"plan","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"filesystem:SKILL.md:43:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Primary next skill**: [budget-optimizer](../budget-optimizer/SKILL.md)","category":"filesystem","line_end":43,"severity":"high","line_start":43},{"id":"filesystem:SKILL.md:47:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> Emit the standard shape from [skill-contract.md §Handoff Summary Format](../../../references/skill","category":"filesystem","line_end":47,"severity":"high","line_start":47},{"id":"filesystem:SKILL.md:63:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"See [CONNECTORS.md](../../../CONNECTORS.md) for the verified free/keyless recipe per category. None ","category":"filesystem","line_end":63,"severity":"high","line_start":63},{"id":"filesystem:SKILL.md:84:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Shared contract: [skill-contract.md](../../../references/skill-contract.md)","category":"filesystem","line_end":84,"severity":"high","line_start":84},{"id":"filesystem:SKILL.md:85:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Shared state model: [state-model.md](../../../references/state-model.md)","category":"filesystem","line_end":85,"severity":"high","line_start":85},{"id":"filesystem:SKILL.md:86:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Connector recipes: [CONNECTORS.md](../../../CONNECTORS.md)","category":"filesystem","line_end":86,"severity":"high","line_start":86},{"id":"filesystem:SKILL.md:87:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- C3 scoring architecture (when scoring brief quality): [references/c3/scoring-architecture.md](../.","category":"filesystem","line_end":87,"severity":"high","line_start":87},{"id":"filesystem:SKILL.md:91:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [campaign-planner](../campaign-planner/SKILL.md) - Create the campaign this brief supports","category":"filesystem","line_end":91,"severity":"high","line_start":91},{"id":"filesystem:SKILL.md:92:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [budget-optimizer](../budget-optimizer/SKILL.md) - Allocate spend across the briefed creators","category":"filesystem","line_end":92,"severity":"high","line_start":92},{"id":"filesystem:SKILL.md:93:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [content-reviewer](../../activate/content-reviewer/SKILL.md) - Review submitted content","category":"filesystem","line_end":93,"severity":"high","line_start":93},{"id":"filesystem:SKILL.md:94:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [outreach-manager](../../activate/outreach-manager/SKILL.md) - Deliver briefs to influencers","category":"filesystem","line_end":94,"severity":"high","line_start":94},{"id":"filesystem:SKILL.md:95:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [contract-helper](../../activate/contract-helper/SKILL.md) - Include legal terms","category":"filesystem","line_end":95,"severity":"high","line_start":95},{"id":"filesystem:SKILL.md:99:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Primary**: [budget-optimizer](../budget-optimizer/SKILL.md) - Once the brief defines deliverable","category":"filesystem","line_end":99,"severity":"high","line_start":99},{"id":"filesystem:SKILL.md:101:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [campaign-planner](../campaign-planner/SKILL.md) - Re-plan campaign scope if the brief surfaces ne","category":"filesystem","line_end":101,"severity":"high","line_start":101},{"id":"filesystem:SKILL.md:102:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [outreach-manager](../../activate/outreach-manager/SKILL.md) - Send the finished brief to selected","category":"filesystem","line_end":102,"severity":"high","line_start":102},{"id":"blocker:SKILL.md:42:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Key messages derive from accepted Narrative canon, claims are context-valid or visibly blocked, an","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:SKILL.md:70:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"2. **Generate the professional brief** — fill the master template and tune it to the platform. Deriv","category":"blocker","line_end":70,"severity":"low","line_start":70},{"id":"blocker:SKILL.md:80:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"**Output**: Complete brief — messaging around organic ingredients and clean label, deliverables of 1","category":"blocker","line_end":80,"severity":"low","line_start":80}],"finding_verdicts":[{"id":"filesystem:references/brief-templates.md:5:path-traversal-sequence","reason":"The sequence appears in a fixed Markdown link back to SKILL.md. It does not construct or access an attacker-controlled path.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/brief-templates.md:86:system-reconnaissance","reason":"The line is a placeholder for prohibited campaign wording. It performs no system discovery or environment inspection.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/brief-templates.md:87:system-reconnaissance","reason":"The line is a second content-guidance placeholder. It contains no reconnaissance instruction or executable operation.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/brief-templates.md:272:system-reconnaissance","reason":"This is an example advertising disclosure available on social platforms. It does not inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/brief-templates.md:292:system-reconnaissance","reason":"This checklist item defines content usage rights for paid advertising. It has no system reconnaissance behavior.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/creator-voice-intake.md:66:system-reconnaissance","reason":"The heading introduces off-brand language to avoid in creator content. It does not request system information.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The backticks open a Markdown example block containing a natural-language prompt. There is no Ruby or shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks close a Markdown prompt example. They are documentation syntax, not command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The backticks open another Markdown example containing only a brief-generation request. No executable code is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The backticks close the natural-language example block. They do not invoke a command interpreter.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Backticks format fixed memory paths in prose describing skill inputs. There is no shell expression or subprocess invocation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"Backticks format a documented output path, and writing requires user permission. No command execution syntax appears.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The backticks identify required handoff field names and allowed status values. They are not executable expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The marked phrase names an optional influencer database connector. Markdown formatting is not shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The marked phrase names an optional analytics connector. It provides no command, arguments, or execution mechanism.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The marked phrase names an optional CRM connector. It is documentation and contains no shell command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"Backticks format a placeholder, a script name, and proposal fields in prose. No shell command or user-controlled execution string is supplied.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:10:hardcoded-url","reason":"The URL is public homepage metadata for the source repository. The skill does not instruct an HTTP request to it.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL is repeated inside public package metadata. It is attribution, not a network destination used for data transfer.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:43:path-traversal-sequence","reason":"This is a fixed relative Markdown link to a sibling skill. No variable input controls the path.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:47:path-traversal-sequence","reason":"This fixed repository-relative link documents a shared handoff format. It does not traverse a user-supplied path.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:63:path-traversal-sequence","reason":"This is a fixed Markdown link to connector documentation. It contains no dynamic path construction or arbitrary file access.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:84:path-traversal-sequence","reason":"The sequence belongs to a fixed link to the repository's shared contract documentation. The path is not attacker-controlled.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:85:path-traversal-sequence","reason":"The sequence belongs to a fixed link to shared state-model documentation. It does not enable arbitrary traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:86:path-traversal-sequence","reason":"The sequence belongs to a fixed repository documentation link. No runtime filesystem operation is defined.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:87:path-traversal-sequence","reason":"This is a fixed link to scoring architecture documentation used only when scoring briefs. It is not a dynamic traversal vector.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:91:path-traversal-sequence","reason":"This fixed sibling-skill link documents an optional workflow handoff. It does not consume user input as a path.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:92:path-traversal-sequence","reason":"This fixed sibling-skill link documents budget allocation as a later step. It does not perform arbitrary file access.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:93:path-traversal-sequence","reason":"This is a fixed Markdown link to a content-review skill. The relative path is documentation, not a traversal exploit.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:94:path-traversal-sequence","reason":"This is a fixed Markdown link to an outreach skill. No dynamic or attacker-controlled filesystem path is used.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:95:path-traversal-sequence","reason":"This is a fixed Markdown link to a contract skill. It does not expose arbitrary local files.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:99:path-traversal-sequence","reason":"The fixed link recommends a sibling skill after brief creation. It is not path construction from untrusted input.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:101:path-traversal-sequence","reason":"The fixed link identifies an alternate campaign-planning handoff. It does not cause unrestricted traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:102:path-traversal-sequence","reason":"The fixed link identifies an alternate outreach handoff. It contains no user-controlled path or filesystem command.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:42:system-reconnaissance","reason":"The word blocked describes validation of unsupported marketing claims. The line does not gather system details.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:70:system-reconnaissance","reason":"The instruction blocks creator-ready status when claims lack sources. It is a content safety control, not reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:80:system-reconnaissance","reason":"This is a sample campaign brief summary containing platform specifications. It does not inspect platform or host configuration.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"d71c7417a35d5c2624161bd2fe8de8a41a362128","subject_content_hash":"8c24fec57d195a5c2baec38bc2752679f01d549f905cdf42450ce6bfe5ddbe10","subject_tree_hash":"75840731ee55ea4e541ed125faf7c4fa401e7b24c53324268513b89059a49b91","subject_plugin_path":"skills/aaron-he-zhu/brief-generator","audit_payload_hash":"3ebeb55507516af5c591643fdd3741d9","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"d71c7417a35d5c2624161bd2fe8de8a41a362128","contentHash":"8c24fec57d195a5c2baec38bc2752679f01d549f905cdf42450ce6bfe5ddbe10","treeHash":"75840731ee55ea4e541ed125faf7c4fa401e7b24c53324268513b89059a49b91","pluginPath":"skills/aaron-he-zhu/brief-generator","auditPayloadHash":"3ebeb55507516af5c591643fdd3741d9"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}