{"data":{"skill":{"slug":"aaron-he-zhu-content-reviewer","name":"content-reviewer","icon":"📦","repo":"https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/influencer/activate/content-reviewer","status":"approved","author":"aaron-he-zhu","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"62a9e78e-0b7b-4268-8c3d-da8dd9f888b1","skill_id":"b1a55174-e774-4d98-b8f8-02107e0cab7c","version":1,"content_hash":"0be09a35cb0e1415bab74f2fc610878d","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The audit found no prompt-injection attempt, executable command path, or malicious filesystem traversal in the reviewed Markdown files. Most static findings are false positives from fixed documentation links, inline code formatting, template fences, connector placeholders, or platform labels. One low-risk network issue remains: the standalone fallback can fetch mutable reference content from GitHub at runtime.","remediation":[{"issue":"Mutable remote reference fallback","severity":"low","suggestion":"Pin the raw GitHub fallback to a version tag or bundled reference file, and require user confirmation before fetching remote reference content."}],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"references/quality-review-aids.md","line_end":7,"line_start":7},{"file":"references/quality-review-aids.md","line_end":17,"line_start":17},{"file":"references/quality-review-aids.md","line_end":23,"line_start":23},{"file":"references/quality-review-aids.md","line_end":24,"line_start":24},{"file":"references/quality-review-aids.md","line_end":25,"line_start":25},{"file":"references/quality-review-aids.md","line_end":26,"line_start":26},{"file":"references/quality-review-aids.md","line_end":27,"line_start":27},{"file":"references/review-templates.md","line_end":3,"line_start":3},{"file":"references/review-templates.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":74,"line_start":74},{"file":"SKILL.md","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":95,"line_start":95},{"file":"SKILL.md","line_end":131,"line_start":131},{"file":"SKILL.md","line_end":132,"line_start":132},{"file":"SKILL.md","line_end":133,"line_start":133},{"file":"SKILL.md","line_end":134,"line_start":134},{"file":"SKILL.md","line_end":135,"line_start":135},{"file":"SKILL.md","line_end":136,"line_start":136},{"file":"SKILL.md","line_end":137,"line_start":137},{"file":"SKILL.md","line_end":138,"line_start":138},{"file":"SKILL.md","line_end":139,"line_start":139},{"file":"SKILL.md","line_end":140,"line_start":140},{"file":"SKILL.md","line_end":141,"line_start":141},{"file":"SKILL.md","line_end":145,"line_start":145},{"file":"SKILL.md","line_end":148,"line_start":148},{"file":"SKILL.md","line_end":149,"line_start":149}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":37,"line_start":35},{"file":"SKILL.md","line_end":41,"line_start":37},{"file":"SKILL.md","line_end":43,"line_start":41},{"file":"SKILL.md","line_end":47,"line_start":43},{"file":"SKILL.md","line_end":48,"line_start":47},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":54,"line_start":49},{"file":"SKILL.md","line_end":54,"line_start":54},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":70,"line_start":69},{"file":"SKILL.md","line_end":71,"line_start":70},{"file":"SKILL.md","line_end":72,"line_start":71},{"file":"SKILL.md","line_end":78,"line_start":72},{"file":"SKILL.md","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":125,"line_start":125}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":80,"line_start":80}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":80,"line_start":80}],"confidence":0.84,"description":"*Standalone install fallback*: if that relative path does not exist, this skill was installed standa","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The standalone fallback instructs the host to fetch reference files from raw.githubusercontent.com on the mutable main branch. That outbound fetch can pull changed content at runtime, creating low supply-chain and privacy risk."}],"dangerous_patterns":[],"files_scanned":3,"total_lines":629,"audit_model":"codex","audited_at":"2026-07-04T15:50:03.73+00:00","created_at":"2026-07-05T00:39:24.716172+00:00","static_findings":[{"id":"filesystem:references/quality-review-aids.md:7:path-traversal-sequence","file":"references/quality-review-aids.md","pattern":"Path traversal sequence","snippet":"When you score the **Creative Quality** category — specifically Authenticity and Native-feel — run t","category":"filesystem","line_end":7,"severity":"high","line_start":7},{"id":"filesystem:references/quality-review-aids.md:17:path-traversal-sequence","file":"references/quality-review-aids.md","pattern":"Path traversal sequence","snippet":"For higher-stakes or ambiguous submissions, run the content past the persona set in [expert-panel.md","category":"filesystem","line_end":17,"severity":"high","line_start":17},{"id":"filesystem:references/quality-review-aids.md:23:path-traversal-sequence","file":"references/quality-review-aids.md","pattern":"Path traversal sequence","snippet":"- [platforms/tiktok.md](../../../../references/platforms/tiktok.md)","category":"filesystem","line_end":23,"severity":"high","line_start":23},{"id":"filesystem:references/quality-review-aids.md:24:path-traversal-sequence","file":"references/quality-review-aids.md","pattern":"Path traversal sequence","snippet":"- [platforms/youtube.md](../../../../references/platforms/youtube.md)","category":"filesystem","line_end":24,"severity":"high","line_start":24},{"id":"filesystem:references/quality-review-aids.md:25:path-traversal-sequence","file":"references/quality-review-aids.md","pattern":"Path traversal sequence","snippet":"- [platforms/x.md](../../../../references/platforms/x.md)","category":"filesystem","line_end":25,"severity":"high","line_start":25},{"id":"filesystem:references/quality-review-aids.md:26:path-traversal-sequence","file":"references/quality-review-aids.md","pattern":"Path traversal sequence","snippet":"- [platforms/linkedin.md](../../../../references/platforms/linkedin.md)","category":"filesystem","line_end":26,"severity":"high","line_start":26},{"id":"filesystem:references/quality-review-aids.md:27:path-traversal-sequence","file":"references/quality-review-aids.md","pattern":"Path traversal sequence","snippet":"- [platforms/reddit.md](../../../../references/platforms/reddit.md)","category":"filesystem","line_end":27,"severity":"high","line_start":27},{"id":"filesystem:references/review-templates.md:3:path-traversal-sequence","file":"references/review-templates.md","pattern":"Path traversal sequence","snippet":"Fill-in templates for each review step, a worked example, the quick checklist, and review tips. Refe","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:references/review-templates.md:108:path-traversal-sequence","file":"references/review-templates.md","pattern":"Path traversal sequence","snippet":"This compliance gate is the C3 **Content** review ([ART](../../../../references/c3/art-content-bench","category":"filesystem","line_end":108,"severity":"high","line_start":108},{"id":"blocker:references/review-templates.md:128:system-reconnaissance","file":"references/review-templates.md","pattern":"System reconnaissance","snippet":"- [ ] \"Paid partnership\" feature","category":"blocker","line_end":128,"severity":"low","line_start":128},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- A creator delivers a draft (post, video, image, caption) against a brief from `brief-generator`","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Before `content-amplifier` puts paid or owned reach behind a creator post","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":37,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":41,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":43,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":47,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Reads**: the content submission (link, description, caption, media notes), the campaign brief an","category":"external_commands","line_end":48,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Writes**: a gated review artifact at `memory/audits/influencer/YYYY-MM-DD-<topic>.md` with `clas","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Promotes**: durable facts (final approval status, recurring compliance gaps, creator-specific no","category":"external_commands","line_end":54,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. The gated artifact follows the auditor-runbook schema: `raw_overall_score` = the ART score; a **T","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Specifically, emit the auditor-class handoff from [auditor-runbook.md §1](../../../references/audito","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~social platform analytics` — pull native post specs, engagement signals, and platform disclosur","category":"external_commands","line_end":70,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~influencer database` — load the creator's history, prior submissions, and past compliance flags","category":"external_commands","line_end":71,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~CRM` — link the review back to the deal, campaign owner, and approval chain.","category":"external_commands","line_end":72,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~compliance reference` — current FTC / platform disclosure rules for the relevant market.","category":"external_commands","line_end":78,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Before scoring, `Read ../../../references/auditor-runbook.md` and `../../../references/c3/art-cont","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"*Standalone install fallback*: if that relative path does not exist, this skill was installed standa","category":"external_commands","line_end":80,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [ ] `cap_applied`, `raw_overall_score`, `final_overall_score` set per the runbook (final omitted o","category":"external_commands","line_end":125,"severity":"medium","line_start":125},{"id":"network:SKILL.md:10:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://github.com/aaron-he-zhu/aaron-marketing-skills\"","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"metadata: {\"author\": \"aaron-he-zhu\", \"version\": \"13.0.0\", \"discipline\": \"influencer\", \"phase\": \"acti","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:80:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"*Standalone install fallback*: if that relative path does not exist, this skill was installed standa","category":"network","line_end":80,"severity":"low","line_start":80},{"id":"filesystem:SKILL.md:47:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Reads**: the content submission (link, description, caption, media notes), the campaign brief an","category":"filesystem","line_end":47,"severity":"high","line_start":47},{"id":"filesystem:SKILL.md:55:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Primary next skill**: [contract-helper](../contract-helper/SKILL.md)","category":"filesystem","line_end":55,"severity":"high","line_start":55},{"id":"filesystem:SKILL.md:59:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> Emit the standard shape from [skill-contract.md §Handoff Summary Format](../../../references/skill","category":"filesystem","line_end":59,"severity":"high","line_start":59},{"id":"filesystem:SKILL.md:61:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Specifically, emit the auditor-class handoff from [auditor-runbook.md §1](../../../references/audito","category":"filesystem","line_end":61,"severity":"high","line_start":61},{"id":"filesystem:SKILL.md:74:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"With no connector configured, ask the user for the missing inputs and proceed. See [CONNECTORS.md](.","category":"filesystem","line_end":74,"severity":"high","line_start":74},{"id":"filesystem:SKILL.md:78:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Before scoring, `Read ../../../references/auditor-runbook.md` and `../../../references/c3/art-cont","category":"filesystem","line_end":78,"severity":"high","line_start":78},{"id":"filesystem:SKILL.md:80:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"*Standalone install fallback*: if that relative path does not exist, this skill was installed standa","category":"filesystem","line_end":80,"severity":"high","line_start":80},{"id":"filesystem:SKILL.md:95:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Step 4's compliance gate is the C3 **Content** review ([ART](../../../references/c3/art-content-benc","category":"filesystem","line_end":95,"severity":"high","line_start":95},{"id":"filesystem:SKILL.md:131:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [references/quality-review-aids.md](references/quality-review-aids.md) — wires the AI-slop checkli","category":"filesystem","line_end":131,"severity":"high","line_start":131},{"id":"filesystem:SKILL.md:132:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [skill-contract.md](../../../references/skill-contract.md) — shared contract and Handoff Summary f","category":"filesystem","line_end":132,"severity":"high","line_start":132},{"id":"filesystem:SKILL.md:133:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [state-model.md](../../../references/state-model.md) — memory tiers and save-path conventions.","category":"filesystem","line_end":133,"severity":"high","line_start":133},{"id":"filesystem:SKILL.md:134:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [CONNECTORS.md](../../../CONNECTORS.md) — keyless data recipes for the `~~` connector placeholders","category":"filesystem","line_end":134,"severity":"high","line_start":134},{"id":"filesystem:SKILL.md:135:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- C3 scoring: [c3-benchmark.md](../../../references/c3-benchmark.md) and [c3/art-content-benchmark.m","category":"filesystem","line_end":135,"severity":"high","line_start":135},{"id":"filesystem:SKILL.md:136:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [offer-claims-registry](../../../protocol/offer-claims-registry/SKILL.md) — the claim-substantiati","category":"filesystem","line_end":136,"severity":"high","line_start":136},{"id":"filesystem:SKILL.md:137:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [creator-registry](../../../protocol/creator-registry/SKILL.md) — the creator's disclosure/complia","category":"filesystem","line_end":137,"severity":"high","line_start":137},{"id":"filesystem:SKILL.md:138:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [brief-generator](../../plan/brief-generator/SKILL.md) — the brief whose criteria this review chec","category":"filesystem","line_end":138,"severity":"high","line_start":138},{"id":"filesystem:SKILL.md:139:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [contract-helper](../contract-helper/SKILL.md) — bake content guidelines and approval terms into t","category":"filesystem","line_end":139,"severity":"high","line_start":139},{"id":"filesystem:SKILL.md:140:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [content-amplifier](../content-amplifier/SKILL.md) — amplify content once approved.","category":"filesystem","line_end":140,"severity":"high","line_start":140},{"id":"filesystem:SKILL.md:141:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [performance-analyzer](../../measure/performance-analyzer/SKILL.md) — track how approved content p","category":"filesystem","line_end":141,"severity":"high","line_start":141},{"id":"filesystem:SKILL.md:145:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Primary**: [contract-helper](../contract-helper/SKILL.md) — once content is approved (or once revi","category":"filesystem","line_end":145,"severity":"high","line_start":145},{"id":"filesystem:SKILL.md:148:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [content-amplifier](../content-amplifier/SKILL.md) — when content is approved and ready to scale t","category":"filesystem","line_end":148,"severity":"high","line_start":148},{"id":"filesystem:SKILL.md:149:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [performance-analyzer](../../measure/performance-analyzer/SKILL.md) — when the piece is live and y","category":"filesystem","line_end":149,"severity":"high","line_start":149},{"id":"blocker:SKILL.md:28:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Before `content-amplifier` puts paid or owned reach behind a creator post","category":"blocker","line_end":28,"severity":"low","line_start":28},{"id":"blocker:SKILL.md:69:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- `~~social platform analytics` — pull native post specs, engagement signals, and platform disclosur","category":"blocker","line_end":69,"severity":"low","line_start":69},{"id":"blocker:SKILL.md:148:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- [content-amplifier](../content-amplifier/SKILL.md) — when content is approved and ready to scale t","category":"blocker","line_end":148,"severity":"low","line_start":148}],"finding_verdicts":[{"id":"filesystem:references/quality-review-aids.md:7:path-traversal-sequence","reason":"This is a fixed Markdown link to repository reference material. No executable file operation or user-controlled path traversal is present.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:references/quality-review-aids.md:17:path-traversal-sequence","reason":"This is a fixed Markdown link to repository reference material. No executable file operation or user-controlled path traversal is present.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:references/quality-review-aids.md:23:path-traversal-sequence","reason":"This is a fixed Markdown link to repository reference material. No executable file operation or user-controlled path traversal is present.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:references/quality-review-aids.md:24:path-traversal-sequence","reason":"This is a fixed Markdown link to repository reference material. No executable file operation or user-controlled path traversal is present.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:references/quality-review-aids.md:25:path-traversal-sequence","reason":"This is a fixed Markdown link to repository reference material. No executable file operation or user-controlled path traversal is present.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:references/quality-review-aids.md:26:path-traversal-sequence","reason":"This is a fixed Markdown link to repository reference material. No executable file operation or user-controlled path traversal is present.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:references/quality-review-aids.md:27:path-traversal-sequence","reason":"This is a fixed Markdown link to repository reference material. No executable file operation or user-controlled path traversal is present.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:references/review-templates.md:3:path-traversal-sequence","reason":"This is a fixed Markdown link to repository reference material. No executable file operation or user-controlled path traversal is present.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:references/review-templates.md:108:path-traversal-sequence","reason":"This is a fixed Markdown link to repository reference material. No executable file operation or user-controlled path traversal is present.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/review-templates.md:128:system-reconnaissance","reason":"The phrase is used as marketing workflow text, a connector label, or a platform disclosure label. It is not system reconnaissance, privilege escalation, or an instruction to bypass review.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline-code formatting or fenced prompt examples, not Ruby or shell execution. The skill contains no command invocation or user-input command construction at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:10:hardcoded-url","reason":"This URL is repository metadata or homepage text, not an instruction to send data over the network. There is no credential transfer, webhook, or runtime request at this location.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:14:hardcoded-url","reason":"This URL is repository metadata or homepage text, not an instruction to send data over the network. There is no credential transfer, webhook, or runtime request at this location.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:80:hardcoded-url","reason":"The standalone fallback instructs the host to fetch reference files from raw.githubusercontent.com on the mutable main branch. That outbound fetch can pull changed content at runtime, creating low supply-chain and privacy risk.","verdict":"confirmed","severity":"low","confidence":0.84},{"id":"filesystem:SKILL.md:47:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:55:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:59:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:61:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:74:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:78:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:80:path-traversal-sequence","reason":"The traversal text is a fixed relative reference path, not a user-controlled file path. The remote-fetch concern on the same line is handled by the network verdict.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:95:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:131:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:132:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:133:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:134:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:135:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:136:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:137:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:138:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:139:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:140:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:141:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:145:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:148:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:149:path-traversal-sequence","reason":"This is a fixed Markdown link or documented in-repository reference used by the skill instructions. It does not construct paths from user input or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.95},{"id":"blocker:SKILL.md:28:system-reconnaissance","reason":"The phrase is used as marketing workflow text, a connector label, or a platform disclosure label. It is not system reconnaissance, privilege escalation, or an instruction to bypass review.","verdict":"false_positive","confidence":0.95},{"id":"blocker:SKILL.md:69:system-reconnaissance","reason":"The phrase is used as marketing workflow text, a connector label, or a platform disclosure label. It is not system reconnaissance, privilege escalation, or an instruction to bypass review.","verdict":"false_positive","confidence":0.95},{"id":"blocker:SKILL.md:148:system-reconnaissance","reason":"The phrase is used as marketing workflow text, a connector label, or a platform disclosure label. It is not system reconnaissance, privilege escalation, or an instruction to bypass review.","verdict":"false_positive","confidence":0.95}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}