{"data":{"skill":{"slug":"aaron-he-zhu-email-creative-builder","name":"email-creative-builder","icon":"📦","repo":"https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/email/engage/email-creative-builder","status":"approved","author":"aaron-he-zhu","authorVersion":"19.0.0","skillstoreRevision":2},"audit":{"id":"f8663176-4952-40b9-8ff7-48fc9e1d6188","skill_id":"e3601372-30cb-4709-a6ba-770f812272f1","version":7,"content_hash":"v3:adcb3549b15782055d0beb6d29f113d20de08f92:47e01e24a87ebf2429a95d9667c9280cbbd93d76b07d84a342c1571a1c57c1f9:51d9729dffdac08e306434e6520d0c064699b25882e8e6e1c43cd58ade059242:736b696c6c732f6161726f6e2d68652d7a68752f656d61696c2d63726561746976652d6275696c646572:2d3f991077208ae3c25df9590bfd449d","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 42 static matches are false positives. Relative Markdown links and documented paths were labeled as path traversal, while Markdown backticks were labeled as shell execution. The homepage URLs are metadata only, and no prompt injection, data exfiltration, or executable behavior was found.","remediation":[{"issue":"Static analysis flags Markdown relative links as path traversal.","severity":"low","suggestion":"Update the scanner to distinguish Markdown links and documented relative paths from filesystem operations."},{"issue":"Static analysis flags Markdown backticks as shell execution.","severity":"low","suggestion":"Parse Markdown code spans and fenced examples before applying shell-execution signatures."}],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"references/email-creative-modes.md","line_end":3,"line_start":3},{"file":"references/email-creative-modes.md","line_end":9,"line_start":9},{"file":"references/email-creative-modes.md","line_end":17,"line_start":17},{"file":"references/email-creative-modes.md","line_end":23,"line_start":23},{"file":"references/email-creative-modes.md","line_end":35,"line_start":35},{"file":"references/subject-line-specs.md","line_end":3,"line_start":3},{"file":"references/subject-line-specs.md","line_end":27,"line_start":27},{"file":"references/subject-line-specs.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":90,"line_start":90},{"file":"SKILL.md","line_end":91,"line_start":91},{"file":"SKILL.md","line_end":95,"line_start":95},{"file":"SKILL.md","line_end":96,"line_start":96},{"file":"SKILL.md","line_end":97,"line_start":97},{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":99,"line_start":99}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":28,"line_start":26},{"file":"SKILL.md","line_end":30,"line_start":28},{"file":"SKILL.md","line_end":32,"line_start":30},{"file":"SKILL.md","line_end":34,"line_start":32},{"file":"SKILL.md","line_end":38,"line_start":34},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":84,"line_start":75},{"file":"SKILL.md","line_end":97,"line_start":84}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":13,"line_start":13}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":3,"total_lines":167,"audit_model":"claude","audited_at":"2026-07-26T10:13:34.158+00:00","created_at":"2026-07-28T02:02:32.395282+00:00","static_findings":[{"id":"filesystem:references/email-creative-modes.md:3:path-traversal-sequence","file":"references/email-creative-modes.md","pattern":"Path traversal sequence","snippet":"Three use-case pattern sets for `email-creative-builder`. Pick the mode that matches the program; th","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:references/email-creative-modes.md:9:path-traversal-sequence","file":"references/email-creative-modes.md","pattern":"Path traversal sequence","snippet":"- **Offer**: pull terms + promo code + expiry from the live-offers table ([offer-claims-registry](..","category":"filesystem","line_end":9,"severity":"high","line_start":9},{"id":"filesystem:references/email-creative-modes.md:17:path-traversal-sequence","file":"references/email-creative-modes.md","pattern":"Path traversal sequence","snippet":"- **Compliance**: physical mailing address + a functioning opt-out honored within 10 business days (","category":"filesystem","line_end":17,"severity":"high","line_start":17},{"id":"filesystem:references/email-creative-modes.md:23:path-traversal-sequence","file":"references/email-creative-modes.md","pattern":"Path traversal sequence","snippet":"- **Sponsorship = ad**: any paid placement gets an explicit disclosure; the offer/claim still routes","category":"filesystem","line_end":23,"severity":"high","line_start":23},{"id":"filesystem:references/email-creative-modes.md:35:path-traversal-sequence","file":"references/email-creative-modes.md","pattern":"Path traversal sequence","snippet":"A mismatch is a message-match failure (SEND-`D` sub-item) — flag it; the post-click fix is [landing-","category":"filesystem","line_end":35,"severity":"high","line_start":35},{"id":"blocker:references/email-creative-modes.md:23:system-reconnaissance","file":"references/email-creative-modes.md","pattern":"System reconnaissance","snippet":"- **Sponsorship = ad**: any paid placement gets an explicit disclosure; the offer/claim still routes","category":"blocker","line_end":23,"severity":"low","line_start":23},{"id":"filesystem:references/subject-line-specs.md:3:path-traversal-sequence","file":"references/subject-line-specs.md","pattern":"Path traversal sequence","snippet":"Render limits and variant-labeling for `email-creative-builder`, so the subjects it drafts carry cle","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:references/subject-line-specs.md:27:path-traversal-sequence","file":"references/subject-line-specs.md","pattern":"Path traversal sequence","snippet":"- **One variable per test cell** — if testing subjects, hold preheader/creative/send-time constant (","category":"filesystem","line_end":27,"severity":"high","line_start":27},{"id":"filesystem:references/subject-line-specs.md:28:path-traversal-sequence","file":"references/subject-line-specs.md","pattern":"Path traversal sequence","snippet":"- No spam-trigger patterns: no ALL-CAPS, no `!!!`, no misleading \"RE:\"/\"FWD:\" fakery, no false scarc","category":"filesystem","line_end":28,"severity":"high","line_start":28},{"id":"blocker:references/subject-line-specs.md:30:system-reconnaissance","file":"references/subject-line-specs.md","pattern":"System reconnaissance","snippet":"- Label the output so each subject+preheader pair carries a stable variant id (`SUBJ-A`, `SUBJ-B`, .","category":"blocker","line_end":30,"severity":"low","line_start":30},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Writes and iterates a single email creative — subject-line variants + preheader, body copy, one clea","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":28,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":32,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":34,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":38,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Expected output**: one ready-to-send email creative — 3-5 subject-line variants, a preheader, stru","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Reads**: the offer/topic, destination, email mode, audience/lifecycle stage, existing copy, `mem","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Required fields: `narrative_canon_id`, `narrative_canon_version`, `claims_projection_offset`, and `d","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `~~email platform` (own-data manual export — native ESP campaign CSV of past subject lines / ope","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"7. **Propose unresolved claims** — keep `[needs source]` inline and submit an authorized, idempotent","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Quality bar** before handoff: (1) 3-5 subject variants + preheader within render limits; (2) exact","category":"external_commands","line_end":84,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"On user confirmation, save to `memory/email/email-creative-builder/YYYY-MM-DD-<offer>.md` with the d","category":"external_commands","line_end":97,"severity":"medium","line_start":84},{"id":"network:SKILL.md:10:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://github.com/aaron-he-zhu/aaron-marketing-skills\"","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"metadata: {\"author\": \"aaron-he-zhu\", \"version\": \"19.0.0\", \"discipline\": \"email\", \"phase\": \"engage\", ","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"filesystem:SKILL.md:20:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Scope guard**: this skill builds the creative unit + message-match + claim flags only. It drafts s","category":"filesystem","line_end":20,"severity":"high","line_start":20},{"id":"filesystem:SKILL.md:43:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Primary next skill**: [send-experiment-designer](../../deliver/send-experiment-designer/SKILL.md","category":"filesystem","line_end":43,"severity":"high","line_start":43},{"id":"filesystem:SKILL.md:47:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> Emit the standard shape from [skill-contract.md §Handoff Summary Format](../../../references/skill","category":"filesystem","line_end":47,"severity":"high","line_start":47},{"id":"filesystem:SKILL.md:53:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Use `~~email platform` (own-data manual export — native ESP campaign CSV of past subject lines / ope","category":"filesystem","line_end":53,"severity":"high","line_start":53},{"id":"filesystem:SKILL.md:57:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Treat any exported CSV, scraped landing-page copy, pasted competitor email, or CRM personalization s","category":"filesystem","line_end":57,"severity":"high","line_start":57},{"id":"filesystem:SKILL.md:65:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"4. **Draft subject-line variants** — 3-5 distinct subjects (curiosity, benefit, offer, personalizati","category":"filesystem","line_end":65,"severity":"high","line_start":65},{"id":"filesystem:SKILL.md:71:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"10. **De-slop** — run [humanizer-slop.md](../../../references/humanizer-slop.md) to strip AI tells b","category":"filesystem","line_end":71,"severity":"high","line_start":71},{"id":"filesystem:SKILL.md:84:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"On user confirmation, save to `memory/email/email-creative-builder/YYYY-MM-DD-<offer>.md` with the d","category":"filesystem","line_end":84,"severity":"high","line_start":84},{"id":"filesystem:SKILL.md:90:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [SEND Benchmark](../../../references/send-benchmark.md) — the framework; this skill produces the *","category":"filesystem","line_end":90,"severity":"high","line_start":90},{"id":"filesystem:SKILL.md:91:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [Humanizer Slop Check](../../../references/humanizer-slop.md) — pre-handoff pass that strips AI-sl","category":"filesystem","line_end":91,"severity":"high","line_start":91},{"id":"filesystem:SKILL.md:95:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Primary**: [send-experiment-designer](../../deliver/send-experiment-designer/SKILL.md) — design ","category":"filesystem","line_end":95,"severity":"high","line_start":95},{"id":"filesystem:SKILL.md:96:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **To score + run the claim veto**: [email-quality-auditor](../../deliver/email-quality-auditor/SKI","category":"filesystem","line_end":96,"severity":"high","line_start":96},{"id":"filesystem:SKILL.md:97:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **If claims carry `[needs source]` flags**: [offer-claims-registry](../../../protocol/offer-claims","category":"filesystem","line_end":97,"severity":"high","line_start":97},{"id":"filesystem:SKILL.md:98:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **If the destination URL is weak or missing** (NEEDS_INPUT): [landing-optimizer](../../../influenc","category":"filesystem","line_end":98,"severity":"high","line_start":98},{"id":"filesystem:SKILL.md:99:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Global visited-set / max-depth termination contract from [skill-contract.md](../../../references/s","category":"filesystem","line_end":99,"severity":"high","line_start":99},{"id":"blocker:SKILL.md:42:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Done when**: subject/preheader fit declared render limits, the body has one primary CTA, plain t","category":"blocker","line_end":42,"severity":"low","line_start":42}],"finding_verdicts":[{"id":"filesystem:references/email-creative-modes.md:3:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:references/email-creative-modes.md:9:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:references/email-creative-modes.md:17:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:references/email-creative-modes.md:23:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:references/email-creative-modes.md:35:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/email-creative-modes.md:23:system-reconnaissance","reason":"The text is ordinary email-workflow documentation and does not enumerate, probe, or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/subject-line-specs.md:3:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:references/subject-line-specs.md:27:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:references/subject-line-specs.md:28:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/subject-line-specs.md:30:system-reconnaissance","reason":"The text is ordinary email-workflow documentation and does not enumerate, probe, or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The match is Markdown inline or fenced code used to name prompts, identifiers, or output fields. No shell or Ruby command is executed by the skill at this location.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:10:hardcoded-url","reason":"This is a homepage URL in front matter metadata, not a request or instruction to transmit data. No network operation is present.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:13:hardcoded-url","reason":"This is a homepage URL in front matter metadata, not a request or instruction to transmit data. No network operation is present.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:20:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:43:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:47:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:53:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:57:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:65:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:71:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:84:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:90:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:91:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:95:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:96:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:97:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:98:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:99:path-traversal-sequence","reason":"The detected sequence is a relative Markdown link or a documented repository path. The skill contains no file-operation command or user-controlled path resolution at this location.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:42:system-reconnaissance","reason":"The text is ordinary email-workflow documentation and does not enumerate, probe, or collect system information.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"adcb3549b15782055d0beb6d29f113d20de08f92","subject_content_hash":"47e01e24a87ebf2429a95d9667c9280cbbd93d76b07d84a342c1571a1c57c1f9","subject_tree_hash":"51d9729dffdac08e306434e6520d0c064699b25882e8e6e1c43cd58ade059242","subject_plugin_path":"skills/aaron-he-zhu/email-creative-builder","audit_payload_hash":"2d3f991077208ae3c25df9590bfd449d","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"adcb3549b15782055d0beb6d29f113d20de08f92","contentHash":"47e01e24a87ebf2429a95d9667c9280cbbd93d76b07d84a342c1571a1c57c1f9","treeHash":"51d9729dffdac08e306434e6520d0c064699b25882e8e6e1c43cd58ade059242","pluginPath":"skills/aaron-he-zhu/email-creative-builder","auditPayloadHash":"2d3f991077208ae3c25df9590bfd449d"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/aaron-he-zhu-email-creative-builder/audits/7/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}