{"data":{"skill":{"slug":"aaron-he-zhu-fit-scorer","name":"fit-scorer","icon":"📦","repo":"https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/influencer/discover/fit-scorer","status":"approved","author":"aaron-he-zhu","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"b5faa91e-0e10-47c6-ac3b-5222f6cb868f","skill_id":"11908cc5-9199-4e61-8c9d-f0da248e2a08","version":3,"content_hash":"d9f6486af0744eb9d9120e87798fa451","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Static alerts were mostly caused by Markdown fences, inline paths, and repository documentation links. I confirmed one medium-risk issue: the skill shows a shell-style YouTube connector command using a candidate handle, which needs validation and non-shell execution guidance. No prompt injection, credential exfiltration, or unauthorized network endpoint was found in the scanned files.","remediation":[{"issue":"Shell-style connector command accepts a candidate handle.","severity":"medium","suggestion":"Require user confirmation before running the connector, validate handles against a strict allowlist, and pass arguments without a shell."},{"issue":"Dynamic memory filenames are not explicitly constrained.","severity":"low","suggestion":"State that topic and handle values must be slugified and kept under the documented memory directories."},{"issue":"Relative documentation links trigger path traversal scanners.","severity":"low","suggestion":"Clarify that parent-directory links are documentation-only references, or replace them with marketplace-safe reference paths."}],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"references/scoring-templates.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":56,"line_start":56},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":95,"line_start":95},{"file":"SKILL.md","line_end":96,"line_start":96},{"file":"SKILL.md","line_end":97,"line_start":97},{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":99,"line_start":99},{"file":"SKILL.md","line_end":103,"line_start":103},{"file":"SKILL.md","line_end":106,"line_start":106},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":113,"line_start":113},{"file":"SKILL.md","line_end":114,"line_start":114},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":116,"line_start":116}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":30,"line_start":26},{"file":"SKILL.md","line_end":32,"line_start":30},{"file":"SKILL.md","line_end":36,"line_start":32},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":37},{"file":"SKILL.md","line_end":53,"line_start":38},{"file":"SKILL.md","line_end":54,"line_start":53},{"file":"SKILL.md","line_end":55,"line_start":54},{"file":"SKILL.md","line_end":56,"line_start":55},{"file":"SKILL.md","line_end":56,"line_start":56},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":84,"line_start":80},{"file":"SKILL.md","line_end":84,"line_start":84}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":13,"line_start":13}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":58,"line_start":58}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":58,"line_start":58}],"confidence":0.64,"description":"**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 \"${CLAUDE_PLUGIN_ROOT}/scri","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line shows a shell-style python3 connector command that includes a candidate handle. If copied into a shell without validating the handle, it creates command-injection risk and requires user approval."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":516,"audit_model":"codex","audited_at":"2026-07-06T17:17:14.849+00:00","created_at":"2026-07-07T02:35:53.131317+00:00","static_findings":[{"id":"filesystem:references/scoring-templates.md:3:path-traversal-sequence","file":"references/scoring-templates.md","pattern":"Path traversal sequence","snippet":"Per-dimension scoring tables, the final-score rollup, the multi-influencer comparison report, the cu","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":32,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":36,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Reads**: brand/campaign context, target audience definition, campaign goal, and a shortlist of i","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Writes**: a fit-score report (per-dimension raw scores, weighted totals, verdict, ranked compari","category":"external_commands","line_end":38,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Promotes**: top-ranked handles, final scores, and the go/pass verdict to `memory/hot-cache.md` s","category":"external_commands","line_end":53,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~influencer database` — follower counts, audience demographics, and partnership history.","category":"external_commands","line_end":54,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~social platform analytics` — engagement rate, comment quality samples, posting cadence, growth ","category":"external_commands","line_end":55,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~audience intelligence` — real-vs-bot follower estimates and audience overlap with your target.","category":"external_commands","line_end":56,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Roster record (keyless Tier 1)** — prior contact, response reputation, and delivery history come","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 \"${CLAUDE_PLUGIN_ROOT}/scri","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. **Score Partnership Potential** — partnership history, professionalism, exclusivity/availability,","category":"external_commands","line_end":84,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Save the report to `memory/influencer/fit-scorer/YYYY-MM-DD-<topic>.md` and promote top picks + verd","category":"external_commands","line_end":84,"severity":"medium","line_start":84},{"id":"network:SKILL.md:10:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://github.com/aaron-he-zhu/aaron-marketing-skills\"","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"metadata: {\"author\": \"aaron-he-zhu\", \"version\": \"16.0.0\", \"discipline\": \"influencer\", \"phase\": \"disc","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"filesystem:SKILL.md:36:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Reads**: brand/campaign context, target audience definition, campaign goal, and a shortlist of i","category":"filesystem","line_end":36,"severity":"high","line_start":36},{"id":"filesystem:SKILL.md:43:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Primary next skill**: [competitor-tracker](../../plan/competitor-tracker/SKILL.md) — benchmark y","category":"filesystem","line_end":43,"severity":"high","line_start":43},{"id":"filesystem:SKILL.md:47:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> Emit the standard shape from [skill-contract.md §Handoff Summary Format](../../../references/skill","category":"filesystem","line_end":47,"severity":"high","line_start":47},{"id":"filesystem:SKILL.md:56:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Roster record (keyless Tier 1)** — prior contact, response reputation, and delivery history come","category":"filesystem","line_end":56,"severity":"high","line_start":56},{"id":"filesystem:SKILL.md:58:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 \"${CLAUDE_PLUGIN_ROOT}/scri","category":"filesystem","line_end":58,"severity":"high","line_start":58},{"id":"filesystem:SKILL.md:60:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"With zero integrations, ask the user to supply each value the scoring tables request; the framework ","category":"filesystem","line_end":60,"severity":"high","line_start":60},{"id":"filesystem:SKILL.md:68:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**C3 ACE alignment & veto gate.** This skill is the C3 **Creator** scorer ([ACE](../../../references","category":"filesystem","line_end":68,"severity":"high","line_start":68},{"id":"filesystem:SKILL.md:95:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [skill-contract.md](../../../references/skill-contract.md) — shared contract and handoff summary f","category":"filesystem","line_end":95,"severity":"high","line_start":95},{"id":"filesystem:SKILL.md:96:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [state-model.md](../../../references/state-model.md) — memory tiers and save-path conventions.","category":"filesystem","line_end":96,"severity":"high","line_start":96},{"id":"filesystem:SKILL.md:97:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [CONNECTORS.md](../../../CONNECTORS.md) — free/keyless data recipe per connector category.","category":"filesystem","line_end":97,"severity":"high","line_start":97},{"id":"filesystem:SKILL.md:98:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Scoring rubric: [c3-benchmark.md](../../../references/c3-benchmark.md) (CVI rollup), [c3/ace-creat","category":"filesystem","line_end":98,"severity":"high","line_start":98},{"id":"filesystem:SKILL.md:99:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Sibling skills: [influencer-discovery](../influencer-discovery/SKILL.md), [competitor-tracker](../","category":"filesystem","line_end":99,"severity":"high","line_start":99},{"id":"filesystem:SKILL.md:103:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Primary**: [competitor-tracker](../../plan/competitor-tracker/SKILL.md) — benchmark your top-score","category":"filesystem","line_end":103,"severity":"high","line_start":103},{"id":"filesystem:SKILL.md:106:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [influencer-discovery](../influencer-discovery/SKILL.md) — if the shortlist is too thin to rank, s","category":"filesystem","line_end":106,"severity":"high","line_start":106},{"id":"filesystem:SKILL.md:107:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [audience-mapper](../audience-mapper/SKILL.md) — if audience-match scores are uncertain, tighten t","category":"filesystem","line_end":107,"severity":"high","line_start":107},{"id":"filesystem:SKILL.md:113:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [influencer-discovery](../influencer-discovery/SKILL.md) - Find influencers to score","category":"filesystem","line_end":113,"severity":"high","line_start":113},{"id":"filesystem:SKILL.md:114:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [competitor-tracker](../../plan/competitor-tracker/SKILL.md) - Benchmark against competitor partne","category":"filesystem","line_end":114,"severity":"high","line_start":114},{"id":"filesystem:SKILL.md:115:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [audience-mapper](../audience-mapper/SKILL.md) - Define target audience","category":"filesystem","line_end":115,"severity":"high","line_start":115},{"id":"filesystem:SKILL.md:116:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [outreach-manager](../../activate/outreach-manager/SKILL.md) - Contact top-scored influencers","category":"filesystem","line_end":116,"severity":"high","line_start":116},{"id":"env_access:SKILL.md:58:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 \"${CLAUDE_PLUGIN_ROOT}/scri","category":"env_access","line_end":58,"severity":"high","line_start":58}],"finding_verdicts":[{"id":"filesystem:references/scoring-templates.md:3:path-traversal-sequence","reason":"The ../ sequence appears only in a Markdown link from the reference file back to SKILL.md. It is documentation navigation, not file access using user-controlled input.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"This is the opening Markdown fence for a prompt example. It is not Ruby backtick execution or a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"This is the closing Markdown fence around a natural-language prompt example. No executable command is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"This is the opening Markdown fence for a comparison prompt example. It does not invoke an external process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"This is the closing Markdown fence for a prompt example. The fenced text is not code intended for execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The backticks wrap memory paths and a linked skill name in documentation. They do not define shell execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The line describes a report output path inside skill memory. It is not an external command.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The backticks identify memory/hot-cache.md as a documentation path. No command execution is requested on this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The backticks format a placeholder data source label. There is no executable command or command interpreter involved.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The backticks format a placeholder analytics source label. It is not a command invocation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The backticks format a placeholder audience intelligence source label. No external command is defined.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The line describes reading a roster record and references an optional CRM source. It does not execute a command.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The line shows a shell-style python3 connector command that includes a candidate handle. If copied into a shell without validating the handle, it creates command-injection risk and requires user approval.","verdict":"confirmed","severity":"medium","confidence":0.64},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The backticks format a memory directory reference for roster records. This is documentation text, not command execution.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The line tells the agent where to save a report and cache summary. It does not invoke a shell or external process.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:10:hardcoded-url","reason":"The hardcoded URL is a GitHub homepage metadata link. It is not used for runtime network access or data exfiltration.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL appears inside metadata as the project homepage. There is no instruction to send user data to this URL.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:36:path-traversal-sequence","reason":"The ../ sequence is in a Markdown link to a roster protocol document. The memory path uses a handle slug, and no arbitrary parent-directory traversal is instructed.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:SKILL.md:43:path-traversal-sequence","reason":"The traversal sequence appears in a relative Markdown link to another skill document. It is documentation navigation, not filesystem access.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:47:path-traversal-sequence","reason":"The line links to a shared reference document using a relative Markdown path. No user-controlled path is read or written.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:56:path-traversal-sequence","reason":"The parent-directory segment appears in a documentation link, and the roster path is described as a slugged memory file. This is not an instruction to traverse arbitrary paths.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:SKILL.md:58:path-traversal-sequence","reason":"The connector path uses CLAUDE_PLUGIN_ROOT and a fixed scripts/connectors/youtube.py suffix. It does not contain a parent-directory traversal sequence.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:60:path-traversal-sequence","reason":"The traversal sequence is in a relative Markdown link to CONNECTORS.md. It is not file access based on user input.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:68:path-traversal-sequence","reason":"The parent-directory segments are Markdown links to reference rubrics. They do not instruct the agent to read arbitrary filesystem locations.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:95:path-traversal-sequence","reason":"This is a relative Markdown link to a shared reference file. It is not an exploitable path traversal operation.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:96:path-traversal-sequence","reason":"This is a relative Markdown link to state-model.md. No user-provided path is involved.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:97:path-traversal-sequence","reason":"This is a relative Markdown link to CONNECTORS.md. It is documentation navigation only.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:98:path-traversal-sequence","reason":"The traversal sequences occur in Markdown links to C3 rubric documents. They are static documentation references, not path traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:99:path-traversal-sequence","reason":"The relative paths link to sibling skill documentation. They do not read or write user-controlled filesystem paths.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:103:path-traversal-sequence","reason":"The line contains a relative Markdown link to competitor-tracker documentation. It is not runtime filesystem access.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:106:path-traversal-sequence","reason":"The parent-directory path is a Markdown link to a sibling skill. It is not constructed from user input.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:107:path-traversal-sequence","reason":"The parent-directory path is a Markdown link to audience-mapper documentation. It is not executable file access.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:113:path-traversal-sequence","reason":"This related-skill entry is a static Markdown link. It does not create a path traversal vector.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:114:path-traversal-sequence","reason":"This related-skill entry is a static Markdown link to competitor-tracker. It is not filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:115:path-traversal-sequence","reason":"This related-skill entry is a static Markdown link to audience-mapper. No user-controlled path is used.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:116:path-traversal-sequence","reason":"This related-skill entry is a static Markdown link to outreach-manager. It is documentation navigation only.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:58:generic-api-secret-keys","reason":"The line names YOUTUBE_API_KEY as an optional credential for the intended YouTube connector. The scanned files do not embed a secret value or send it to an unrelated endpoint.","verdict":"false_positive","confidence":0.82}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}