{"data":{"skill":{"slug":"aaron-he-zhu-influencer-discovery","name":"influencer-discovery","icon":"📦","repo":"https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/influencer/discover/influencer-discovery","status":"approved","author":"aaron-he-zhu","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"e9e63aa7-8625-42b0-8724-eb5036fa2c26","skill_id":"8ce42884-e928-4530-962f-aefe3ada6716","version":3,"content_hash":"8294d4e9f6c1fde113723de6348e6901","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static findings are false positives caused by Markdown code fences, inline backticks, relative documentation links, and public URLs. The skill does include an optional YouTube connector command that can execute local code and consume a YouTube API key, so that path needs explicit opt-in. I found no prompt injection text or malicious data-exfiltration intent in the reviewed files.","remediation":[{"issue":"Optional YouTube connector command can execute local code and use an API key.","severity":"high","suggestion":"Require explicit user confirmation before running the connector, validate the handle argument, and state what data is sent to YouTube."},{"issue":"Connector instructions depend on files outside this skill package.","severity":"medium","suggestion":"Package required connector documentation with the skill or replace parent-directory paths with marketplace-safe references."}],"risk_factor_evidence":[{"factor":"env_access","evidence":[{"file":"references/creator-dossier.md","line_end":28,"line_start":28},{"file":"references/creator-dossier.md","line_end":74,"line_start":74},{"file":"SKILL.md","line_end":59,"line_start":59}]},{"factor":"filesystem","evidence":[{"file":"references/platform-vetting.md","line_end":7,"line_start":7},{"file":"references/platform-vetting.md","line_end":8,"line_start":8},{"file":"references/platform-vetting.md","line_end":9,"line_start":9},{"file":"references/platform-vetting.md","line_end":10,"line_start":10},{"file":"references/platform-vetting.md","line_end":11,"line_start":11},{"file":"references/templates.md","line_end":3,"line_start":3},{"file":"references/templates.md","line_end":207,"line_start":207},{"file":"references/templates.md","line_end":281,"line_start":281},{"file":"references/templates.md","line_end":282,"line_start":282},{"file":"references/templates.md","line_end":283,"line_start":283},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":74,"line_start":74},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":90,"line_start":90},{"file":"SKILL.md","line_end":91,"line_start":91},{"file":"SKILL.md","line_end":95,"line_start":95},{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":99,"line_start":99},{"file":"SKILL.md","line_end":105,"line_start":105},{"file":"SKILL.md","line_end":106,"line_start":106},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":108,"line_start":108}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":24,"line_start":22},{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":29,"line_start":26},{"file":"SKILL.md","line_end":33,"line_start":29},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":50,"line_start":35},{"file":"SKILL.md","line_end":52,"line_start":50},{"file":"SKILL.md","line_end":53,"line_start":52},{"file":"SKILL.md","line_end":54,"line_start":53},{"file":"SKILL.md","line_end":55,"line_start":54},{"file":"SKILL.md","line_end":57,"line_start":55},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":74,"line_start":74}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":57,"line_start":57}]}],"critical_findings":[],"high_findings":[{"title":"Path traversal sequence","locations":[{"file":"SKILL.md","line_end":59,"line_start":59}],"confidence":0.66,"description":"**Measured YouTube metrics (free key)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scripts/connectors/youtube.","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"Line 59 points to a connector script under CLAUDE_PLUGIN_ROOT and a parent-directory README path. This can move execution and documentation trust outside the skill package."},{"title":"Generic API/secret keys","locations":[{"file":"SKILL.md","line_end":59,"line_start":59}],"confidence":0.74,"description":"**Measured YouTube metrics (free key)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scripts/connectors/youtube.","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"Line 59 names YOUTUBE_API_KEY and implies the connector will consume that secret for API calls. The use appears bounded, but environment-secret access needs opt-in handling."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":59,"line_start":59}],"confidence":0.78,"description":"**Measured YouTube metrics (free key)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scripts/connectors/youtube.","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Line 59 instructs use of a local python3 connector command with a handle argument. This is legitimate for YouTube metrics, but it can execute local code and should require explicit user approval."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":4,"total_lines":600,"audit_model":"codex","audited_at":"2026-07-06T17:27:01.749+00:00","created_at":"2026-07-07T02:33:51.616681+00:00","static_findings":[{"id":"env_access:references/creator-dossier.md:28:configuration-library","file":"references/creator-dossier.md","pattern":"Configuration library","snippet":"`unconfirmed` rather than guessing — an honest gap is more useful than a fake fact.","category":"env_access","line_end":28,"severity":"low","line_start":28},{"id":"env_access:references/creator-dossier.md:74:configuration-library","file":"references/creator-dossier.md","pattern":"Configuration library","snippet":"6. **No public path found** — record `unconfirmed` and flag that outreach must","category":"env_access","line_end":74,"severity":"low","line_start":74},{"id":"blocker:references/creator-dossier.md:5:system-reconnaissance","file":"references/creator-dossier.md","pattern":"System reconnaissance","snippet":"public pages, the creator's own posts, and inputs the user shares. No paid tools,","category":"blocker","line_end":5,"severity":"low","line_start":5},{"id":"filesystem:references/platform-vetting.md:7:path-traversal-sequence","file":"references/platform-vetting.md","pattern":"Path traversal sequence","snippet":"| X / Twitter | [../../../references/platforms/x.md](../../../../references/platforms/x.md) | reply-","category":"filesystem","line_end":7,"severity":"high","line_start":7},{"id":"filesystem:references/platform-vetting.md:8:path-traversal-sequence","file":"references/platform-vetting.md","pattern":"Path traversal sequence","snippet":"| LinkedIn | [../../../references/platforms/linkedin.md](../../../../references/platforms/linkedin.m","category":"filesystem","line_end":8,"severity":"high","line_start":8},{"id":"filesystem:references/platform-vetting.md:9:path-traversal-sequence","file":"references/platform-vetting.md","pattern":"Path traversal sequence","snippet":"| TikTok | [../../../references/platforms/tiktok.md](../../../../references/platforms/tiktok.md) | v","category":"filesystem","line_end":9,"severity":"high","line_start":9},{"id":"filesystem:references/platform-vetting.md:10:path-traversal-sequence","file":"references/platform-vetting.md","pattern":"Path traversal sequence","snippet":"| YouTube | [../../../references/platforms/youtube.md](../../../../references/platforms/youtube.md) ","category":"filesystem","line_end":10,"severity":"high","line_start":10},{"id":"filesystem:references/platform-vetting.md:11:path-traversal-sequence","file":"references/platform-vetting.md","pattern":"Path traversal sequence","snippet":"| Reddit | [../../../references/platforms/reddit.md](../../../../references/platforms/reddit.md) | k","category":"filesystem","line_end":11,"severity":"high","line_start":11},{"id":"filesystem:references/templates.md:3:path-traversal-sequence","file":"references/templates.md","pattern":"Path traversal sequence","snippet":"Fill-in scaffolds for each step of [SKILL.md](../SKILL.md): the search-criteria","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:references/templates.md:207:path-traversal-sequence","file":"references/templates.md","pattern":"Path traversal sequence","snippet":"> defensible score is computed downstream by [fit-scorer](../../fit-scorer/SKILL.md).","category":"filesystem","line_end":207,"severity":"high","line_start":207},{"id":"filesystem:references/templates.md:281:path-traversal-sequence","file":"references/templates.md","pattern":"Path traversal sequence","snippet":"1. Review top recommendations with [fit-scorer](../../fit-scorer/SKILL.md)","category":"filesystem","line_end":281,"severity":"high","line_start":281},{"id":"filesystem:references/templates.md:282:path-traversal-sequence","file":"references/templates.md","pattern":"Path traversal sequence","snippet":"2. Develop outreach strategy with [outreach-manager](../../../activate/outreach-manager/SKILL.md)","category":"filesystem","line_end":282,"severity":"high","line_start":282},{"id":"filesystem:references/templates.md:283:path-traversal-sequence","file":"references/templates.md","pattern":"Path traversal sequence","snippet":"3. Create campaign briefs with [brief-generator](../../../plan/brief-generator/SKILL.md)","category":"filesystem","line_end":283,"severity":"high","line_start":283},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":24,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":29,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":33,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Reads**: brand/product, niche or category, target platforms, follower range, engagement floor, l","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Writes**: discovery results to `memory/influencer/influencer-discovery/YYYY-MM-DD-<topic>.md` — ","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Promotes**: durable facts (top-tier handles, confirmed niche/platform mix, competitor-saturated ","category":"external_commands","line_end":50,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Where a tool *could* sharpen results, use `~~` connector placeholders:","category":"external_commands","line_end":52,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~influencer database` — bulk discovery, follower/engagement metrics, audience demographics.","category":"external_commands","line_end":53,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~social platform analytics` — native creator-marketplace data, trending sounds, related accounts","category":"external_commands","line_end":54,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~CRM` — import the shortlist and dedupe against existing partners.","category":"external_commands","line_end":55,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~audience overlap` — estimate creator-audience vs. brand-audience match.","category":"external_commands","line_end":57,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Keyless candidate-card metadata (oEmbed)**: YouTube (`https://www.youtube.com/oembed?url=<video-ur","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Measured YouTube metrics (free key)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scripts/connectors/youtube.","category":"external_commands","line_end":59,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Save the report to `memory/influencer/influencer-discovery/YYYY-MM-DD-<topic>.md` and promote top-ti","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"network:SKILL.md:10:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://github.com/aaron-he-zhu/aaron-marketing-skills\"","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"metadata: {\"author\": \"aaron-he-zhu\", \"version\": \"16.0.0\", \"discipline\": \"influencer\", \"phase\": \"disc","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:57:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"**Keyless candidate-card metadata (oEmbed)**: YouTube (`https://www.youtube.com/oembed?url=<video-ur","category":"network","line_end":57,"severity":"low","line_start":57},{"id":"filesystem:SKILL.md:33:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Reads**: brand/product, niche or category, target platforms, follower range, engagement floor, l","category":"filesystem","line_end":33,"severity":"high","line_start":33},{"id":"filesystem:SKILL.md:40:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Primary next skill**: [fit-scorer](../fit-scorer/SKILL.md) — score and rank the discovered candi","category":"filesystem","line_end":40,"severity":"high","line_start":40},{"id":"filesystem:SKILL.md:44:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> Emit the standard shape from [skill-contract.md §Handoff Summary Format](../../../references/skill","category":"filesystem","line_end":44,"severity":"high","line_start":44},{"id":"filesystem:SKILL.md:59:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Measured YouTube metrics (free key)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scripts/connectors/youtube.","category":"filesystem","line_end":59,"severity":"high","line_start":59},{"id":"filesystem:SKILL.md:61:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"See [CONNECTORS.md](../../../CONNECTORS.md) for the free/keyless recipe per category and the opt-in ","category":"filesystem","line_end":61,"severity":"high","line_start":61},{"id":"filesystem:SKILL.md:65:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Each step has a fill-in block in [references/templates.md](references/templates.md) — copy the match","category":"filesystem","line_end":65,"severity":"high","line_start":65},{"id":"filesystem:SKILL.md:74:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Save the report to `memory/influencer/influencer-discovery/YYYY-MM-DD-<topic>.md` and promote top-ti","category":"filesystem","line_end":74,"severity":"high","line_start":74},{"id":"filesystem:SKILL.md:87:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [skill-contract.md](../../../references/skill-contract.md) — shared contract and Handoff Summary f","category":"filesystem","line_end":87,"severity":"high","line_start":87},{"id":"filesystem:SKILL.md:88:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [state-model.md](../../../references/state-model.md) — memory tiers and save-path conventions.","category":"filesystem","line_end":88,"severity":"high","line_start":88},{"id":"filesystem:SKILL.md:89:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [CONNECTORS.md](../../../CONNECTORS.md) — free/keyless data recipes and opt-in MCP layer.","category":"filesystem","line_end":89,"severity":"high","line_start":89},{"id":"filesystem:SKILL.md:90:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- C3 benchmark at [references/c3/scoring-architecture.md](../../../references/c3/scoring-architectur","category":"filesystem","line_end":90,"severity":"high","line_start":90},{"id":"filesystem:SKILL.md:91:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Siblings in the discover phase: [fit-scorer](../fit-scorer/SKILL.md), [audience-mapper](../audienc","category":"filesystem","line_end":91,"severity":"high","line_start":91},{"id":"filesystem:SKILL.md:95:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Primary**: [fit-scorer](../fit-scorer/SKILL.md) — score and rank the discovered candidates with we","category":"filesystem","line_end":95,"severity":"high","line_start":95},{"id":"filesystem:SKILL.md:98:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [competitor-tracker](../../plan/competitor-tracker/SKILL.md) — when discovery surfaced competitor-","category":"filesystem","line_end":98,"severity":"high","line_start":98},{"id":"filesystem:SKILL.md:99:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [audience-mapper](../audience-mapper/SKILL.md) — when the target audience is still fuzzy and crite","category":"filesystem","line_end":99,"severity":"high","line_start":99},{"id":"filesystem:SKILL.md:105:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [audience-mapper](../audience-mapper/SKILL.md) - Define who to reach","category":"filesystem","line_end":105,"severity":"high","line_start":105},{"id":"filesystem:SKILL.md:106:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [fit-scorer](../fit-scorer/SKILL.md) - Score and rank discovered influencers","category":"filesystem","line_end":106,"severity":"high","line_start":106},{"id":"filesystem:SKILL.md:107:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [competitor-tracker](../../plan/competitor-tracker/SKILL.md) - Find competitor influencers","category":"filesystem","line_end":107,"severity":"high","line_start":107},{"id":"filesystem:SKILL.md:108:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [outreach-manager](../../activate/outreach-manager/SKILL.md) - Contact discovered influencers","category":"filesystem","line_end":108,"severity":"high","line_start":108},{"id":"env_access:SKILL.md:59:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"**Measured YouTube metrics (free key)**: `python3 \"${CLAUDE_PLUGIN_ROOT}/scripts/connectors/youtube.","category":"env_access","line_end":59,"severity":"high","line_start":59}],"finding_verdicts":[{"id":"env_access:references/creator-dossier.md:28:configuration-library","reason":"The flagged text is the literal output value `unconfirmed` in a creator dossier template. It does not access environment variables, configuration files, or secrets.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/creator-dossier.md:74:configuration-library","reason":"The flagged text is the literal output value `unconfirmed` in a creator dossier template. It does not access environment variables, configuration files, or secrets.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/creator-dossier.md:5:system-reconnaissance","reason":"The line limits the skill to public creator pages, user-provided inputs, and no login-gated scraping. It is not system reconnaissance or host discovery.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/platform-vetting.md:7:path-traversal-sequence","reason":"The parent-directory sequence appears inside fixed Markdown links to shared platform playbooks. It is not user-controlled path traversal or a file write.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:references/platform-vetting.md:8:path-traversal-sequence","reason":"The parent-directory sequence appears inside fixed Markdown links to shared platform playbooks. It is not user-controlled path traversal or a file write.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:references/platform-vetting.md:9:path-traversal-sequence","reason":"The parent-directory sequence appears inside fixed Markdown links to shared platform playbooks. It is not user-controlled path traversal or a file write.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:references/platform-vetting.md:10:path-traversal-sequence","reason":"The parent-directory sequence appears inside fixed Markdown links to shared platform playbooks. It is not user-controlled path traversal or a file write.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:references/platform-vetting.md:11:path-traversal-sequence","reason":"The parent-directory sequence appears inside fixed Markdown links to shared platform playbooks. It is not user-controlled path traversal or a file write.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:references/templates.md:3:path-traversal-sequence","reason":"The parent-directory sequence is a fixed Markdown link to this skill or related workflow skills. It does not read sensitive files or construct paths from user input.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:references/templates.md:207:path-traversal-sequence","reason":"The parent-directory sequence is a fixed Markdown link to this skill or related workflow skills. It does not read sensitive files or construct paths from user input.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:references/templates.md:281:path-traversal-sequence","reason":"The parent-directory sequence is a fixed Markdown link to this skill or related workflow skills. It does not read sensitive files or construct paths from user input.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:references/templates.md:282:path-traversal-sequence","reason":"The parent-directory sequence is a fixed Markdown link to this skill or related workflow skills. It does not read sensitive files or construct paths from user input.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:references/templates.md:283:path-traversal-sequence","reason":"The parent-directory sequence is a fixed Markdown link to this skill or related workflow skills. It does not read sensitive files or construct paths from user input.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown code fences around natural-language prompt examples. They do not contain shell syntax or executable Ruby backtick calls.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown code fences around natural-language prompt examples. They do not contain shell syntax or executable Ruby backtick calls.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown code fences around natural-language prompt examples. They do not contain shell syntax or executable Ruby backtick calls.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown code fences around natural-language prompt examples. They do not contain shell syntax or executable Ruby backtick calls.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown formatting for paths, connector placeholders, or skill names. This line does not invoke a shell command or pass user input to execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown formatting for paths, connector placeholders, or skill names. This line does not invoke a shell command or pass user input to execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown formatting for paths, connector placeholders, or skill names. This line does not invoke a shell command or pass user input to execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown formatting for paths, connector placeholders, or skill names. This line does not invoke a shell command or pass user input to execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown formatting for paths, connector placeholders, or skill names. This line does not invoke a shell command or pass user input to execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown formatting for paths, connector placeholders, or skill names. This line does not invoke a shell command or pass user input to execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown formatting for paths, connector placeholders, or skill names. This line does not invoke a shell command or pass user input to execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown formatting for paths, connector placeholders, or skill names. This line does not invoke a shell command or pass user input to execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The backticked content is an official oEmbed URL example, not a command. No local process execution is requested on this line.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"Line 59 instructs use of a local python3 connector command with a handle argument. This is legitimate for YouTube metrics, but it can execute local code and should require explicit user approval.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown formatting for paths, connector placeholders, or skill names. This line does not invoke a shell command or pass user input to execution.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:10:hardcoded-url","reason":"The URL is repository metadata in the skill front matter. It does not initiate a network request or transmit user data.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL is repository metadata in the skill front matter. It does not initiate a network request or transmit user data.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:57:hardcoded-url","reason":"The URLs are public oEmbed endpoints for optional metadata lookup from pasted post links. They do not include credentials or an attacker-controlled destination.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:33:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:40:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:44:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:59:path-traversal-sequence","reason":"Line 59 points to a connector script under CLAUDE_PLUGIN_ROOT and a parent-directory README path. This can move execution and documentation trust outside the skill package.","verdict":"confirmed","severity":"high","confidence":0.66},{"id":"filesystem:SKILL.md:61:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:65:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:74:path-traversal-sequence","reason":"The line writes to fixed memory paths for the skill output and candidate notes. The parent-directory signal comes from a documentation link, not user-controlled traversal.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:87:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:88:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:89:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:90:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:91:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:95:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:98:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:99:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:105:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:106:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:107:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:SKILL.md:108:path-traversal-sequence","reason":"The flagged text is a fixed documentation or sibling-skill link using relative Markdown paths. It is not arbitrary filesystem traversal or a secret file access pattern.","verdict":"false_positive","confidence":0.84},{"id":"env_access:SKILL.md:59:generic-api-secret-keys","reason":"Line 59 names YOUTUBE_API_KEY and implies the connector will consume that secret for API calls. The use appears bounded, but environment-secret access needs opt-in handling.","verdict":"confirmed","severity":"high","confidence":0.74}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}