{"data":{"skill":{"slug":"aaron-he-zhu-performance-analyzer","name":"performance-analyzer","icon":"📦","repo":"https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/influencer/measure/performance-analyzer","status":"approved","author":"aaron-he-zhu","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"71432034-6076-4606-9452-b3662d3905d9","skill_id":"92147f57-c617-4c39-a845-6d12f3c9ca16","version":7,"content_hash":"3cb78ef8806379873e22963c3d42a2af","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most findings are false positives caused by Markdown links, code fences, placeholders, and homepage metadata. One medium issue remains: the skill instructs the agent to run an optional Python YouTube connector from CLAUDE_PLUGIN_ROOT, which is legitimate but still external command execution. No prompt injection, data-exfiltration intent, or malicious override text was found in the reviewed files.","remediation":[{"issue":"Optional connector command in skill instructions","severity":"medium","suggestion":"State that command execution requires user confirmation, restrict it to a trusted plugin root, and document expected arguments."},{"issue":"YouTube API key handling is only briefly described","severity":"low","suggestion":"Clarify that the skill should never print, store, or expose YOUTUBE_API_KEY and should use user-managed credentials only."},{"issue":"Relative documentation links resemble traversal patterns","severity":"low","suggestion":"Keep links as documentation references and avoid phrasing that implies arbitrary filesystem reads outside the skill directory."}],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"references/analysis-templates.md","line_end":3,"line_start":3},{"file":"references/analysis-templates.md","line_end":5,"line_start":5},{"file":"references/analysis-templates.md","line_end":7,"line_start":7},{"file":"references/analysis-templates.md","line_end":8,"line_start":8},{"file":"references/analysis-templates.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":77,"line_start":77},{"file":"SKILL.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":105,"line_start":105},{"file":"SKILL.md","line_end":106,"line_start":106},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":113,"line_start":113},{"file":"SKILL.md","line_end":117,"line_start":117},{"file":"SKILL.md","line_end":118,"line_start":118}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":30,"line_start":26},{"file":"SKILL.md","line_end":32,"line_start":30},{"file":"SKILL.md","line_end":36,"line_start":32},{"file":"SKILL.md","line_end":37,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":37},{"file":"SKILL.md","line_end":53,"line_start":38},{"file":"SKILL.md","line_end":55,"line_start":53},{"file":"SKILL.md","line_end":56,"line_start":55},{"file":"SKILL.md","line_end":58,"line_start":56},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":60,"line_start":59},{"file":"SKILL.md","line_end":85,"line_start":60},{"file":"SKILL.md","line_end":99,"line_start":85}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":13,"line_start":13}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":58,"line_start":58}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":58,"line_start":58}],"confidence":0.74,"description":"**Measured YouTube post-performance (free key)**: when campaign content lives on YouTube, `python3 \"","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Line 58 instructs the agent to run a python3 YouTube connector from CLAUDE_PLUGIN_ROOT. The command appears legitimate, but it is still external command execution and should require a trusted path and user consent."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":535,"audit_model":"codex","audited_at":"2026-07-09T07:24:35.168+00:00","created_at":"2026-07-09T10:47:07.562591+00:00","static_findings":[{"id":"filesystem:references/analysis-templates.md:3:path-traversal-sequence","file":"references/analysis-templates.md","pattern":"Path traversal sequence","snippet":"Fill-in templates for each step of the influencer performance analysis. Each maps to a numbered step","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:references/analysis-templates.md:5:path-traversal-sequence","file":"references/analysis-templates.md","pattern":"Path traversal sequence","snippet":"Repo-root links from this file use `../../../`.","category":"filesystem","line_end":5,"severity":"high","line_start":5},{"id":"filesystem:references/analysis-templates.md:7:path-traversal-sequence","file":"references/analysis-templates.md","pattern":"Path traversal sequence","snippet":"- [skill-contract.md](../../../../references/skill-contract.md)","category":"filesystem","line_end":7,"severity":"high","line_start":7},{"id":"filesystem:references/analysis-templates.md:8:path-traversal-sequence","file":"references/analysis-templates.md","pattern":"Path traversal sequence","snippet":"- [state-model.md](../../../../references/state-model.md)","category":"filesystem","line_end":8,"severity":"high","line_start":8},{"id":"filesystem:references/analysis-templates.md:9:path-traversal-sequence","file":"references/analysis-templates.md","pattern":"Path traversal sequence","snippet":"- [CONNECTORS.md](../../../../CONNECTORS.md)","category":"filesystem","line_end":9,"severity":"high","line_start":9},{"id":"blocker:references/analysis-templates.md:364:system-reconnaissance","file":"references/analysis-templates.md","pattern":"System reconnaissance","snippet":"| @[handle2] | Renew at same level | Solid results |","category":"blocker","line_end":364,"severity":"low","line_start":364},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Cross-discipline (paid ads):** this is also the cross-channel **paid-ads** scorecard/anomaly len","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":32,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":36,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Reads**: campaign name and date range; native platform analytics (reach, views, engagement); inf","category":"external_commands","line_end":37,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Writes**: a performance analysis to `memory/influencer/performance-analyzer/YYYY-MM-DD-<campaign","category":"external_commands","line_end":38,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Promotes**: durable facts (top-performing creators, winning formats, platform ROI splits, roster","category":"external_commands","line_end":53,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Where a connector could speed the work, the skill marks it with a `~~` placeholder:","category":"external_commands","line_end":55,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~social platform analytics` — native reach/engagement/video metrics per post.","category":"external_commands","line_end":56,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~web analytics` — site traffic, click-through, and on-site conversion data.","category":"external_commands","line_end":58,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Measured YouTube post-performance (free key)**: when campaign content lives on YouTube, `python3 \"","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~ecommerce / sales platform` — revenue, orders, AOV, promo-code redemptions.","category":"external_commands","line_end":60,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~influencer database` — historical creator benchmarks for comparison.","category":"external_commands","line_end":85,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":99,"severity":"medium","line_start":85},{"id":"network:SKILL.md:10:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://github.com/aaron-he-zhu/aaron-marketing-skills\"","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"metadata: {\"author\": \"aaron-he-zhu\", \"version\": \"16.0.1\", \"discipline\": \"influencer\", \"phase\": \"meas","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"filesystem:SKILL.md:20:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> **Cross-discipline (paid ads):** this is also the cross-channel **paid-ads** scorecard/anomaly len","category":"filesystem","line_end":20,"severity":"high","line_start":20},{"id":"filesystem:SKILL.md:36:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Reads**: campaign name and date range; native platform analytics (reach, views, engagement); inf","category":"filesystem","line_end":36,"severity":"high","line_start":36},{"id":"filesystem:SKILL.md:43:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Primary next skill**: [roi-calculator](../roi-calculator/SKILL.md) — turn measured performance i","category":"filesystem","line_end":43,"severity":"high","line_start":43},{"id":"filesystem:SKILL.md:47:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> Emit the standard shape from [skill-contract.md §Handoff Summary Format](../../../references/skill","category":"filesystem","line_end":47,"severity":"high","line_start":47},{"id":"filesystem:SKILL.md:58:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Measured YouTube post-performance (free key)**: when campaign content lives on YouTube, `python3 \"","category":"filesystem","line_end":58,"severity":"high","line_start":58},{"id":"filesystem:SKILL.md:62:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"No placeholder is required to run. See [CONNECTORS.md](../../../CONNECTORS.md) for the verified free","category":"filesystem","line_end":62,"severity":"high","line_start":62},{"id":"filesystem:SKILL.md:77:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Before naming any creator/format/platform a real winner, clear the significance bar in [measurement-","category":"filesystem","line_end":77,"severity":"high","line_start":77},{"id":"filesystem:SKILL.md:104:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [skill-contract.md](../../../references/skill-contract.md) — shared contract and handoff format.","category":"filesystem","line_end":104,"severity":"high","line_start":104},{"id":"filesystem:SKILL.md:105:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [state-model.md](../../../references/state-model.md) — memory tiers and save-path conventions.","category":"filesystem","line_end":105,"severity":"high","line_start":105},{"id":"filesystem:SKILL.md:106:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [CONNECTORS.md](../../../CONNECTORS.md) — verified free/keyless data recipes per connector categor","category":"filesystem","line_end":106,"severity":"high","line_start":106},{"id":"filesystem:SKILL.md:107:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [measurement-protocol.md](../../../references/measurement-protocol.md) — readback windows and prom","category":"filesystem","line_end":107,"severity":"high","line_start":107},{"id":"filesystem:SKILL.md:108:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- The C3 benchmark at [references/c3/scoring-architecture.md](../../../references/c3/scoring-archite","category":"filesystem","line_end":108,"severity":"high","line_start":108},{"id":"filesystem:SKILL.md:109:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Sibling skills: [roi-calculator](../roi-calculator/SKILL.md), [report-generator](../report-generat","category":"filesystem","line_end":109,"severity":"high","line_start":109},{"id":"filesystem:SKILL.md:113:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Primary**: [roi-calculator](../roi-calculator/SKILL.md) — convert measured performance into dollar","category":"filesystem","line_end":113,"severity":"high","line_start":113},{"id":"filesystem:SKILL.md:117:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [report-generator](../report-generator/SKILL.md) — package the analysis into a formal stakeholder ","category":"filesystem","line_end":117,"severity":"high","line_start":117},{"id":"filesystem:SKILL.md:118:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [fit-scorer](../../discover/fit-scorer/SKILL.md) — feed proven performers back into creator scorin","category":"filesystem","line_end":118,"severity":"high","line_start":118},{"id":"env_access:SKILL.md:58:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"**Measured YouTube post-performance (free key)**: when campaign content lives on YouTube, `python3 \"","category":"env_access","line_end":58,"severity":"high","line_start":58},{"id":"blocker:SKILL.md:20:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"> **Cross-discipline (paid ads):** this is also the cross-channel **paid-ads** scorecard/anomaly len","category":"blocker","line_end":20,"severity":"low","line_start":20}],"finding_verdicts":[{"id":"filesystem:references/analysis-templates.md:3:path-traversal-sequence","reason":"The flagged sequence is part of Markdown documentation or a relative link to local reference material. It is not user-controlled file access, path construction, or traversal logic.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:references/analysis-templates.md:5:path-traversal-sequence","reason":"The flagged sequence is part of Markdown documentation or a relative link to local reference material. It is not user-controlled file access, path construction, or traversal logic.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:references/analysis-templates.md:7:path-traversal-sequence","reason":"The flagged sequence is part of Markdown documentation or a relative link to local reference material. It is not user-controlled file access, path construction, or traversal logic.","verdict":"false_positive","confidence":0.93},{"id":"filesystem:references/analysis-templates.md:8:path-traversal-sequence","reason":"The flagged sequence is part of Markdown documentation or a relative link to local reference material. It is not user-controlled file access, path construction, or traversal logic.","verdict":"false_positive","confidence":0.93},{"id":"filesystem:references/analysis-templates.md:9:path-traversal-sequence","reason":"The flagged sequence is part of Markdown documentation or a relative link to local reference material. It is not user-controlled file access, path construction, or traversal logic.","verdict":"false_positive","confidence":0.93},{"id":"blocker:references/analysis-templates.md:364:system-reconnaissance","reason":"The line is a sample influencer roster recommendation saying to renew at the same level. It contains no system reconnaissance instruction or host information gathering.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.83},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.83},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.83},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.83},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.83},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.83},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.83},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"Line 58 instructs the agent to run a python3 YouTube connector from CLAUDE_PLUGIN_ROOT. The command appears legitimate, but it is still external command execution and should require a trusted path and user consent.","verdict":"confirmed","severity":"medium","confidence":0.74},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.83},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.83},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting for prompts, file paths, placeholders, links, or example output. There is no shell evaluation or executable command at this flagged location.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:10:hardcoded-url","reason":"The URL is repository homepage metadata in the skill header. It does not initiate a network request or transmit user data.","verdict":"false_positive","confidence":0.95},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL is repository homepage metadata in the skill header. It does not initiate a network request or transmit user data.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:20:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:36:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:43:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:47:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:58:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:62:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:77:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:104:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:105:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:106:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:107:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:108:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:109:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:113:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:117:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:118:path-traversal-sequence","reason":"The path traversal pattern is a static relative Markdown link or documented memory path. It is not path normalization, user-controlled traversal, or file access code.","verdict":"false_positive","confidence":0.91},{"id":"env_access:SKILL.md:58:generic-api-secret-keys","reason":"The line names YOUTUBE_API_KEY as a setup requirement for an optional connector. No secret value is embedded and there is no instruction to print, store, or exfiltrate the key.","verdict":"false_positive","confidence":0.78},{"id":"blocker:SKILL.md:20:system-reconnaissance","reason":"The line describes paid-ads campaign scorecards and memory output. It does not request host reconnaissance, system enumeration, or sensitive environment discovery.","verdict":"false_positive","confidence":0.96}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}