{"data":{"skill":{"slug":"aaron-he-zhu-performance-analyzer","name":"performance-analyzer","icon":"📦","repo":"https://github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/influencer/measure/performance-analyzer","status":"approved","author":"aaron-he-zhu","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"90ea3eed-43e6-4649-a35d-46b4c4481d16","skill_id":"92147f57-c617-4c39-a845-6d12f3c9ca16","version":8,"content_hash":"6de3bac04e716f67bd1f2ec6d72533e1","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static findings are false positives caused by Markdown links, code fences, placeholder notation, and fixed memory paths. The confirmed risks are the optional YouTube connector command and its use of YOUTUBE_API_KEY. No prompt injection or malicious data-exfiltration intent was found.","remediation":[{"issue":"Optional YouTube connector command","severity":"medium","suggestion":"State that the connector is optional and should run only after user confirmation. Keep the script path fixed and pass handles as arguments."},{"issue":"Environment API key use","severity":"high","suggestion":"Document that YOUTUBE_API_KEY is read only for YouTube API calls and must never be printed, stored, or included in reports."},{"issue":"Relative repository links trigger traversal warnings","severity":"low","suggestion":"Prefer package-local links where possible, and explain that shared references stay inside the repository documentation tree."}],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"references/analysis-templates.md","line_end":3,"line_start":3},{"file":"references/analysis-templates.md","line_end":5,"line_start":5},{"file":"references/analysis-templates.md","line_end":7,"line_start":7},{"file":"references/analysis-templates.md","line_end":8,"line_start":8},{"file":"references/analysis-templates.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":77,"line_start":77},{"file":"SKILL.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":105,"line_start":105},{"file":"SKILL.md","line_end":106,"line_start":106},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":113,"line_start":113},{"file":"SKILL.md","line_end":117,"line_start":117},{"file":"SKILL.md","line_end":118,"line_start":118}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":30,"line_start":26},{"file":"SKILL.md","line_end":32,"line_start":30},{"file":"SKILL.md","line_end":36,"line_start":32},{"file":"SKILL.md","line_end":37,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":37},{"file":"SKILL.md","line_end":53,"line_start":38},{"file":"SKILL.md","line_end":55,"line_start":53},{"file":"SKILL.md","line_end":56,"line_start":55},{"file":"SKILL.md","line_end":58,"line_start":56},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":60,"line_start":59},{"file":"SKILL.md","line_end":85,"line_start":60},{"file":"SKILL.md","line_end":99,"line_start":85}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":13,"line_start":13}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":58,"line_start":58}]}],"critical_findings":[],"high_findings":[{"title":"Generic API/secret keys","locations":[{"file":"SKILL.md","line_end":58,"line_start":58}],"confidence":0.8,"description":"**Measured YouTube post-performance (free key)**: when campaign content lives on YouTube, `python3 \"","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The line references YOUTUBE_API_KEY for the optional YouTube connector. There is no evidence of exfiltration, but environment secret access in a community skill is a real risk that requires disclosure and safeguards."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":58,"line_start":58}],"confidence":0.83,"description":"**Measured YouTube post-performance (free key)**: when campaign content lives on YouTube, `python3 \"","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line instructs the agent to run python3 with a YouTube connector under CLAUDE_PLUGIN_ROOT. The command appears legitimate, but external process execution from a community skill is a real operational risk."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":535,"audit_model":"codex","audited_at":"2026-07-09T12:20:07.944+00:00","created_at":"2026-07-09T23:55:49.649427+00:00","static_findings":[{"id":"filesystem:references/analysis-templates.md:3:path-traversal-sequence","file":"references/analysis-templates.md","pattern":"Path traversal sequence","snippet":"Fill-in templates for each step of the influencer performance analysis. Each maps to a numbered step","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"filesystem:references/analysis-templates.md:5:path-traversal-sequence","file":"references/analysis-templates.md","pattern":"Path traversal sequence","snippet":"Repo-root links from this file use `../../../`.","category":"filesystem","line_end":5,"severity":"high","line_start":5},{"id":"filesystem:references/analysis-templates.md:7:path-traversal-sequence","file":"references/analysis-templates.md","pattern":"Path traversal sequence","snippet":"- [skill-contract.md](../../../../references/skill-contract.md)","category":"filesystem","line_end":7,"severity":"high","line_start":7},{"id":"filesystem:references/analysis-templates.md:8:path-traversal-sequence","file":"references/analysis-templates.md","pattern":"Path traversal sequence","snippet":"- [state-model.md](../../../../references/state-model.md)","category":"filesystem","line_end":8,"severity":"high","line_start":8},{"id":"filesystem:references/analysis-templates.md:9:path-traversal-sequence","file":"references/analysis-templates.md","pattern":"Path traversal sequence","snippet":"- [CONNECTORS.md](../../../../CONNECTORS.md)","category":"filesystem","line_end":9,"severity":"high","line_start":9},{"id":"blocker:references/analysis-templates.md:364:system-reconnaissance","file":"references/analysis-templates.md","pattern":"System reconnaissance","snippet":"| @[handle2] | Renew at same level | Solid results |","category":"blocker","line_end":364,"severity":"low","line_start":364},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Cross-discipline (paid ads):** this is also the cross-channel **paid-ads** scorecard/anomaly len","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":32,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":36,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Reads**: campaign name and date range; native platform analytics (reach, views, engagement); inf","category":"external_commands","line_end":37,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Writes**: a performance analysis to `memory/influencer/performance-analyzer/YYYY-MM-DD-<campaign","category":"external_commands","line_end":38,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Promotes**: durable facts (top-performing creators, winning formats, platform ROI splits, roster","category":"external_commands","line_end":53,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Where a connector could speed the work, the skill marks it with a `~~` placeholder:","category":"external_commands","line_end":55,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~social platform analytics` — native reach/engagement/video metrics per post.","category":"external_commands","line_end":56,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~web analytics` — site traffic, click-through, and on-site conversion data.","category":"external_commands","line_end":58,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Measured YouTube post-performance (free key)**: when campaign content lives on YouTube, `python3 \"","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~ecommerce / sales platform` — revenue, orders, AOV, promo-code redemptions.","category":"external_commands","line_end":60,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `~~influencer database` — historical creator benchmarks for comparison.","category":"external_commands","line_end":85,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":99,"severity":"medium","line_start":85},{"id":"network:SKILL.md:10:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://github.com/aaron-he-zhu/aaron-marketing-skills\"","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"metadata: {\"author\": \"aaron-he-zhu\", \"version\": \"16.0.1\", \"discipline\": \"influencer\", \"phase\": \"meas","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"filesystem:SKILL.md:20:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> **Cross-discipline (paid ads):** this is also the cross-channel **paid-ads** scorecard/anomaly len","category":"filesystem","line_end":20,"severity":"high","line_start":20},{"id":"filesystem:SKILL.md:36:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Reads**: campaign name and date range; native platform analytics (reach, views, engagement); inf","category":"filesystem","line_end":36,"severity":"high","line_start":36},{"id":"filesystem:SKILL.md:43:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Primary next skill**: [roi-calculator](../roi-calculator/SKILL.md) — turn measured performance i","category":"filesystem","line_end":43,"severity":"high","line_start":43},{"id":"filesystem:SKILL.md:47:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"> Emit the standard shape from [skill-contract.md §Handoff Summary Format](../../../references/skill","category":"filesystem","line_end":47,"severity":"high","line_start":47},{"id":"filesystem:SKILL.md:58:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Measured YouTube post-performance (free key)**: when campaign content lives on YouTube, `python3 \"","category":"filesystem","line_end":58,"severity":"high","line_start":58},{"id":"filesystem:SKILL.md:62:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"No placeholder is required to run. See [CONNECTORS.md](../../../CONNECTORS.md) for the verified free","category":"filesystem","line_end":62,"severity":"high","line_start":62},{"id":"filesystem:SKILL.md:77:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Before naming any creator/format/platform a real winner, clear the significance bar in [measurement-","category":"filesystem","line_end":77,"severity":"high","line_start":77},{"id":"filesystem:SKILL.md:104:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [skill-contract.md](../../../references/skill-contract.md) — shared contract and handoff format.","category":"filesystem","line_end":104,"severity":"high","line_start":104},{"id":"filesystem:SKILL.md:105:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [state-model.md](../../../references/state-model.md) — memory tiers and save-path conventions.","category":"filesystem","line_end":105,"severity":"high","line_start":105},{"id":"filesystem:SKILL.md:106:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [CONNECTORS.md](../../../CONNECTORS.md) — verified free/keyless data recipes per connector categor","category":"filesystem","line_end":106,"severity":"high","line_start":106},{"id":"filesystem:SKILL.md:107:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [measurement-protocol.md](../../../references/measurement-protocol.md) — readback windows and prom","category":"filesystem","line_end":107,"severity":"high","line_start":107},{"id":"filesystem:SKILL.md:108:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- The C3 benchmark at [references/c3/scoring-architecture.md](../../../references/c3/scoring-archite","category":"filesystem","line_end":108,"severity":"high","line_start":108},{"id":"filesystem:SKILL.md:109:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Sibling skills: [roi-calculator](../roi-calculator/SKILL.md), [report-generator](../report-generat","category":"filesystem","line_end":109,"severity":"high","line_start":109},{"id":"filesystem:SKILL.md:113:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"**Primary**: [roi-calculator](../roi-calculator/SKILL.md) — convert measured performance into dollar","category":"filesystem","line_end":113,"severity":"high","line_start":113},{"id":"filesystem:SKILL.md:117:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [report-generator](../report-generator/SKILL.md) — package the analysis into a formal stakeholder ","category":"filesystem","line_end":117,"severity":"high","line_start":117},{"id":"filesystem:SKILL.md:118:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- [fit-scorer](../../discover/fit-scorer/SKILL.md) — feed proven performers back into creator scorin","category":"filesystem","line_end":118,"severity":"high","line_start":118},{"id":"env_access:SKILL.md:58:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"**Measured YouTube post-performance (free key)**: when campaign content lives on YouTube, `python3 \"","category":"env_access","line_end":58,"severity":"high","line_start":58},{"id":"blocker:SKILL.md:20:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"> **Cross-discipline (paid ads):** this is also the cross-channel **paid-ads** scorecard/anomaly len","category":"blocker","line_end":20,"severity":"low","line_start":20}],"finding_verdicts":[{"id":"filesystem:references/analysis-templates.md:3:path-traversal-sequence","reason":"The line is prose linking to ../SKILL.md inside the skill documentation. It does not direct arbitrary path reads or use user-controlled file paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:references/analysis-templates.md:5:path-traversal-sequence","reason":"The line documents a relative link convention for repository documentation. It is not runtime filesystem traversal or access to sensitive paths.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/analysis-templates.md:7:path-traversal-sequence","reason":"This is a Markdown link to a shared repository reference file. No command, file read API, or user-controlled path expansion is present.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/analysis-templates.md:8:path-traversal-sequence","reason":"This is a Markdown link to a shared state-model reference. It is documentation navigation, not path traversal behavior.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/analysis-templates.md:9:path-traversal-sequence","reason":"This is a Markdown link to CONNECTORS.md in the repository. The path is static documentation, not a dynamic filesystem operation.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/analysis-templates.md:364:system-reconnaissance","reason":"The line contains a placeholder influencer handle in a roster recommendation table. It is not host, network, or system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The line uses backticks around a memory path in prose and links to related skills. There is no shell command or Ruby backtick execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The line is a Markdown code fence opening for a prompt example. A fence delimiter is not executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The line is a Markdown code fence closing for a prompt example. It does not invoke a shell or external process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The line is a Markdown code fence opening for a second prompt example. It is formatting, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The line is a Markdown code fence closing for a prompt example. It contains no shell command or dynamic execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The line describes scoped campaign data and a local memory file path. The backticks mark a documentation path, not a command.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The line describes the report output path under memory/influencer. It is a static save-path convention, not external command execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The line describes promoting durable facts to memory/hot-cache.md. It uses backticks for a file path and does not run a process.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The line explains the `~~` placeholder notation for connectors. This is Markdown formatting and not shell execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The line names a social analytics connector placeholder in backticks. It does not contain an executable command.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The line names a web analytics connector placeholder in backticks. It is not Ruby or shell execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The line instructs the agent to run python3 with a YouTube connector under CLAUDE_PLUGIN_ROOT. The command appears legitimate, but external process execution from a community skill is a real operational risk.","verdict":"confirmed","severity":"medium","confidence":0.83},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The line names an ecommerce connector placeholder in backticks. It is documentation, not an executable shell command.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The line names an influencer database connector placeholder in backticks. No command invocation or shell interpolation is present.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The line opens a Markdown fenced example output block. A language-tagged fence is not executable code.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:10:hardcoded-url","reason":"The URL is homepage metadata in the skill front matter. It does not perform a network request or send data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL appears inside metadata for the public project homepage. It is not a runtime network call or webhook.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:20:path-traversal-sequence","reason":"The relative paths are Markdown links to sibling skills, and the memory path is a fixed save location. There is no arbitrary path traversal.","verdict":"false_positive","confidence":0.93},{"id":"filesystem:SKILL.md:36:path-traversal-sequence","reason":"The line describes expected reads from campaign inputs and scoped memory records. It does not instruct traversal outside an allowed workspace path.","verdict":"false_positive","confidence":0.92},{"id":"filesystem:SKILL.md:43:path-traversal-sequence","reason":"The line is a Markdown link to a sibling ROI skill. It is documentation navigation, not filesystem traversal.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:47:path-traversal-sequence","reason":"The line links to a shared skill-contract reference using a static relative path. It does not include dynamic or user-controlled path access.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:58:path-traversal-sequence","reason":"The connector path is fixed under CLAUDE_PLUGIN_ROOT, and the traversal-like sequence is in a documentation link. External command risk is covered separately for the same line.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:62:path-traversal-sequence","reason":"The line links to CONNECTORS.md with a static relative path. This is repository documentation, not a traversal operation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:77:path-traversal-sequence","reason":"The line contains static Markdown links to measurement and scoring reference files. It does not construct or access paths from user input.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:104:path-traversal-sequence","reason":"The line is a static Markdown link to skill-contract.md. No filesystem API or traversal behavior is present.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:105:path-traversal-sequence","reason":"The line is a static Markdown link to state-model.md. It is not runtime path traversal.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:106:path-traversal-sequence","reason":"The line is a static Markdown link to CONNECTORS.md. It does not read arbitrary files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:107:path-traversal-sequence","reason":"The line is a static Markdown link to measurement-protocol.md and describes statistical criteria. It is not a traversal instruction.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:108:path-traversal-sequence","reason":"The line is a static Markdown link to the C3 scoring reference. It does not access sensitive files or build a path dynamically.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:109:path-traversal-sequence","reason":"The line lists static sibling skill links. Documentation links to nearby skills are not path traversal behavior.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:113:path-traversal-sequence","reason":"The line links to a sibling roi-calculator skill. It is a fixed documentation link, not arbitrary filesystem access.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:117:path-traversal-sequence","reason":"The line links to a sibling report-generator skill. It does not execute or dereference a user-controlled path.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:118:path-traversal-sequence","reason":"The line links to a sibling fit-scorer skill through a static relative path. It is documentation navigation, not traversal.","verdict":"false_positive","confidence":0.95},{"id":"env_access:SKILL.md:58:generic-api-secret-keys","reason":"The line references YOUTUBE_API_KEY for the optional YouTube connector. There is no evidence of exfiltration, but environment secret access in a community skill is a real risk that requires disclosure and safeguards.","verdict":"confirmed","severity":"high","confidence":0.8},{"id":"blocker:SKILL.md:20:system-reconnaissance","reason":"The line discusses paid-ad scorecards and related marketing skills. It does not probe the host system, enumerate networks, or collect system information.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}