{"data":{"skill":{"slug":"addyosmani-context-engineering","name":"context-engineering","icon":"📦","repo":"https://github.com/addyosmani/agent-skills/tree/be4e44a9fbc5e8df0beaefadbb28bd22ee61cc39/skills/context-engineering","status":"approved","author":"addyosmani","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"5d399447-d518-4952-aaae-ca5d888ce7ed","skill_id":"819128b6-b8fc-4bca-8e8e-5d12234feb8a","version":1,"content_hash":"v3:5526951beaeca22519572a471618555839b53b05:8b736cb9e55b82b265ab6ff78349c0e826e8a6df550deddf665b7fb3ff858b63:58fe158e9f1a305fc2262f682f452b1430ec9b991890415b75532acba1376057:736b696c6c732f616464796f736d616e692f636f6e746578742d656e67696e656572696e67:36d1174b98b22ea2da15cb664a9f67ef","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All static findings are false positives caused by Markdown formatting, documented developer commands, filenames, or protective secret-handling guidance. The skill contains no executable scripts, credential access, prompt injection, or malicious intent.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":36,"line_start":24},{"file":"SKILL.md","line_end":43,"line_start":36},{"file":"SKILL.md","line_end":51,"line_start":43},{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":53,"line_start":52},{"file":"SKILL.md","line_end":54,"line_start":53},{"file":"SKILL.md","line_end":55,"line_start":54},{"file":"SKILL.md","line_end":60,"line_start":55},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":72,"line_start":61},{"file":"SKILL.md","line_end":75,"line_start":72},{"file":"SKILL.md","line_end":75,"line_start":75},{"file":"SKILL.md","line_end":77,"line_start":76},{"file":"SKILL.md","line_end":78,"line_start":77},{"file":"SKILL.md","line_end":109,"line_start":78},{"file":"SKILL.md","line_end":135,"line_start":109},{"file":"SKILL.md","line_end":145,"line_start":135},{"file":"SKILL.md","line_end":153,"line_start":145},{"file":"SKILL.md","line_end":159,"line_start":153},{"file":"SKILL.md","line_end":172,"line_start":159},{"file":"SKILL.md","line_end":178,"line_start":172},{"file":"SKILL.md","line_end":194,"line_start":178},{"file":"SKILL.md","line_end":209,"line_start":194},{"file":"SKILL.md","line_end":224,"line_start":209},{"file":"SKILL.md","line_end":228,"line_start":224},{"file":"SKILL.md","line_end":236,"line_start":228},{"file":"SKILL.md","line_end":239,"line_start":236},{"file":"SKILL.md","line_end":259,"line_start":239},{"file":"SKILL.md","line_end":262,"line_start":259},{"file":"SKILL.md","line_end":266,"line_start":262},{"file":"SKILL.md","line_end":277,"line_start":266},{"file":"SKILL.md","line_end":287,"line_start":277},{"file":"SKILL.md","line_end":298,"line_start":287},{"file":"SKILL.md","line_end":304,"line_start":298},{"file":"SKILL.md","line_end":310,"line_start":304}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":354,"audit_model":"codex","audited_at":"2026-09-12T11:54:40.389+00:00","created_at":"2026-09-14T00:38:55.812163+00:00","static_findings":[{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":36,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":43,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":51,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Build: `npm run build`","category":"external_commands","line_end":52,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Test: `npm test`","category":"external_commands","line_end":53,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Lint: `npm run lint --fix`","category":"external_commands","line_end":54,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Dev: `npm run dev`","category":"external_commands","line_end":55,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Type check: `npx tsc --noEmit`","category":"external_commands","line_end":60,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- colocate tests next to source: `Button.tsx` → `Button.test.tsx`","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `cn()` utility for conditional classNames","category":"external_commands","line_end":72,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":75,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `.cursorrules` or `.cursor/rules/*.md` (Cursor)","category":"external_commands","line_end":75,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `.windsurfrules` (Windsurf)","category":"external_commands","line_end":77,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `.github/copilot-instructions.md` (GitHub Copilot)","category":"external_commands","line_end":78,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `AGENTS.md` (OpenAI Codex)","category":"external_commands","line_end":109,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Effective:** \"The test failed with: `TypeError: Cannot read property 'id' of undefined at UserServ","category":"external_commands","line_end":135,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"In the fresh session, read the rules, spec, plan, task status, and actual `git status` before acting","category":"external_commands","line_end":145,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":153,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":159,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":172,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":178,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":194,"severity":"medium","line_start":178},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":209,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Verbose tool output (long `find` results, full file listings) | After you've extracted what you ne","category":"external_commands","line_end":224,"severity":"medium","line_start":209},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":228,"severity":"medium","line_start":224},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":236,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":239,"severity":"medium","line_start":236},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":259,"severity":"medium","line_start":239},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":262,"severity":"medium","line_start":259},{"id":"external_commands:SKILL.md:262:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":266,"severity":"medium","line_start":262},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":277,"severity":"medium","line_start":266},{"id":"external_commands:SKILL.md:277:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":287,"severity":"medium","line_start":277},{"id":"external_commands:SKILL.md:287:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":298,"severity":"medium","line_start":287},{"id":"external_commands:SKILL.md:298:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":304,"severity":"medium","line_start":298},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":310,"severity":"medium","line_start":304},{"id":"sensitive:SKILL.md:65:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"- Never commit .env files or secrets","category":"sensitive","line_end":65,"severity":"high","line_start":65}],"finding_verdicts":[{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"Lines 24-36 are a fenced text diagram of the context hierarchy. The backticks are Markdown delimiters and do not execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Line 36 closes a Markdown code fence for a static diagram. No Ruby expression, shell invocation, or executable script is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"Line 43 opens a Markdown example for a CLAUDE.md rules file. It is documentation content, not a Ruby or shell execution construct.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The inline text documents npm run build as an example project command inside a rules-file template. Markdown backticks only format the command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The inline text documents npm test as an example project command inside a rules-file template. It contains no mechanism that executes the command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The npm lint command is presented as static Markdown documentation for project conventions. The backticks are not Ruby command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The npm development command is an example entry in a CLAUDE.md template. It is formatted text with no automatic execution behavior.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The TypeScript check is documented as an example project command. No code passes this text to a shell or Ruby interpreter.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The backticks format example source and test filenames. They contain no commands and cannot trigger execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The backticks format the name of a class-name utility in a coding-conventions example. This is an identifier, not an executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"Line 72 closes the Markdown block containing the sample rules file. A code-fence delimiter is not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The backticks format Cursor rules-file paths. These are filenames listed for reference, not commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The backticks format the Windsurf rules filename. No external process or command invocation is described.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The backticks identify the GitHub Copilot instructions file. This is a file-path reference rather than executable shell content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The backticks format the AGENTS.md filename for Codex. The surrounding section only lists equivalent rules files.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The inline text is an example TypeError message supplied as debugging context. Markdown formatting does not execute its contents.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"The skill advises checking git status during a session handoff. The command is inline documentation and is not invoked by executable code.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"Lines 145-153 are a fenced plain-text template for organizing project context. The fence has no execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"Line 153 closes a static context template. It is a Markdown delimiter, not Ruby backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"Lines 159-172 provide a fenced task-context example with illustrative file paths. No command execution construct exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"Line 172 closes the selective-context example. The backticks only delimit Markdown content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","reason":"Lines 178-194 are a fenced Markdown project-map example. It contains descriptive paths and architecture notes, not executable commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"Line 194 closes a Markdown project-map example. No interpreter consumes this fence as a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","reason":"The backticks format the word find while discussing verbose tool output. This prose does not invoke find or any external process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","reason":"Lines 224-228 show a before-and-after context summary in a fenced text block. The delimiter is purely presentational.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"Line 228 closes a static summarization example. It does not contain or trigger Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","reason":"Lines 236-239 contain a fenced diagram showing context order. The backticks delimit prose and have no execution path.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","reason":"Line 239 closes the context-order diagram. It is Markdown syntax without command content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","reason":"Lines 259-262 form a fenced example of conflicting requirements. The content is explanatory text, not executable shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:262:ruby-shell-backtick-execution","reason":"Line 262 closes a Markdown example about context conflicts. No command is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","reason":"Lines 266-277 provide a fenced decision prompt for resolving a specification conflict. It is a user-facing template with no executable behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:277:ruby-shell-backtick-execution","reason":"Line 277 closes the conflict-resolution prompt example. The backticks are Markdown syntax only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:287:ruby-shell-backtick-execution","reason":"Lines 287-298 are a fenced prompt illustrating an incomplete requirement. It presents choices and does not execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:298:ruby-shell-backtick-execution","reason":"Line 298 closes a Markdown requirements example. There is no Ruby or shell context.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","reason":"Lines 304-310 contain a fenced planning example for an agent. It is static instructional prose rather than an executable script.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:65:environment-file-access","reason":"Line 65 explicitly says never to commit .env files or secrets. It neither reads an environment file nor requests access to sensitive data.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"5526951beaeca22519572a471618555839b53b05","subject_content_hash":"8b736cb9e55b82b265ab6ff78349c0e826e8a6df550deddf665b7fb3ff858b63","subject_tree_hash":"58fe158e9f1a305fc2262f682f452b1430ec9b991890415b75532acba1376057","subject_plugin_path":"skills/addyosmani/context-engineering","audit_payload_hash":"36d1174b98b22ea2da15cb664a9f67ef","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"5526951beaeca22519572a471618555839b53b05","contentHash":"8b736cb9e55b82b265ab6ff78349c0e826e8a6df550deddf665b7fb3ff858b63","treeHash":"58fe158e9f1a305fc2262f682f452b1430ec9b991890415b75532acba1376057","pluginPath":"skills/addyosmani/context-engineering","auditPayloadHash":"36d1174b98b22ea2da15cb664a9f67ef"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/addyosmani-context-engineering/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}