{"data":{"skill":{"slug":"agentkitco-dependency-upgrade","name":"dependency-upgrade","icon":"📦","repo":"https://github.com/agentkitco/agentkit-dev-skills/tree/a5058856442fcb89bd538b1c01f94558488bfac3/skills/dependency-upgrade","status":"approved","author":"agentkitco","authorVersion":"1.0","skillstoreRevision":1},"audit":{"id":"ef800c34-1b78-4355-b457-f69b05049f0d","skill_id":"fbec90d5-55ed-4f38-9f78-7b54b8409f5c","version":2,"content_hash":"v3:18efac79a818d7e997295839638fdd21906cfd1c:5bd0eada2c9d4dec619326433b100bad3f7202f5415f15340e144fbd9d53e2ab:105db4b4462ed730be53ee3237f532d889ab4929de8cdd2dcaaaf3565291c68b:736b696c6c732f6167656e746b6974636f2f646570656e64656e63792d75706772616465:e56a576793c7f8072a06498cafa2bdc4","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All five static findings are false positives involving Markdown backticks, routine package version queries, code search, and rollback documentation. No evidence found of malicious intent, credential access, data exfiltration, or prompt injection in SKILL.md.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":39,"line_start":32},{"file":"SKILL.md","line_end":40,"line_start":39}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":48,"audit_model":"codex","audited_at":"2026-10-22T19:14:58.07+00:00","created_at":"2026-10-22T22:25:17.113052+00:00","static_findings":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Pin down the current state.** Find the installed version (lockfile, not just the manifest) and ","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Map the impact.** `rg` the codebase for each removed, renamed or changed API. List affected fil","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":39,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Rollback: revert <files>, or `git revert <commit>`","category":"external_commands","line_end":40,"severity":"medium","line_start":39},{"id":"blocker:SKILL.md:16:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"1. **Pin down the current state.** Find the installed version (lockfile, not just the manifest) and ","category":"blocker","line_end":16,"severity":"low","line_start":16}],"finding_verdicts":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Line 16 uses Markdown backticks for package manager version queries, not Ruby or shell substitution. These queries establish the requested upgrade target; no injected payload or unrelated execution is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"Line 19 formats rg as inline Markdown and requests codebase searches for changed APIs. This is task-related source inspection, not executable backtick substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"Lines 32 through 40 form a fenced Markdown report template containing placeholders and verification headings. The backticks delimit documentation, not a shell or Ruby execution expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"Line 39 documents git revert with a commit placeholder inside the report template. This describes a scoped rollback option, not backtick execution or an instruction to discard unrelated changes.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:16:system-reconnaissance","reason":"Line 16 checks the installed dependency version and queries available package versions to select an upgrade target. It does not enumerate hosts, accounts, credentials, or unrelated system information.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"18efac79a818d7e997295839638fdd21906cfd1c","subject_content_hash":"5bd0eada2c9d4dec619326433b100bad3f7202f5415f15340e144fbd9d53e2ab","subject_tree_hash":"105db4b4462ed730be53ee3237f532d889ab4929de8cdd2dcaaaf3565291c68b","subject_plugin_path":"skills/agentkitco/dependency-upgrade","audit_payload_hash":"e56a576793c7f8072a06498cafa2bdc4","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"18efac79a818d7e997295839638fdd21906cfd1c","contentHash":"5bd0eada2c9d4dec619326433b100bad3f7202f5415f15340e144fbd9d53e2ab","treeHash":"105db4b4462ed730be53ee3237f532d889ab4929de8cdd2dcaaaf3565291c68b","pluginPath":"skills/agentkitco/dependency-upgrade","auditPayloadHash":"e56a576793c7f8072a06498cafa2bdc4"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/agentkitco-dependency-upgrade/audits/2/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}