{"data":{"skill":{"slug":"agentkitco-pr-description","name":"pr-description","icon":"📦","repo":"https://github.com/agentkitco/agentkit-dev-skills/tree/a5058856442fcb89bd538b1c01f94558488bfac3/skills/pr-description","status":"approved","author":"agentkitco","authorVersion":"1.0","skillstoreRevision":2},"audit":{"id":"4b445115-9c86-4edb-b685-0da12c0acfcd","skill_id":"2a95b03a-38ca-4b5c-84fc-3f4134d88020","version":2,"content_hash":"v3:18efac79a818d7e997295839638fdd21906cfd1c:0a1fbba4d9935d34f942c5c7e20fd16cb5f8095796c7fa3fa35ffb240fde3bfe:c27a38f8cda73de94c47b3d2f80fb9b03c50d6d0a25146edeb52aa6625954af3:736b696c6c732f6167656e746b6974636f2f70722d6465736372697074696f6e:65daa8aee6e8601d1784801d0446c2db","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All five static findings are false positives involving Markdown formatting, read-only Git inspection, or guidance against unsupported screenshot claims. No evidence found of credential access, data exfiltration, destructive commands, or prompt injection in SKILL.md. Pull request creation is explicitly prohibited unless requested.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":43,"line_start":23},{"file":"SKILL.md","line_end":51,"line_start":43}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":52,"audit_model":"codex","audited_at":"2026-10-22T19:19:38.517+00:00","created_at":"2026-10-22T22:25:34.383554+00:00","static_findings":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Find the base branch and run `git log --oneline <base>..HEAD` and `git diff --stat <base>...HEAD`","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. Look for a `.github/pull_request_template.md` or `PULL_REQUEST_TEMPLATE`. If one exists, fill it ","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":43,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":51,"severity":"medium","line_start":43},{"id":"blocker:SKILL.md:50:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Screenshots or output examples: say where one would help; never describe a screenshot you did not ","category":"blocker","line_end":50,"severity":"low","line_start":50}],"finding_verdicts":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Line 16 documents read-only git log and git diff commands using Markdown inline code. The backticks are formatting, not Ruby execution or shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"Line 19 uses Markdown backticks around repository template filenames. It requests locating and following a pull request template, not executing these filenames.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"Lines 23 through 43 form a fenced Markdown example containing pull request headings and prose placeholders. There is no executable payload or shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"Line 43 closes the Markdown example; subsequent lines give writing rules. Line 51 mentions gh pr create only to prohibit execution unless requested.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:50:system-reconnaissance","reason":"Line 50 tells the assistant not to describe screenshots it has not seen. It requests no screenshot capture, system inspection, or reconnaissance.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"18efac79a818d7e997295839638fdd21906cfd1c","subject_content_hash":"0a1fbba4d9935d34f942c5c7e20fd16cb5f8095796c7fa3fa35ffb240fde3bfe","subject_tree_hash":"c27a38f8cda73de94c47b3d2f80fb9b03c50d6d0a25146edeb52aa6625954af3","subject_plugin_path":"skills/agentkitco/pr-description","audit_payload_hash":"65daa8aee6e8601d1784801d0446c2db","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"18efac79a818d7e997295839638fdd21906cfd1c","contentHash":"0a1fbba4d9935d34f942c5c7e20fd16cb5f8095796c7fa3fa35ffb240fde3bfe","treeHash":"c27a38f8cda73de94c47b3d2f80fb9b03c50d6d0a25146edeb52aa6625954af3","pluginPath":"skills/agentkitco/pr-description","auditPayloadHash":"65daa8aee6e8601d1784801d0446c2db"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/agentkitco-pr-description/audits/2/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}