{"data":{"skill":{"slug":"agentkitco-repro-first-debugging","name":"repro-first-debugging","icon":"📦","repo":"https://github.com/agentkitco/agentkit-dev-skills/tree/a5058856442fcb89bd538b1c01f94558488bfac3/skills/repro-first-debugging","status":"approved","author":"agentkitco","authorVersion":"1.0","skillstoreRevision":1},"audit":{"id":"14bf313c-7978-4d0c-9809-88652ab2dbc8","skill_id":"b897a947-4c72-471a-9fdc-c7a30aee9947","version":2,"content_hash":"v3:18efac79a818d7e997295839638fdd21906cfd1c:82cf362ca8091fd6f79d337955ccf137e837e9a37061021f3a305c6839c75689:de79786104df33fc8e59771fd38a2db9e51bc14ca7696d95c7202f8c64f5aa37:736b696c6c732f6167656e746b6974636f2f726570726f2d66697273742d646562756767696e67:1c5699cbdcda96024fd2a61c38b4a583","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All four static findings are false positives caused by Markdown formatting or ordinary debugging prose. No evidence found of malicious execution, reconnaissance, exfiltration, or prompt injection in SKILL.md. The skill describes a reproduction-first debugging workflow with explicit verification and scope limits.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":35,"line_start":27}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":43,"audit_model":"codex","audited_at":"2026-10-22T19:24:11.781+00:00","created_at":"2026-10-22T22:25:50.540386+00:00","static_findings":[{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **Test the hypotheses, cheapest first.** Read the code path, add temporary logging or assertions,","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"8. **Look for siblings.** Search for the same pattern elsewhere (`rg`) and report, but do not change","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":35,"severity":"medium","line_start":27},{"id":"blocker:SKILL.md:12:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Goal: fix the cause, prove the fix, and avoid editing on a guess.","category":"blocker","line_end":12,"severity":"low","line_start":12}],"finding_verdicts":[{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"SKILL.md:20 uses Markdown inline backticks around git bisect and git log examples within a debugging checklist. These are relevant debugging operations, not Ruby execution or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"SKILL.md:23 uses Markdown backticks to name rg for finding similar code. It explicitly limits changes to related code and contains no executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"SKILL.md:27-35 is a Markdown fenced report template containing descriptive placeholders. The fence does not execute code or invoke a shell.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:12:system-reconnaissance","reason":"SKILL.md:12 states the goal of fixing causes and proving fixes before speculative edits. It requests no system enumeration, sensitive information, or reconnaissance.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"18efac79a818d7e997295839638fdd21906cfd1c","subject_content_hash":"82cf362ca8091fd6f79d337955ccf137e837e9a37061021f3a305c6839c75689","subject_tree_hash":"de79786104df33fc8e59771fd38a2db9e51bc14ca7696d95c7202f8c64f5aa37","subject_plugin_path":"skills/agentkitco/repro-first-debugging","audit_payload_hash":"1c5699cbdcda96024fd2a61c38b4a583","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"18efac79a818d7e997295839638fdd21906cfd1c","contentHash":"82cf362ca8091fd6f79d337955ccf137e837e9a37061021f3a305c6839c75689","treeHash":"de79786104df33fc8e59771fd38a2db9e51bc14ca7696d95c7202f8c64f5aa37","pluginPath":"skills/agentkitco/repro-first-debugging","auditPayloadHash":"1c5699cbdcda96024fd2a61c38b4a583"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/agentkitco-repro-first-debugging/audits/2/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}