{"data":{"skill":{"slug":"agentkitco-review-my-diff","name":"review-my-diff","icon":"📦","repo":"https://github.com/agentkitco/agentkit-dev-skills/tree/a5058856442fcb89bd538b1c01f94558488bfac3/skills/review-my-diff","status":"approved","author":"agentkitco","authorVersion":"1.0","skillstoreRevision":2},"audit":{"id":"2e8fd483-26c4-4021-b570-5f93ff1159a5","skill_id":"78fda928-b583-478d-a94c-0a2a393d2ccc","version":2,"content_hash":"v3:18efac79a818d7e997295839638fdd21906cfd1c:90b698f93f87174f2db7e43f275ea60cbf0aaac3bf1c1da27c7d563e0f6ff65b:1fef3cd77497189320a0670c1e6ac3d4e860eb1bcf37ea3bc714e560bb57a21e:736b696c6c732f6167656e746b6974636f2f7265766965772d6d792d64696666:e928254a35b9a243b6781ad811da29f4","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All six static findings are false positives involving ordinary Git commands, Markdown formatting, or legitimate review instructions. No evidence found of credential theft, data exfiltration, malicious reconnaissance, or prompt injection. Running project checks executes repository code and requires a trusted environment.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":48,"line_start":30}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":56,"audit_model":"codex","audited_at":"2026-10-22T19:26:10.938+00:00","created_at":"2026-10-22T22:25:59.485292+00:00","static_findings":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Get the change.** Run `git status --short`, then `git diff` (unstaged) and `git diff --staged`.","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. Maintainability: dead code, copy-paste, unclear names, debug leftovers (`console.log`, `print`, `","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":48,"severity":"medium","line_start":30},{"id":"blocker:SKILL.md:18:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"3. **Read the whole diff, then the code around risky hunks** (callers, tests, config). A diff hides ","category":"blocker","line_end":18,"severity":"low","line_start":18},{"id":"blocker:SKILL.md:26:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"5. **Run what exists**: the project's tests, lint and type check, if they are quick. Report the exac","category":"blocker","line_end":26,"severity":"low","line_start":26},{"id":"blocker:SKILL.md:54:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Distinguish \"I verified this\" from \"this looks suspicious\". Do not claim a bug you did not trace.","category":"blocker","line_end":54,"severity":"low","line_start":54}],"finding_verdicts":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Line 16 uses Markdown backticks around standard Git status, diff, and merge-base commands for reviewing changes. No Ruby execution, injected shell payload, or destructive command appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"Line 24 lists console.log, print, and TODO as debug leftovers to inspect. The backticks format examples rather than execute code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Lines 30 through 48 are a fenced plaintext review template with intent, checks, findings, and questions. The fence is Markdown syntax, not shell substitution.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:18:system-reconnaissance","reason":"Line 18 requests inspection of callers, tests, and configuration surrounding changed code. This is repository-local review context, not host reconnaissance or credential discovery.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:26:system-reconnaissance","reason":"Line 26 requests existing tests, lint, and type checks with accurate reporting. These are normal verification steps, not system reconnaissance; repository code still requires trust.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:54:system-reconnaissance","reason":"Line 54 requires distinguishing verified bugs from suspicions and tracing evidence. It neither collects system information nor instructs reconnaissance.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"18efac79a818d7e997295839638fdd21906cfd1c","subject_content_hash":"90b698f93f87174f2db7e43f275ea60cbf0aaac3bf1c1da27c7d563e0f6ff65b","subject_tree_hash":"1fef3cd77497189320a0670c1e6ac3d4e860eb1bcf37ea3bc714e560bb57a21e","subject_plugin_path":"skills/agentkitco/review-my-diff","audit_payload_hash":"e928254a35b9a243b6781ad811da29f4","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"18efac79a818d7e997295839638fdd21906cfd1c","contentHash":"90b698f93f87174f2db7e43f275ea60cbf0aaac3bf1c1da27c7d563e0f6ff65b","treeHash":"1fef3cd77497189320a0670c1e6ac3d4e860eb1bcf37ea3bc714e560bb57a21e","pluginPath":"skills/agentkitco/review-my-diff","auditPayloadHash":"e928254a35b9a243b6781ad811da29f4"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/agentkitco-review-my-diff/audits/2/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}