{"data":{"skill":{"slug":"agentkitco-security-quick-review","name":"security-quick-review","icon":"📦","repo":"https://github.com/agentkitco/agentkit-dev-skills/tree/a5058856442fcb89bd538b1c01f94558488bfac3/skills/security-quick-review","status":"approved","author":"agentkitco","authorVersion":"1.0","skillstoreRevision":2},"audit":{"id":"bcbf3160-9cfd-45ba-931b-160b45c26238","skill_id":"716938bf-a71c-49c4-aef4-fe7fedfd9721","version":2,"content_hash":"v3:18efac79a818d7e997295839638fdd21906cfd1c:a4bd778479b48a565136133dbb4644d3d5f3301a1dcbda8af877c5d2212c16e9:b6ebc2f6d8576f0858df6e4ff14e50e2d891e57067ce3886a949095bd1955e49:736b696c6c732f6167656e746b6974636f2f73656375726974792d717569636b2d726576696577:236e746fe10f91564088c699091920d0","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All five static findings are false positives from Markdown formatting, defensive terminology, and scoped code inspection. The only suggested commands inspect Git changes and history; the skill forbids live exploitation and repeating secret values. No evidence found of malicious instructions, credential exfiltration, or unsafe execution directives.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":39,"line_start":31}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":47,"audit_model":"codex","audited_at":"2026-10-22T19:29:48.11+00:00","created_at":"2026-10-22T22:26:16.350044+00:00","static_findings":[{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Secrets**: keys, tokens, passwords, private keys, connection strings in code, config, tests, fi","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. **Unsafe operations**: deserialization of untrusted data, `eval`/`exec`, disabled TLS verificatio","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":39,"severity":"medium","line_start":31},{"id":"sensitive:SKILL.md:20:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"1. **Secrets**: keys, tokens, passwords, private keys, connection strings in code, config, tests, fi","category":"sensitive","line_end":20,"severity":"high","line_start":20},{"id":"blocker:SKILL.md:16:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"State what you reviewed (a diff, a directory, an endpoint) and what you did not. Review the diff plu","category":"blocker","line_end":16,"severity":"low","line_start":16}],"finding_verdicts":[{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"Backticks format git diff and git log -p as inline Markdown, not Ruby or shell substitution. These commands support scoped repository inspection, and the text prohibits repeating secret values.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The inline eval/exec references name unsafe operations to detect during review. They are not executable statements or instructions to invoke either operation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Lines 31 through 39 contain a fenced Markdown report template with severity labels and placeholders. The fence does not contain executable commands or command substitution.","verdict":"false_positive","confidence":1},{"id":"sensitive:SKILL.md:20:crypto-seed-private-key-mention","reason":"Private keys appear only as a category of exposed secrets to detect in scoped code and history. The instruction explicitly prohibits repeating secret values, and no actual key material appears.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:16:system-reconnaissance","reason":"Line 16 defines review scope and asks for inspection of related called code. It does not request host enumeration, system probing, or unrelated data collection.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"18efac79a818d7e997295839638fdd21906cfd1c","subject_content_hash":"a4bd778479b48a565136133dbb4644d3d5f3301a1dcbda8af877c5d2212c16e9","subject_tree_hash":"b6ebc2f6d8576f0858df6e4ff14e50e2d891e57067ce3886a949095bd1955e49","subject_plugin_path":"skills/agentkitco/security-quick-review","audit_payload_hash":"236e746fe10f91564088c699091920d0","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"18efac79a818d7e997295839638fdd21906cfd1c","contentHash":"a4bd778479b48a565136133dbb4644d3d5f3301a1dcbda8af877c5d2212c16e9","treeHash":"b6ebc2f6d8576f0858df6e4ff14e50e2d891e57067ce3886a949095bd1955e49","pluginPath":"skills/agentkitco/security-quick-review","auditPayloadHash":"236e746fe10f91564088c699091920d0"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/agentkitco-security-quick-review/audits/2/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}