{"data":{"skill":{"slug":"agentsecops-webapp-nikto","name":"webapp-nikto","icon":"📦","repo":"https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/webapp-nikto","status":"approved","author":"AgentSecOps","authorVersion":"0.1.0","skillstoreRevision":2},"audit":{"id":"040e3933-c1d4-4ae9-8ade-aac8e5724061","skill_id":"896a4111-1a40-4239-a8b9-444ce6e7e5a8","version":9,"content_hash":"v3:181fdefcafd96b041926e61c4b2e306ca7e7820e:bb047e6769cd6301ebf04c001948750e35f02ac9b944d2ca9b9345b7958ddf27:f7d33c939da83a9a40e397f2a9dad0e30c24b5ff6eb2945a101f47a2df209a9a:736b696c6c732f6167656e747365636f70732f7765626170702d6e696b746f:c2eb81f811a627eb5a4899fe0e24ed93","risk_level":"critical","is_blocked":true,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"blocked","manual_install_policy":"allowed_with_warning","summary":"Most static findings are false positives from Markdown code fences, reserved example URLs, defensive samples, and standard local report processing. The CI template executes an unverified remote installer and uses mutable third-party actions in security-sensitive workflows. The skill also provides actionable IDS and WAF evasion guidance despite repeated authorization warnings.","remediation":[{"issue":"A remote script is piped directly into Bash from a mutable branch.","severity":"critical","suggestion":"Download a versioned release, verify its checksum or signature, and execute only the verified local file."},{"issue":"Third-party GitHub Actions use mutable release tags or the master branch.","severity":"high","suggestion":"Pin every third-party action to a reviewed commit SHA and use dependency automation for controlled updates."},{"issue":"The skill provides detailed IDS and WAF evasion commands.","severity":"high","suggestion":"Remove evasion guidance, or restrict it to approved validation goals with explicit authorization and monitoring requirements."},{"issue":"The CI scan example accepts any target URL without an allowlist.","severity":"medium","suggestion":"Require an approved target allowlist and reject private, loopback, link-local, metadata, or out-of-scope destinations."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"assets/ci-config-template.yml","line_end":298,"line_start":298},{"file":"assets/ci-config-template.yml","line_end":301,"line_start":301},{"file":"assets/ci-config-template.yml","line_end":304,"line_start":304},{"file":"assets/ci-config-template.yml","line_end":307,"line_start":307},{"file":"assets/ci-config-template.yml","line_end":310,"line_start":310},{"file":"assets/ci-config-template.yml","line_end":134,"line_start":134},{"file":"assets/ci-config-template.yml","line_end":250,"line_start":250},{"file":"assets/ci-config-template.yml","line_end":291,"line_start":291},{"file":"SKILL.md","line_end":48,"line_start":36},{"file":"SKILL.md","line_end":79,"line_start":48},{"file":"SKILL.md","line_end":97,"line_start":79},{"file":"SKILL.md","line_end":103,"line_start":97},{"file":"SKILL.md","line_end":121,"line_start":103},{"file":"SKILL.md","line_end":145,"line_start":121},{"file":"SKILL.md","line_end":160,"line_start":145},{"file":"SKILL.md","line_end":166,"line_start":160},{"file":"SKILL.md","line_end":184,"line_start":166},{"file":"SKILL.md","line_end":190,"line_start":184},{"file":"SKILL.md","line_end":205,"line_start":190},{"file":"SKILL.md","line_end":258,"line_start":205},{"file":"SKILL.md","line_end":266,"line_start":258},{"file":"SKILL.md","line_end":270,"line_start":266},{"file":"SKILL.md","line_end":277,"line_start":270},{"file":"SKILL.md","line_end":281,"line_start":277},{"file":"SKILL.md","line_end":287,"line_start":281},{"file":"SKILL.md","line_end":291,"line_start":287},{"file":"SKILL.md","line_end":298,"line_start":291},{"file":"SKILL.md","line_end":302,"line_start":298},{"file":"SKILL.md","line_end":312,"line_start":302},{"file":"SKILL.md","line_end":318,"line_start":312},{"file":"SKILL.md","line_end":341,"line_start":318},{"file":"SKILL.md","line_end":345,"line_start":341},{"file":"SKILL.md","line_end":352,"line_start":345},{"file":"SKILL.md","line_end":359,"line_start":352},{"file":"SKILL.md","line_end":368,"line_start":359},{"file":"SKILL.md","line_end":373,"line_start":368},{"file":"SKILL.md","line_end":382,"line_start":373},{"file":"SKILL.md","line_end":395,"line_start":382},{"file":"SKILL.md","line_end":404,"line_start":395},{"file":"SKILL.md","line_end":323,"line_start":323},{"file":"SKILL.md","line_end":341,"line_start":318},{"file":"SKILL.md","line_end":319,"line_start":319}]},{"factor":"network","evidence":[{"file":"assets/ci-config-template.yml","line_end":240,"line_start":240},{"file":"assets/rule-template.yaml","line_end":43,"line_start":43},{"file":"assets/rule-template.yaml","line_end":44,"line_start":44},{"file":"assets/rule-template.yaml","line_end":45,"line_start":45},{"file":"assets/rule-template.yaml","line_end":73,"line_start":73},{"file":"assets/rule-template.yaml","line_end":118,"line_start":118},{"file":"assets/rule-template.yaml","line_end":119,"line_start":119},{"file":"assets/rule-template.yaml","line_end":151,"line_start":151},{"file":"assets/rule-template.yaml","line_end":191,"line_start":191},{"file":"assets/rule-template.yaml","line_end":192,"line_start":192},{"file":"assets/rule-template.yaml","line_end":193,"line_start":193},{"file":"assets/rule-template.yaml","line_end":217,"line_start":217},{"file":"assets/rule-template.yaml","line_end":260,"line_start":260},{"file":"assets/rule-template.yaml","line_end":261,"line_start":261},{"file":"assets/rule-template.yaml","line_end":288,"line_start":288},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":90,"line_start":90},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":105,"line_start":105},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":114,"line_start":114},{"file":"SKILL.md","line_end":147,"line_start":147},{"file":"SKILL.md","line_end":150,"line_start":150},{"file":"SKILL.md","line_end":153,"line_start":153},{"file":"SKILL.md","line_end":156,"line_start":156},{"file":"SKILL.md","line_end":159,"line_start":159},{"file":"SKILL.md","line_end":168,"line_start":168},{"file":"SKILL.md","line_end":171,"line_start":171},{"file":"SKILL.md","line_end":174,"line_start":174},{"file":"SKILL.md","line_end":177,"line_start":177},{"file":"SKILL.md","line_end":180,"line_start":180},{"file":"SKILL.md","line_end":183,"line_start":183},{"file":"SKILL.md","line_end":192,"line_start":192},{"file":"SKILL.md","line_end":195,"line_start":195},{"file":"SKILL.md","line_end":198,"line_start":198},{"file":"SKILL.md","line_end":201,"line_start":201},{"file":"SKILL.md","line_end":204,"line_start":204},{"file":"SKILL.md","line_end":261,"line_start":261},{"file":"SKILL.md","line_end":272,"line_start":272},{"file":"SKILL.md","line_end":283,"line_start":283},{"file":"SKILL.md","line_end":293,"line_start":293},{"file":"SKILL.md","line_end":305,"line_start":305},{"file":"SKILL.md","line_end":306,"line_start":306}]},{"factor":"filesystem","evidence":[{"file":"assets/ci-config-template.yml","line_end":323,"line_start":323},{"file":"assets/ci-config-template.yml","line_end":323,"line_start":323}]},{"factor":"env_access","evidence":[{"file":"assets/ci-config-template.yml","line_end":164,"line_start":164},{"file":"assets/rule-template.yaml","line_end":148,"line_start":148},{"file":"assets/rule-template.yaml","line_end":148,"line_start":148},{"file":"assets/rule-template.yaml","line_end":147,"line_start":147},{"file":"assets/rule-template.yaml","line_end":162,"line_start":162},{"file":"assets/rule-template.yaml","line_end":132,"line_start":132},{"file":"assets/rule-template.yaml","line_end":147,"line_start":147},{"file":"assets/rule-template.yaml","line_end":148,"line_start":148},{"file":"assets/rule-template.yaml","line_end":156,"line_start":156},{"file":"assets/rule-template.yaml","line_end":157,"line_start":157},{"file":"assets/rule-template.yaml","line_end":162,"line_start":162},{"file":"assets/rule-template.yaml","line_end":163,"line_start":163},{"file":"assets/rule-template.yaml","line_end":164,"line_start":164},{"file":"assets/rule-template.yaml","line_end":165,"line_start":165},{"file":"references/EXAMPLE.md","line_end":423,"line_start":423},{"file":"references/EXAMPLE.md","line_end":423,"line_start":423},{"file":"references/EXAMPLE.md","line_end":424,"line_start":424},{"file":"references/EXAMPLE.md","line_end":425,"line_start":425},{"file":"references/EXAMPLE.md","line_end":427,"line_start":427},{"file":"references/EXAMPLE.md","line_end":430,"line_start":430},{"file":"references/EXAMPLE.md","line_end":432,"line_start":432},{"file":"references/EXAMPLE.md","line_end":437,"line_start":437},{"file":"references/EXAMPLE.md","line_end":444,"line_start":444}]},{"factor":"scripts","evidence":[{"file":"references/EXAMPLE.md","line_end":138,"line_start":138},{"file":"references/EXAMPLE.md","line_end":137,"line_start":137}]}],"critical_findings":[{"title":"Pipe to shell pattern","locations":[{"file":"assets/ci-config-template.yml","line_end":240,"line_start":240}],"confidence":0.99,"description":"curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The workflow downloads a script from a mutable branch and pipes it directly to Bash. A compromised upstream response would execute arbitrary code on the CI runner."}],"high_findings":[{"title":"Hardcoded URL","locations":[{"file":"assets/ci-config-template.yml","line_end":240,"line_start":240}],"confidence":0.98,"description":"curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The URL references an installer on the mutable master branch and its response is executed without checksum or signature verification. This creates a concrete supply-chain dependency."},{"title":"Actionable IDS and WAF Evasion Guidance","locations":[{"file":"SKILL.md","line_end":215,"line_start":186},{"file":"SKILL.md","line_end":404,"line_start":392}],"confidence":0.98,"description":"The skill teaches random user agents, URI mutations, IDS evasion, and WAF bypass techniques that can conceal unauthorized vulnerability scanning.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The headings and commands explicitly describe evading detection and continuing when a WAF blocks scans. Authorization warnings reduce misuse risk but do not remove the capability."},{"title":"Mutable Third-Party CI Actions","locations":[{"file":"assets/ci-config-template.yml","line_end":165,"line_start":161},{"file":"assets/ci-config-template.yml","line_end":202,"line_start":196}],"confidence":0.97,"description":"The CI template uses third-party actions through mutable tags, including a master branch, allowing upstream changes to execute in security-sensitive workflows.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The template visibly selects gitleaks-action@v2 and trivy-action@master instead of immutable commit SHAs. These actions run on CI runners with repository context."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[{"title":"Pipe to shell pattern","locations":[{"file":"assets/ci-config-template.yml","line_end":240,"line_start":240}],"confidence":0.99,"description":"curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The workflow downloads a script from a mutable branch and pipes it directly to Bash. A compromised upstream response would execute arbitrary code on the CI runner."}],"files_scanned":6,"total_lines":1972,"audit_model":"codex","audited_at":"2026-07-23T07:18:17.619+00:00","created_at":"2026-07-24T04:57:38.27435+00:00","static_findings":[{"id":"external_commands:assets/ci-config-template.yml:298:ruby-shell-backtick-execution","file":"assets/ci-config-template.yml","pattern":"Ruby/shell backtick execution","snippet":"See artifacts: `sast-results`","category":"external_commands","line_end":298,"severity":"medium","line_start":298},{"id":"external_commands:assets/ci-config-template.yml:301:ruby-shell-backtick-execution","file":"assets/ci-config-template.yml","pattern":"Ruby/shell backtick execution","snippet":"See artifacts: `dependency-scan-results`","category":"external_commands","line_end":301,"severity":"medium","line_start":301},{"id":"external_commands:assets/ci-config-template.yml:304:ruby-shell-backtick-execution","file":"assets/ci-config-template.yml","pattern":"Ruby/shell backtick execution","snippet":"See artifacts: `secrets-scan-results`","category":"external_commands","line_end":304,"severity":"medium","line_start":304},{"id":"external_commands:assets/ci-config-template.yml:307:ruby-shell-backtick-execution","file":"assets/ci-config-template.yml","pattern":"Ruby/shell backtick execution","snippet":"See artifacts: `container-scan-results`","category":"external_commands","line_end":307,"severity":"medium","line_start":307},{"id":"external_commands:assets/ci-config-template.yml:310:ruby-shell-backtick-execution","file":"assets/ci-config-template.yml","pattern":"Ruby/shell backtick execution","snippet":"See artifacts: `iac-scan-results`","category":"external_commands","line_end":310,"severity":"medium","line_start":310},{"id":"external_commands:assets/ci-config-template.yml:134:shell-command-substitution","file":"assets/ci-config-template.yml","pattern":"Shell command substitution","snippet":"critical_count=$(python3 -c \"import json; data=json.load(open('${{ env.REPORT_DIR }}/safety-results.","category":"external_commands","line_end":134,"severity":"medium","line_start":134},{"id":"external_commands:assets/ci-config-template.yml:250:shell-command-substitution","file":"assets/ci-config-template.yml","pattern":"Shell command substitution","snippet":"critical_count=$(python3 -c \"import json; data=json.load(open('${{ env.REPORT_DIR }}/checkov-results","category":"external_commands","line_end":250,"severity":"medium","line_start":250},{"id":"external_commands:assets/ci-config-template.yml:291:shell-command-substitution","file":"assets/ci-config-template.yml","pattern":"Shell command substitution","snippet":"**Scan Date**: $(date -u +\"%Y-%m-%d %H:%M:%S UTC\")","category":"external_commands","line_end":291,"severity":"medium","line_start":291},{"id":"network:assets/ci-config-template.yml:240:hardcoded-url","file":"assets/ci-config-template.yml","pattern":"Hardcoded URL","snippet":"curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash","category":"network","line_end":240,"severity":"low","line_start":240},{"id":"filesystem:assets/ci-config-template.yml:323:node-js-fs-operations","file":"assets/ci-config-template.yml","pattern":"Node.js fs operations","snippet":"const report = fs.readFileSync('consolidated-report/security-summary.md', 'utf8');","category":"filesystem","line_end":323,"severity":"medium","line_start":323},{"id":"filesystem:assets/ci-config-template.yml:323:synchronous-file-operations","file":"assets/ci-config-template.yml","pattern":"Synchronous file operations","snippet":"const report = fs.readFileSync('consolidated-report/security-summary.md', 'utf8');","category":"filesystem","line_end":323,"severity":"medium","line_start":323},{"id":"env_access:assets/ci-config-template.yml:164:git-platform-tokens","file":"assets/ci-config-template.yml","pattern":"Git platform tokens","snippet":"GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}","category":"env_access","line_end":164,"severity":"high","line_start":164},{"id":"blocker:assets/ci-config-template.yml:240:pipe-to-shell-pattern","file":"assets/ci-config-template.yml","pattern":"Pipe to shell pattern","snippet":"curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash","category":"blocker","line_end":240,"severity":"critical","line_start":240},{"id":"network:assets/rule-template.yaml:43:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"- \"https://owasp.org/www-community/attacks/SQL_Injection\"","category":"network","line_end":43,"severity":"low","line_start":43},{"id":"network:assets/rule-template.yaml:44:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"- \"https://cwe.mitre.org/data/definitions/89.html\"","category":"network","line_end":44,"severity":"low","line_start":44},{"id":"network:assets/rule-template.yaml:45:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"- \"https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html\"","category":"network","line_end":45,"severity":"low","line_start":45},{"id":"network:assets/rule-template.yaml:73:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"See: https://owasp.org/www-community/attacks/SQL_Injection","category":"network","line_end":73,"severity":"low","line_start":73},{"id":"network:assets/rule-template.yaml:118:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"- \"https://cwe.mitre.org/data/definitions/798.html\"","category":"network","line_end":118,"severity":"low","line_start":118},{"id":"network:assets/rule-template.yaml:119:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"- \"https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password\"","category":"network","line_end":119,"severity":"low","line_start":119},{"id":"network:assets/rule-template.yaml:151:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"See: https://cwe.mitre.org/data/definitions/798.html","category":"network","line_end":151,"severity":"low","line_start":151},{"id":"network:assets/rule-template.yaml:191:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"- \"https://owasp.org/www-community/attacks/xss/\"","category":"network","line_end":191,"severity":"low","line_start":191},{"id":"network:assets/rule-template.yaml:192:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"- \"https://cwe.mitre.org/data/definitions/79.html\"","category":"network","line_end":192,"severity":"low","line_start":192},{"id":"network:assets/rule-template.yaml:193:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"- \"https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\"","category":"network","line_end":193,"severity":"low","line_start":193},{"id":"network:assets/rule-template.yaml:217:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"See: https://owasp.org/www-community/attacks/xss/","category":"network","line_end":217,"severity":"low","line_start":217},{"id":"network:assets/rule-template.yaml:260:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"- \"https://cwe.mitre.org/data/definitions/327.html\"","category":"network","line_end":260,"severity":"low","line_start":260},{"id":"network:assets/rule-template.yaml:261:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"- \"https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testin","category":"network","line_end":261,"severity":"low","line_start":261},{"id":"network:assets/rule-template.yaml:288:hardcoded-url","file":"assets/rule-template.yaml","pattern":"Hardcoded URL","snippet":"See: https://cwe.mitre.org/data/definitions/327.html","category":"network","line_end":288,"severity":"low","line_start":288},{"id":"env_access:assets/rule-template.yaml:148:environment-variable-access-dot-notation","file":"assets/rule-template.yaml","pattern":"Environment variable access (dot notation)","snippet":"- Node.js: process.env.API_KEY","category":"env_access","line_end":148,"severity":"low","line_start":148},{"id":"env_access:assets/rule-template.yaml:148:environment-variable-object","file":"assets/rule-template.yaml","pattern":"Environment variable object","snippet":"- Node.js: process.env.API_KEY","category":"env_access","line_end":148,"severity":"low","line_start":148},{"id":"env_access:assets/rule-template.yaml:147:python-environment-access","file":"assets/rule-template.yaml","pattern":"Python environment access","snippet":"- Python: os.environ.get('API_KEY')","category":"env_access","line_end":147,"severity":"low","line_start":147},{"id":"env_access:assets/rule-template.yaml:162:python-environment-access","file":"assets/rule-template.yaml","pattern":"Python environment access","snippet":"api_key = os.environ.get('API_KEY')","category":"env_access","line_end":162,"severity":"low","line_start":162},{"id":"env_access:assets/rule-template.yaml:132:generic-api-secret-keys","file":"assets/rule-template.yaml","pattern":"Generic API/secret keys","snippet":"api_key = \"...\"","category":"env_access","line_end":132,"severity":"high","line_start":132},{"id":"env_access:assets/rule-template.yaml:147:generic-api-secret-keys","file":"assets/rule-template.yaml","pattern":"Generic API/secret keys","snippet":"- Python: os.environ.get('API_KEY')","category":"env_access","line_end":147,"severity":"high","line_start":147},{"id":"env_access:assets/rule-template.yaml:148:generic-api-secret-keys","file":"assets/rule-template.yaml","pattern":"Generic API/secret keys","snippet":"- Node.js: process.env.API_KEY","category":"env_access","line_end":148,"severity":"high","line_start":148},{"id":"env_access:assets/rule-template.yaml:156:generic-api-secret-keys","file":"assets/rule-template.yaml","pattern":"Generic API/secret keys","snippet":"api_key = \"sk-1234567890abcdef\"","category":"env_access","line_end":156,"severity":"high","line_start":156},{"id":"env_access:assets/rule-template.yaml:157:generic-api-secret-keys","file":"assets/rule-template.yaml","pattern":"Generic API/secret keys","snippet":"api.authenticate(api_key)","category":"env_access","line_end":157,"severity":"high","line_start":157},{"id":"env_access:assets/rule-template.yaml:162:generic-api-secret-keys","file":"assets/rule-template.yaml","pattern":"Generic API/secret keys","snippet":"api_key = os.environ.get('API_KEY')","category":"env_access","line_end":162,"severity":"high","line_start":162},{"id":"env_access:assets/rule-template.yaml:163:generic-api-secret-keys","file":"assets/rule-template.yaml","pattern":"Generic API/secret keys","snippet":"if not api_key:","category":"env_access","line_end":163,"severity":"high","line_start":163},{"id":"env_access:assets/rule-template.yaml:164:generic-api-secret-keys","file":"assets/rule-template.yaml","pattern":"Generic API/secret keys","snippet":"raise ValueError(\"API_KEY environment variable not set\")","category":"env_access","line_end":164,"severity":"high","line_start":164},{"id":"env_access:assets/rule-template.yaml:165:generic-api-secret-keys","file":"assets/rule-template.yaml","pattern":"Generic API/secret keys","snippet":"api.authenticate(api_key)","category":"env_access","line_end":165,"severity":"high","line_start":165},{"id":"sensitive:assets/rule-template.yaml:148:environment-file-access","file":"assets/rule-template.yaml","pattern":"Environment file access","snippet":"- Node.js: process.env.API_KEY","category":"sensitive","line_end":148,"severity":"high","line_start":148},{"id":"blocker:assets/rule-template.yaml:70:system-reconnaissance","file":"assets/rule-template.yaml","pattern":"System reconnaissance","snippet":"- Python: cursor.execute(\"SELECT * FROM users WHERE id = ?\", (user_id,))","category":"blocker","line_end":70,"severity":"low","line_start":70},{"id":"blocker:assets/rule-template.yaml:71:system-reconnaissance","file":"assets/rule-template.yaml","pattern":"System reconnaissance","snippet":"- JavaScript: db.query(\"SELECT * FROM users WHERE id = $1\", [userId])","category":"blocker","line_end":71,"severity":"low","line_start":71},{"id":"blocker:assets/rule-template.yaml:83:system-reconnaissance","file":"assets/rule-template.yaml","pattern":"System reconnaissance","snippet":"user_id = request.GET['id']","category":"blocker","line_end":83,"severity":"low","line_start":83},{"id":"blocker:assets/rule-template.yaml:84:system-reconnaissance","file":"assets/rule-template.yaml","pattern":"System reconnaissance","snippet":"query = \"SELECT * FROM users WHERE id = \" + user_id","category":"blocker","line_end":84,"severity":"low","line_start":84},{"id":"blocker:assets/rule-template.yaml:89:system-reconnaissance","file":"assets/rule-template.yaml","pattern":"System reconnaissance","snippet":"user_id = request.GET['id']","category":"blocker","line_end":89,"severity":"low","line_start":89},{"id":"blocker:assets/rule-template.yaml:90:system-reconnaissance","file":"assets/rule-template.yaml","pattern":"System reconnaissance","snippet":"query = \"SELECT * FROM users WHERE id = ?\"","category":"blocker","line_end":90,"severity":"low","line_start":90},{"id":"scripts:references/EXAMPLE.md:138:document-write-injection","file":"references/EXAMPLE.md","pattern":"document.write injection","snippet":"document.write(userInput);","category":"scripts","line_end":138,"severity":"high","line_start":138},{"id":"scripts:references/EXAMPLE.md:137:innerhtml-assignment-xss-risk","file":"references/EXAMPLE.md","pattern":"innerHTML assignment (XSS risk)","snippet":"element.innerHTML = userInput;","category":"scripts","line_end":137,"severity":"medium","line_start":137},{"id":"env_access:references/EXAMPLE.md:423:python-environment-access","file":"references/EXAMPLE.md","pattern":"Python environment access","snippet":"VALID_API_KEY = os.environ.get('API_KEY')","category":"env_access","line_end":423,"severity":"low","line_start":423},{"id":"env_access:references/EXAMPLE.md:423:generic-api-secret-keys","file":"references/EXAMPLE.md","pattern":"Generic API/secret keys","snippet":"VALID_API_KEY = os.environ.get('API_KEY')","category":"env_access","line_end":423,"severity":"high","line_start":423},{"id":"env_access:references/EXAMPLE.md:424:generic-api-secret-keys","file":"references/EXAMPLE.md","pattern":"Generic API/secret keys","snippet":"if not VALID_API_KEY:","category":"env_access","line_end":424,"severity":"high","line_start":424},{"id":"env_access:references/EXAMPLE.md:425:generic-api-secret-keys","file":"references/EXAMPLE.md","pattern":"Generic API/secret keys","snippet":"raise ValueError(\"API_KEY environment variable not set\")","category":"env_access","line_end":425,"severity":"high","line_start":425},{"id":"env_access:references/EXAMPLE.md:427:generic-api-secret-keys","file":"references/EXAMPLE.md","pattern":"Generic API/secret keys","snippet":"def require_api_key(f):","category":"env_access","line_end":427,"severity":"high","line_start":427},{"id":"env_access:references/EXAMPLE.md:430:generic-api-secret-keys","file":"references/EXAMPLE.md","pattern":"Generic API/secret keys","snippet":"api_key = request.headers.get('X-API-Key')","category":"env_access","line_end":430,"severity":"high","line_start":430},{"id":"env_access:references/EXAMPLE.md:432:generic-api-secret-keys","file":"references/EXAMPLE.md","pattern":"Generic API/secret keys","snippet":"if not api_key:","category":"env_access","line_end":432,"severity":"high","line_start":432},{"id":"env_access:references/EXAMPLE.md:437:generic-api-secret-keys","file":"references/EXAMPLE.md","pattern":"Generic API/secret keys","snippet":"if not hmac.compare_digest(api_key, VALID_API_KEY):","category":"env_access","line_end":437,"severity":"high","line_start":437},{"id":"env_access:references/EXAMPLE.md:444:generic-api-secret-keys","file":"references/EXAMPLE.md","pattern":"Generic API/secret keys","snippet":"@require_api_key","category":"env_access","line_end":444,"severity":"high","line_start":444},{"id":"blocker:references/EXAMPLE.md:276:c2-keywords","file":"references/EXAMPLE.md","pattern":"C2 keywords","snippet":"- **T1041**: Exfiltration Over C2 Channel","category":"blocker","line_end":276,"severity":"high","line_start":276},{"id":"blocker:references/EXAMPLE.md:97:system-reconnaissance","file":"references/EXAMPLE.md","pattern":"System reconnaissance","snippet":"query = \"SELECT * FROM users WHERE id = \" + user_id","category":"blocker","line_end":97,"severity":"low","line_start":97},{"id":"blocker:references/EXAMPLE.md:113:system-reconnaissance","file":"references/EXAMPLE.md","pattern":"System reconnaissance","snippet":"query = \"SELECT * FROM users WHERE id = ?\"","category":"blocker","line_end":113,"severity":"low","line_start":113},{"id":"blocker:references/EXAMPLE.md:242:system-reconnaissance","file":"references/EXAMPLE.md","pattern":"System reconnaissance","snippet":"- **T1078**: Valid Accounts","category":"blocker","line_end":242,"severity":"low","line_start":242},{"id":"blocker:references/EXAMPLE.md:298:system-reconnaissance","file":"references/EXAMPLE.md","pattern":"System reconnaissance","snippet":"cursor.execute(\"SELECT * FROM users WHERE id = ?\", (user_id,))","category":"blocker","line_end":298,"severity":"low","line_start":298},{"id":"blocker:references/EXAMPLE.md:301:system-reconnaissance","file":"references/EXAMPLE.md","pattern":"System reconnaissance","snippet":"cursor.execute(\"SELECT * FROM users WHERE id = %s\", (user_id,))","category":"blocker","line_end":301,"severity":"low","line_start":301},{"id":"blocker:references/EXAMPLE.md:305:system-reconnaissance","file":"references/EXAMPLE.md","pattern":"System reconnaissance","snippet":"result = session.execute(text(\"SELECT * FROM users WHERE id = :id\"), {\"id\": user_id})","category":"blocker","line_end":305,"severity":"low","line_start":305},{"id":"blocker:references/EXAMPLE.md:314:system-reconnaissance","file":"references/EXAMPLE.md","pattern":"System reconnaissance","snippet":"raise ValueError(\"Invalid user ID format\")","category":"blocker","line_end":314,"severity":"low","line_start":314},{"id":"blocker:references/EXAMPLE.md:438:system-reconnaissance","file":"references/EXAMPLE.md","pattern":"System reconnaissance","snippet":"return jsonify({'error': 'Invalid API key'}), 403","category":"blocker","line_end":438,"severity":"low","line_start":438},{"id":"blocker:references/EXAMPLE.md:471:system-reconnaissance","file":"references/EXAMPLE.md","pattern":"System reconnaissance","snippet":"is_valid = verify_password(\"user_password\", stored_hash)  # True","category":"blocker","line_end":471,"severity":"low","line_start":471},{"id":"blocker:references/EXAMPLE.md:523:system-reconnaissance","file":"references/EXAMPLE.md","pattern":"System reconnaissance","snippet":"raise ValueError(\"Invalid file type\")","category":"blocker","line_end":523,"severity":"low","line_start":523},{"id":"blocker:references/EXAMPLE.md:529:system-reconnaissance","file":"references/EXAMPLE.md","pattern":"System reconnaissance","snippet":"import uuid","category":"blocker","line_end":530,"severity":"low","line_start":529},{"id":"blocker:references/EXAMPLE.md:381:network-reconnaissance","file":"references/EXAMPLE.md","pattern":"Network reconnaissance","snippet":"- xss","category":"blocker","line_end":382,"severity":"low","line_start":381},{"id":"blocker:references/WORKFLOW_CHECKLIST.md:193:malware-type-keywords","file":"references/WORKFLOW_CHECKLIST.md","pattern":"Malware type keywords","snippet":"[ ] 10. Remove malicious artifacts (malware, backdoors, webshells)","category":"blocker","line_end":193,"severity":"high","line_start":193},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":48,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":79,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":97,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":103,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":121,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":145,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":160,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":166,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":184,"severity":"medium","line_start":166},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":190,"severity":"medium","line_start":184},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":205,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":258,"severity":"medium","line_start":205},{"id":"external_commands:SKILL.md:258:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":266,"severity":"medium","line_start":258},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":270,"severity":"medium","line_start":266},{"id":"external_commands:SKILL.md:270:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":277,"severity":"medium","line_start":270},{"id":"external_commands:SKILL.md:277:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":281,"severity":"medium","line_start":277},{"id":"external_commands:SKILL.md:281:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":287,"severity":"medium","line_start":281},{"id":"external_commands:SKILL.md:287:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":291,"severity":"medium","line_start":287},{"id":"external_commands:SKILL.md:291:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":298,"severity":"medium","line_start":291},{"id":"external_commands:SKILL.md:298:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":302,"severity":"medium","line_start":298},{"id":"external_commands:SKILL.md:302:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":312,"severity":"medium","line_start":302},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":318,"severity":"medium","line_start":312},{"id":"external_commands:SKILL.md:318:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":341,"severity":"medium","line_start":318},{"id":"external_commands:SKILL.md:341:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":345,"severity":"medium","line_start":341},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":352,"severity":"medium","line_start":345},{"id":"external_commands:SKILL.md:352:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":359,"severity":"medium","line_start":352},{"id":"external_commands:SKILL.md:359:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":368,"severity":"medium","line_start":359},{"id":"external_commands:SKILL.md:368:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":373,"severity":"medium","line_start":368},{"id":"external_commands:SKILL.md:373:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":382,"severity":"medium","line_start":373},{"id":"external_commands:SKILL.md:382:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":395,"severity":"medium","line_start":382},{"id":"external_commands:SKILL.md:395:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":404,"severity":"medium","line_start":395},{"id":"external_commands:SKILL.md:323:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"OUTPUT_DIR=\"nikto_results/$(date +%Y%m%d_%H%M%S)\"","category":"external_commands","line_end":323,"severity":"medium","line_start":323},{"id":"external_commands:SKILL.md:318:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"```bash","category":"external_commands","line_end":341,"severity":"medium","line_start":318},{"id":"external_commands:SKILL.md:319:unix-shell-invocation","file":"SKILL.md","pattern":"Unix shell invocation","snippet":"#!/bin/bash","category":"external_commands","line_end":319,"severity":"medium","line_start":319},{"id":"network:SKILL.md:19:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://cirt.net/Nikto2","category":"network","line_end":19,"severity":"low","line_start":19},{"id":"network:SKILL.md:20:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://github.com/sullo/nikto","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"network:SKILL.md:21:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- https://owasp.org/www-project-web-security-testing-guide/","category":"network","line_end":21,"severity":"low","line_start":21},{"id":"network:SKILL.md:38:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com","category":"network","line_end":38,"severity":"low","line_start":38},{"id":"network:SKILL.md:41:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h https://example.com","category":"network","line_end":41,"severity":"low","line_start":41},{"id":"network:SKILL.md:81:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com","category":"network","line_end":81,"severity":"low","line_start":81},{"id":"network:SKILL.md:84:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -useragent \"Mozilla/5.0...\"","category":"network","line_end":84,"severity":"low","line_start":84},{"id":"network:SKILL.md:87:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -useproxy http://proxy:8080","category":"network","line_end":87,"severity":"low","line_start":87},{"id":"network:SKILL.md:90:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -id username:password","category":"network","line_end":90,"severity":"low","line_start":90},{"id":"network:SKILL.md:93:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h https://example.com -ssl","category":"network","line_end":93,"severity":"low","line_start":93},{"id":"network:SKILL.md:105:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -Tuning 123bde","category":"network","line_end":105,"severity":"low","line_start":105},{"id":"network:SKILL.md:108:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -Tuning x","category":"network","line_end":108,"severity":"low","line_start":108},{"id":"network:SKILL.md:114:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -Plugins \"apache_expect_xss\"","category":"network","line_end":114,"severity":"low","line_start":114},{"id":"network:SKILL.md:147:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -o results.txt","category":"network","line_end":147,"severity":"low","line_start":147},{"id":"network:SKILL.md:150:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -o results.html -Format html","category":"network","line_end":150,"severity":"low","line_start":150},{"id":"network:SKILL.md:153:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -o results.csv -Format csv","category":"network","line_end":153,"severity":"low","line_start":153},{"id":"network:SKILL.md:156:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -o results.xml -Format xml","category":"network","line_end":156,"severity":"low","line_start":156},{"id":"network:SKILL.md:159:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -o results.txt -Format txt -o results.html -Format html","category":"network","line_end":159,"severity":"low","line_start":159},{"id":"network:SKILL.md:168:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -timeout 20","category":"network","line_end":168,"severity":"low","line_start":168},{"id":"network:SKILL.md:171:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -maxtime 30m","category":"network","line_end":171,"severity":"low","line_start":171},{"id":"network:SKILL.md:174:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -vhost example.com","category":"network","line_end":174,"severity":"low","line_start":174},{"id":"network:SKILL.md:177:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -followredirects","category":"network","line_end":177,"severity":"low","line_start":177},{"id":"network:SKILL.md:180:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -no404","category":"network","line_end":180,"severity":"low","line_start":180},{"id":"network:SKILL.md:183:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -Pause 2","category":"network","line_end":183,"severity":"low","line_start":183},{"id":"network:SKILL.md:192:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -useragent random","category":"network","line_end":192,"severity":"low","line_start":192},{"id":"network:SKILL.md:195:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -evasion 1","category":"network","line_end":195,"severity":"low","line_start":195},{"id":"network:SKILL.md:198:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -evasion 12345678","category":"network","line_end":198,"severity":"low","line_start":198},{"id":"network:SKILL.md:201:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -Pause 5","category":"network","line_end":201,"severity":"low","line_start":201},{"id":"network:SKILL.md:204:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -cookies \"session=abc123\"","category":"network","line_end":204,"severity":"low","line_start":204},{"id":"network:SKILL.md:261:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h https://$host -o nikto_${host}.html -Format html","category":"network","line_end":261,"severity":"low","line_start":261},{"id":"network:SKILL.md:272:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://intranet.local \\","category":"network","line_end":272,"severity":"low","line_start":272},{"id":"network:SKILL.md:283:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h https://example.com \\","category":"network","line_end":283,"severity":"low","line_start":283},{"id":"network:SKILL.md:293:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com \\","category":"network","line_end":293,"severity":"low","line_start":293},{"id":"network:SKILL.md:305:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"http://web1.example.com","category":"network","line_end":305,"severity":"low","line_start":305},{"id":"network:SKILL.md:306:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://web2.example.com:8443","category":"network","line_end":306,"severity":"low","line_start":306},{"id":"network:SKILL.md:307:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"http://web3.example.com:8080","category":"network","line_end":307,"severity":"low","line_start":307},{"id":"network:SKILL.md:347:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -o findings.xml -Format xml","category":"network","line_end":347,"severity":"low","line_start":347},{"id":"network:SKILL.md:361:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -maxtime 15m","category":"network","line_end":361,"severity":"low","line_start":361},{"id":"network:SKILL.md:364:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -Tuning 123","category":"network","line_end":364,"severity":"low","line_start":364},{"id":"network:SKILL.md:367:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -no404","category":"network","line_end":367,"severity":"low","line_start":367},{"id":"network:SKILL.md:378:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h https://example.com -ssl -nossl","category":"network","line_end":378,"severity":"low","line_start":378},{"id":"network:SKILL.md:381:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h https://example.com -ssl","category":"network","line_end":381,"severity":"low","line_start":381},{"id":"network:SKILL.md:397:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -evasion 1234567","category":"network","line_end":397,"severity":"low","line_start":397},{"id":"network:SKILL.md:400:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -Pause 10","category":"network","line_end":400,"severity":"low","line_start":400},{"id":"network:SKILL.md:403:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nikto -h http://example.com -useragent \"legitimate-browser-string\"","category":"network","line_end":403,"severity":"low","line_start":403},{"id":"network:SKILL.md:438:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Nikto Official Documentation](https://cirt.net/Nikto2)","category":"network","line_end":438,"severity":"low","line_start":438},{"id":"network:SKILL.md:439:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Nikto GitHub Repository](https://github.com/sullo/nikto)","category":"network","line_end":439,"severity":"low","line_start":439},{"id":"network:SKILL.md:440:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)","category":"network","line_end":440,"severity":"low","line_start":440},{"id":"network:SKILL.md:441:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [NIST SP 800-115: Technical Security Testing](https://csrc.nist.gov/publications/detail/sp/800-115","category":"network","line_end":441,"severity":"low","line_start":441},{"id":"network:SKILL.md:442:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [CIS Web Server Benchmarks](https://www.cisecurity.org/cis-benchmarks/)","category":"network","line_end":442,"severity":"low","line_start":442},{"id":"blocker:SKILL.md:90:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"nikto -h http://example.com -id username:password","category":"blocker","line_end":90,"severity":"low","line_start":90},{"id":"blocker:SKILL.md:294:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"-id admin:password \\","category":"blocker","line_end":294,"severity":"low","line_start":294},{"id":"blocker:SKILL.md:424:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Monitor for rapid sequential requests","category":"blocker","line_end":424,"severity":"low","line_start":424},{"id":"blocker:SKILL.md:134:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- **a**: Authentication Bypass","category":"blocker","line_end":135,"severity":"low","line_start":134}],"finding_verdicts":[{"id":"external_commands:assets/ci-config-template.yml:298:ruby-shell-backtick-execution","reason":"The backticks delimit artifact names as Markdown inside a single-quoted here-document. They are report text and cannot execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:assets/ci-config-template.yml:301:ruby-shell-backtick-execution","reason":"The backticks delimit artifact names as Markdown inside a single-quoted here-document. They are report text and cannot execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:assets/ci-config-template.yml:304:ruby-shell-backtick-execution","reason":"The backticks delimit artifact names as Markdown inside a single-quoted here-document. They are report text and cannot execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:assets/ci-config-template.yml:307:ruby-shell-backtick-execution","reason":"The backticks delimit artifact names as Markdown inside a single-quoted here-document. They are report text and cannot execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:assets/ci-config-template.yml:310:ruby-shell-backtick-execution","reason":"The backticks delimit artifact names as Markdown inside a single-quoted here-document. They are report text and cannot execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:assets/ci-config-template.yml:134:shell-command-substitution","reason":"The substitution runs a fixed Python parser against a report path derived from the constant REPORT_DIR value. No untrusted text is interpolated into the command.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:assets/ci-config-template.yml:250:shell-command-substitution","reason":"The substitution runs a fixed Python parser against a report path derived from the constant REPORT_DIR value. No untrusted text is interpolated into the command.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:assets/ci-config-template.yml:291:shell-command-substitution","reason":"The date expression is inside a here-document opened with a quoted EOF delimiter. The shell writes it literally and does not perform command substitution.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/ci-config-template.yml:240:hardcoded-url","reason":"The URL references an installer on the mutable master branch and its response is executed without checksum or signature verification. This creates a concrete supply-chain dependency.","verdict":"confirmed","severity":"high","confidence":0.98},{"id":"filesystem:assets/ci-config-template.yml:323:node-js-fs-operations","reason":"The JavaScript reads a fixed, locally generated Markdown report before posting it to the current pull request. The path is not user-controlled.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:assets/ci-config-template.yml:323:synchronous-file-operations","reason":"The JavaScript reads a fixed, locally generated Markdown report before posting it to the current pull request. The path is not user-controlled.","verdict":"false_positive","confidence":0.96},{"id":"env_access:assets/ci-config-template.yml:164:git-platform-tokens","reason":"The workflow passes GitHub's scoped Actions token to the Gitleaks action under declared least-privilege permissions. The template contains no code that reads or exports the token.","verdict":"false_positive","confidence":0.9},{"id":"blocker:assets/ci-config-template.yml:240:pipe-to-shell-pattern","reason":"The workflow downloads a script from a mutable branch and pipes it directly to Bash. A compromised upstream response would execute arbitrary code on the CI runner.","verdict":"confirmed","severity":"critical","confidence":0.99},{"id":"network:assets/rule-template.yaml:43:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:44:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:45:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:73:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:118:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:119:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:151:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:191:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:192:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:193:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:217:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:260:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:261:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/rule-template.yaml:288:hardcoded-url","reason":"This URL is a documentation reference embedded in a security-rule template. The YAML does not request or execute content from the address.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:148:environment-variable-access-dot-notation","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:148:environment-variable-object","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:147:python-environment-access","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:162:python-environment-access","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:132:generic-api-secret-keys","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:147:generic-api-secret-keys","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:148:generic-api-secret-keys","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:156:generic-api-secret-keys","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:157:generic-api-secret-keys","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:162:generic-api-secret-keys","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:163:generic-api-secret-keys","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:164:generic-api-secret-keys","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:assets/rule-template.yaml:165:generic-api-secret-keys","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:assets/rule-template.yaml:148:environment-file-access","reason":"This is non-executable example text for detecting hardcoded secrets and recommending environment variables. It does not access a real environment or credential file.","verdict":"false_positive","confidence":0.99},{"id":"blocker:assets/rule-template.yaml:70:system-reconnaissance","reason":"The detector matched SQL query examples in a defensive rule template. These lines neither inspect the host system nor perform reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:assets/rule-template.yaml:71:system-reconnaissance","reason":"The detector matched SQL query examples in a defensive rule template. These lines neither inspect the host system nor perform reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:assets/rule-template.yaml:83:system-reconnaissance","reason":"The detector matched SQL query examples in a defensive rule template. These lines neither inspect the host system nor perform reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:assets/rule-template.yaml:84:system-reconnaissance","reason":"The detector matched SQL query examples in a defensive rule template. These lines neither inspect the host system nor perform reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:assets/rule-template.yaml:89:system-reconnaissance","reason":"The detector matched SQL query examples in a defensive rule template. These lines neither inspect the host system nor perform reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:assets/rule-template.yaml:90:system-reconnaissance","reason":"The detector matched SQL query examples in a defensive rule template. These lines neither inspect the host system nor perform reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"scripts:references/EXAMPLE.md:138:document-write-injection","reason":"The statement appears in a Markdown block explicitly labeled as vulnerable XSS code and is followed by safe remediation. It is not executable skill logic.","verdict":"false_positive","confidence":1},{"id":"scripts:references/EXAMPLE.md:137:innerhtml-assignment-xss-risk","reason":"The statement appears in a Markdown block explicitly labeled as vulnerable XSS code and is followed by safe remediation. It is not executable skill logic.","verdict":"false_positive","confidence":1},{"id":"env_access:references/EXAMPLE.md:423:python-environment-access","reason":"The Markdown example demonstrates secure API-key loading from an environment variable and constant-time comparison. It contains no credential value or exfiltration behavior.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/EXAMPLE.md:423:generic-api-secret-keys","reason":"The Markdown example demonstrates secure API-key loading from an environment variable and constant-time comparison. It contains no credential value or exfiltration behavior.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/EXAMPLE.md:424:generic-api-secret-keys","reason":"The Markdown example demonstrates secure API-key loading from an environment variable and constant-time comparison. It contains no credential value or exfiltration behavior.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/EXAMPLE.md:425:generic-api-secret-keys","reason":"The Markdown example demonstrates secure API-key loading from an environment variable and constant-time comparison. It contains no credential value or exfiltration behavior.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/EXAMPLE.md:427:generic-api-secret-keys","reason":"The Markdown example demonstrates secure API-key loading from an environment variable and constant-time comparison. It contains no credential value or exfiltration behavior.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/EXAMPLE.md:430:generic-api-secret-keys","reason":"The Markdown example demonstrates secure API-key loading from an environment variable and constant-time comparison. It contains no credential value or exfiltration behavior.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/EXAMPLE.md:432:generic-api-secret-keys","reason":"The Markdown example demonstrates secure API-key loading from an environment variable and constant-time comparison. It contains no credential value or exfiltration behavior.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/EXAMPLE.md:437:generic-api-secret-keys","reason":"The Markdown example demonstrates secure API-key loading from an environment variable and constant-time comparison. It contains no credential value or exfiltration behavior.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/EXAMPLE.md:444:generic-api-secret-keys","reason":"The Markdown example demonstrates secure API-key loading from an environment variable and constant-time comparison. It contains no credential value or exfiltration behavior.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/EXAMPLE.md:276:c2-keywords","reason":"The phrase is the title of MITRE ATT&CK technique T1041 in a taxonomy reference. No command-and-control channel or implementation is present.","verdict":"false_positive","confidence":1},{"id":"blocker:references/EXAMPLE.md:97:system-reconnaissance","reason":"The matched term occurs in defensive vulnerability, authentication, hashing, or file-validation examples. The reference does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/EXAMPLE.md:113:system-reconnaissance","reason":"The matched term occurs in defensive vulnerability, authentication, hashing, or file-validation examples. The reference does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/EXAMPLE.md:242:system-reconnaissance","reason":"The matched term occurs in defensive vulnerability, authentication, hashing, or file-validation examples. The reference does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/EXAMPLE.md:298:system-reconnaissance","reason":"The matched term occurs in defensive vulnerability, authentication, hashing, or file-validation examples. The reference does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/EXAMPLE.md:301:system-reconnaissance","reason":"The matched term occurs in defensive vulnerability, authentication, hashing, or file-validation examples. The reference does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/EXAMPLE.md:305:system-reconnaissance","reason":"The matched term occurs in defensive vulnerability, authentication, hashing, or file-validation examples. The reference does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/EXAMPLE.md:314:system-reconnaissance","reason":"The matched term occurs in defensive vulnerability, authentication, hashing, or file-validation examples. The reference does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/EXAMPLE.md:438:system-reconnaissance","reason":"The matched term occurs in defensive vulnerability, authentication, hashing, or file-validation examples. The reference does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/EXAMPLE.md:471:system-reconnaissance","reason":"The matched term occurs in defensive vulnerability, authentication, hashing, or file-validation examples. The reference does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/EXAMPLE.md:523:system-reconnaissance","reason":"The matched term occurs in defensive vulnerability, authentication, hashing, or file-validation examples. The reference does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/EXAMPLE.md:529:system-reconnaissance","reason":"The matched term occurs in defensive vulnerability, authentication, hashing, or file-validation examples. The reference does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/EXAMPLE.md:381:network-reconnaissance","reason":"The matched term occurs in defensive vulnerability, authentication, hashing, or file-validation examples. The reference does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/WORKFLOW_CHECKLIST.md:193:malware-type-keywords","reason":"The malware terms occur in an incident-response checklist directing defenders to remove malicious artifacts. The file does not create, install, or operate malware.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:258:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:270:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:277:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:281:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:287:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:291:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:298:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:302:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:318:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:341:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:352:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:359:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:368:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:373:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:382:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:395:ruby-shell-backtick-execution","reason":"The detector matched Markdown code-fence delimiters around documented Nikto commands. The backticks are formatting and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:323:shell-command-substitution","reason":"The shell example uses date only to create a timestamped local report directory. It contains no untrusted input or command-injection path.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:318:template-literal-with-command-substitution","reason":"The reported template literal is a Markdown Bash code fence, not a JavaScript template expression. It has no execution semantics.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:319:unix-shell-invocation","reason":"This is a documented CI shell-script example that invokes the expected Nikto tool and quotes the target argument. The shebang itself is not unsafe.","verdict":"false_positive","confidence":0.95},{"id":"network:SKILL.md:19:hardcoded-url","reason":"The address is a visible reference to Nikto, OWASP, NIST, CIS, or its source repository. It is documentation, not a hidden or automatic network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:20:hardcoded-url","reason":"The address is a visible reference to Nikto, OWASP, NIST, CIS, or its source repository. It is documentation, not a hidden or automatic network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:21:hardcoded-url","reason":"The address is a visible reference to Nikto, OWASP, NIST, CIS, or its source repository. It is documentation, not a hidden or automatic network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:38:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:41:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:81:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:84:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:87:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:90:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:93:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:105:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:108:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:114:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:147:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:150:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:153:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:156:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:159:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:168:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:171:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:174:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:177:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:180:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:183:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:192:hardcoded-url","reason":"The URL detector matched a reserved example.com target in documentation. The separate operational risk of the surrounding evasion guidance is recorded as a semantic finding.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:195:hardcoded-url","reason":"The URL detector matched a reserved example.com target in documentation. The separate operational risk of the surrounding evasion guidance is recorded as a semantic finding.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:198:hardcoded-url","reason":"The URL detector matched a reserved example.com target in documentation. The separate operational risk of the surrounding evasion guidance is recorded as a semantic finding.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:201:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:204:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:261:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:272:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:283:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:293:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:305:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:306:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:307:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:347:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:361:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:364:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:367:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:378:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:381:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:397:hardcoded-url","reason":"The URL detector matched a reserved example.com target in documentation. The separate operational risk of the surrounding evasion guidance is recorded as a semantic finding.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:400:hardcoded-url","reason":"The address is a reserved example host, a local placeholder, or a user-supplied variable in documented Nikto commands. It is not an embedded external service endpoint.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:403:hardcoded-url","reason":"The URL detector matched a reserved example.com target in documentation. The separate operational risk of the surrounding evasion guidance is recorded as a semantic finding.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:438:hardcoded-url","reason":"The address is a visible reference to Nikto, OWASP, NIST, CIS, or its source repository. It is documentation, not a hidden or automatic network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:439:hardcoded-url","reason":"The address is a visible reference to Nikto, OWASP, NIST, CIS, or its source repository. It is documentation, not a hidden or automatic network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:440:hardcoded-url","reason":"The address is a visible reference to Nikto, OWASP, NIST, CIS, or its source repository. It is documentation, not a hidden or automatic network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:441:hardcoded-url","reason":"The address is a visible reference to Nikto, OWASP, NIST, CIS, or its source repository. It is documentation, not a hidden or automatic network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:442:hardcoded-url","reason":"The address is a visible reference to Nikto, OWASP, NIST, CIS, or its source repository. It is documentation, not a hidden or automatic network request.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:90:system-reconnaissance","reason":"The line demonstrates authenticated Nikto syntax with explicit placeholder credentials. It does not enumerate the local system or expose a real credential.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:294:system-reconnaissance","reason":"The line demonstrates authenticated Nikto syntax with explicit placeholder credentials. It does not enumerate the local system or expose a real credential.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:424:system-reconnaissance","reason":"This is defensive monitoring advice for detecting rapid scan requests. It performs no reconnaissance.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:134:network-reconnaissance","reason":"The line labels Nikto tuning category a as authentication-bypass testing. It is a reference entry, not network reconnaissance behavior.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Actionable IDS and WAF Evasion Guidance","severity":"high","locations":[{"file":"SKILL.md","line_end":215,"line_start":186},{"file":"SKILL.md","line_end":404,"line_start":392}],"confidence":0.98,"description":"The skill teaches random user agents, URI mutations, IDS evasion, and WAF bypass techniques that can conceal unauthorized vulnerability scanning.","confidence_reasoning":"The headings and commands explicitly describe evading detection and continuing when a WAF blocks scans. Authorization warnings reduce misuse risk but do not remove the capability."},{"title":"Mutable Third-Party CI Actions","severity":"high","locations":[{"file":"assets/ci-config-template.yml","line_end":165,"line_start":161},{"file":"assets/ci-config-template.yml","line_end":202,"line_start":196}],"confidence":0.97,"description":"The CI template uses third-party actions through mutable tags, including a master branch, allowing upstream changes to execute in security-sensitive workflows.","confidence_reasoning":"The template visibly selects gitleaks-action@v2 and trivy-action@master instead of immutable commit SHAs. These actions run on CI runners with repository context."}],"subject_marketplace_commit_sha":"181fdefcafd96b041926e61c4b2e306ca7e7820e","subject_content_hash":"bb047e6769cd6301ebf04c001948750e35f02ac9b944d2ca9b9345b7958ddf27","subject_tree_hash":"f7d33c939da83a9a40e397f2a9dad0e30c24b5ff6eb2945a101f47a2df209a9a","subject_plugin_path":"skills/agentsecops/webapp-nikto","audit_payload_hash":"c2eb81f811a627eb5a4899fe0e24ed93","confirmed_risk_level":"critical","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"181fdefcafd96b041926e61c4b2e306ca7e7820e","contentHash":"bb047e6769cd6301ebf04c001948750e35f02ac9b944d2ca9b9345b7958ddf27","treeHash":"f7d33c939da83a9a40e397f2a9dad0e30c24b5ff6eb2945a101f47a2df209a9a","pluginPath":"skills/agentsecops/webapp-nikto","auditPayloadHash":"c2eb81f811a627eb5a4899fe0e24ed93"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/agentsecops-webapp-nikto/audits/9/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"critical","confirmedFindingCount":3,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"blocked","manualInstallPolicy":"allowed_with_warning","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}