{"data":{"skill":{"slug":"algorithmic-art","name":"algorithmic-art","icon":"📦","repo":"https://github.com/anthropics/skills/tree/main/skills/algorithmic-art","status":"approved","author":"anthropics","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"88c63462-3005-4434-a879-457b4cd08807","skill_id":"b1424dec-8126-42ff-a963-1a2a64a7265c","version":11,"content_hash":"631b73c70b2bdb06151af1917f3d911f","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Manual review confirmed only low-severity external network dependencies for p5.js and Google Fonts in the HTML template. The command execution, script execution, and reconnaissance alerts are false positives from Markdown code fences, inline code, prose, and JavaScript RegExp use. No prompt injection or hidden malicious behavior was found.","remediation":[{"issue":"Generated viewers load p5.js and fonts from external CDNs.","severity":"low","suggestion":"Document the external requests clearly or provide a bundled offline template for environments that restrict network access."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":141,"line_start":136},{"file":"SKILL.md","line_end":147,"line_start":141},{"file":"SKILL.md","line_end":159,"line_start":147},{"file":"SKILL.md","line_end":189,"line_start":159},{"file":"SKILL.md","line_end":199,"line_start":189},{"file":"SKILL.md","line_end":215,"line_start":199},{"file":"SKILL.md","line_end":223,"line_start":215},{"file":"SKILL.md","line_end":229,"line_start":223},{"file":"SKILL.md","line_end":275,"line_start":229},{"file":"SKILL.md","line_end":300,"line_start":275},{"file":"SKILL.md","line_end":313,"line_start":300},{"file":"SKILL.md","line_end":319,"line_start":313},{"file":"templates/generator_template.js","line_end":133,"line_start":133}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":280,"line_start":280},{"file":"templates/viewer.html","line_end":23,"line_start":23},{"file":"templates/viewer.html","line_end":24,"line_start":24},{"file":"templates/viewer.html","line_end":25,"line_start":25},{"file":"templates/viewer.html","line_end":26,"line_start":26}]},{"factor":"scripts","evidence":[{"file":"templates/generator_template.js","line_end":133,"line_start":133}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":280,"line_start":280}],"confidence":0.98,"description":"<script src=\"https://cdnjs.cloudflare.com/ajax/libs/p5.js/1.7.0/p5.min.js\"></script>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill instructs generated artifacts to load p5.js from a public CDN, which creates an external network dependency."},{"title":"Hardcoded URL","locations":[{"file":"templates/viewer.html","line_end":23,"line_start":23}],"confidence":0.98,"description":"<script src=\"https://cdnjs.cloudflare.com/ajax/libs/p5.js/1.7.0/p5.min.js\"></script>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The viewer template loads p5.js from cdnjs, so rendered artifacts make an external network request."},{"title":"Hardcoded URL","locations":[{"file":"templates/viewer.html","line_end":24,"line_start":24}],"confidence":0.98,"description":"<link rel=\"preconnect\" href=\"https://fonts.googleapis.com\">","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The viewer template preconnects to Google Fonts, creating an external network dependency."},{"title":"Hardcoded URL","locations":[{"file":"templates/viewer.html","line_end":25,"line_start":25}],"confidence":0.98,"description":"<link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The viewer template preconnects to gstatic for fonts, creating an external network dependency."},{"title":"Hardcoded URL","locations":[{"file":"templates/viewer.html","line_end":26,"line_start":26}],"confidence":0.98,"description":"<link href=\"https://fonts.googleapis.com/css2?family=Poppins:wght@400;500;600&family=Lora:wght@400;5","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The viewer template loads Google Fonts from a remote stylesheet, creating an external network dependency."}],"dangerous_patterns":[],"files_scanned":4,"total_lines":1429,"audit_model":"claude","audited_at":"2026-07-09T05:49:33.382+00:00","created_at":"2026-07-09T06:43:49.227833+00:00","static_findings":[{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Read** `templates/viewer.html` using the Read tool","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":141,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":147,"severity":"medium","line_start":141},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":159,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":189,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":199,"severity":"medium","line_start":189},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":215,"severity":"medium","line_start":199},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Single HTML Artifact** - Self-contained interactive generative art built from `templates/viewer","category":"external_commands","line_end":223,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:223:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**REMINDER: `templates/viewer.html` should have already been read (see STEP 0). Use that file as the","category":"external_commands","line_end":229,"severity":"medium","line_start":223},{"id":"external_commands:SKILL.md:229:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `templates/viewer.html` file is the foundation. It contains the exact structure and styling need","category":"external_commands","line_end":275,"severity":"medium","line_start":229},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":300,"severity":"medium","line_start":275},{"id":"external_commands:SKILL.md:300:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":313,"severity":"medium","line_start":300},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":319,"severity":"medium","line_start":313},{"id":"network:SKILL.md:280:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<script src=\"https://cdnjs.cloudflare.com/ajax/libs/p5.js/1.7.0/p5.min.js\"></script>","category":"network","line_end":280,"severity":"low","line_start":280},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: Creating algorithmic art using p5.js with seeded randomness and interactive parameter e","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:SKILL.md:48:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Avoid redundancy**: Each algorithmic aspect should be mentioned once. Avoid repeating concepts a","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"blocker:SKILL.md:86:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"**The algorithmic philosophy should be 4-6 paragraphs long.** Fill it with poetic computational phil","category":"blocker","line_end":86,"severity":"low","line_start":86},{"id":"blocker:SKILL.md:167:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"To express the philosophy through code, avoid thinking \"which pattern should I use?\" and instead thi","category":"blocker","line_end":167,"severity":"low","line_start":167},{"id":"blocker:SKILL.md:83:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- **PURE GENERATIVE ART**: This is about making LIVING ALGORITHMS, not static images with randomness","category":"blocker","line_end":84,"severity":"low","line_start":83},{"id":"scripts:templates/generator_template.js:133:python-exec-function","file":"templates/generator_template.js","pattern":"Python exec() function","snippet":"const result = /^#?([a-f\\d]{2})([a-f\\d]{2})([a-f\\d]{2})$/i.exec(hex);","category":"scripts","line_end":133,"severity":"high","line_start":133},{"id":"external_commands:templates/generator_template.js:133:process-exec","file":"templates/generator_template.js","pattern":"Process exec","snippet":"const result = /^#?([a-f\\d]{2})([a-f\\d]{2})([a-f\\d]{2})$/i.exec(hex);","category":"external_commands","line_end":133,"severity":"high","line_start":133},{"id":"blocker:templates/generator_template.js:62:system-reconnaissance","file":"templates/generator_template.js","pattern":"System reconnaissance","snippet":"// - Grid structures","category":"blocker","line_end":62,"severity":"low","line_start":62},{"id":"network:templates/viewer.html:23:hardcoded-url","file":"templates/viewer.html","pattern":"Hardcoded URL","snippet":"<script src=\"https://cdnjs.cloudflare.com/ajax/libs/p5.js/1.7.0/p5.min.js\"></script>","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:templates/viewer.html:24:hardcoded-url","file":"templates/viewer.html","pattern":"Hardcoded URL","snippet":"<link rel=\"preconnect\" href=\"https://fonts.googleapis.com\">","category":"network","line_end":24,"severity":"low","line_start":24},{"id":"network:templates/viewer.html:25:hardcoded-url","file":"templates/viewer.html","pattern":"Hardcoded URL","snippet":"<link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin>","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:templates/viewer.html:26:hardcoded-url","file":"templates/viewer.html","pattern":"Hardcoded URL","snippet":"<link href=\"https://fonts.googleapis.com/css2?family=Poppins:wght@400;500;600&family=Lora:wght@400;5","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"blocker:templates/viewer.html:117:system-reconnaissance","file":"templates/viewer.html","pattern":"System reconnaissance","snippet":"border: 1px solid var(--anthropic-light-gray);","category":"blocker","line_end":117,"severity":"low","line_start":117},{"id":"blocker:templates/viewer.html:545:system-reconnaissance","file":"templates/viewer.html","pattern":"System reconnaissance","snippet":"// Reset to current seed if invalid","category":"blocker","line_end":546,"severity":"low","line_start":545}],"finding_verdicts":[{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:223:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:229:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:300:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","reason":"The flagged content is Markdown backticks, inline code formatting, or example code in documentation. It does not instruct shell command execution.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:280:hardcoded-url","reason":"The skill instructs generated artifacts to load p5.js from a public CDN, which creates an external network dependency.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"The flagged wording describes generative art concepts or template styling. It does not request host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:48:system-reconnaissance","reason":"The flagged wording describes generative art concepts or template styling. It does not request host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:86:system-reconnaissance","reason":"The flagged wording describes generative art concepts or template styling. It does not request host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:167:system-reconnaissance","reason":"The flagged wording describes generative art concepts or template styling. It does not request host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:83:network-reconnaissance","reason":"The flagged wording describes generative art concepts or template styling. It does not request host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"scripts:templates/generator_template.js:133:python-exec-function","reason":"The flagged text is JavaScript RegExp.prototype.exec used to parse a hex color string, not Python exec or process execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/generator_template.js:133:process-exec","reason":"The flagged text is JavaScript RegExp.prototype.exec used to parse a hex color string, not Python exec or process execution.","verdict":"false_positive","confidence":0.99},{"id":"blocker:templates/generator_template.js:62:system-reconnaissance","reason":"The flagged wording describes generative art concepts or template styling. It does not request host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"network:templates/viewer.html:23:hardcoded-url","reason":"The viewer template loads p5.js from cdnjs, so rendered artifacts make an external network request.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:templates/viewer.html:24:hardcoded-url","reason":"The viewer template preconnects to Google Fonts, creating an external network dependency.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:templates/viewer.html:25:hardcoded-url","reason":"The viewer template preconnects to gstatic for fonts, creating an external network dependency.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:templates/viewer.html:26:hardcoded-url","reason":"The viewer template loads Google Fonts from a remote stylesheet, creating an external network dependency.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"blocker:templates/viewer.html:117:system-reconnaissance","reason":"The flagged wording describes generative art concepts or template styling. It does not request host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:templates/viewer.html:545:system-reconnaissance","reason":"The flagged wording describes generative art concepts or template styling. It does not request host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":5,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}