{"data":{"skill":{"slug":"algorithmic-art","name":"algorithmic-art","icon":"📦","repo":"https://github.com/anthropics/skills/tree/main/skills/algorithmic-art","status":"approved","author":"anthropics","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"390f5ad5-3d6a-4e03-bba2-096102fd021b","skill_id":"b1424dec-8126-42ff-a963-1a2a64a7265c","version":8,"content_hash":"38781d25fba2ad683024d0d95655ba82","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Static findings were reviewed against the cited files. Most alerts are false positives from markdown code fences, normal JavaScript regex use, and generative art wording; the confirmed issues are low-severity external network dependencies for p5.js and Google Fonts.","remediation":[{"issue":"The HTML template loads p5.js and Google Fonts from external CDNs.","severity":"low","suggestion":"Document the external dependencies and offer a local or bundled option for offline and privacy-sensitive use."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":141,"line_start":136},{"file":"SKILL.md","line_end":147,"line_start":141},{"file":"SKILL.md","line_end":159,"line_start":147},{"file":"SKILL.md","line_end":189,"line_start":159},{"file":"SKILL.md","line_end":199,"line_start":189},{"file":"SKILL.md","line_end":215,"line_start":199},{"file":"SKILL.md","line_end":223,"line_start":215},{"file":"SKILL.md","line_end":229,"line_start":223},{"file":"SKILL.md","line_end":275,"line_start":229},{"file":"SKILL.md","line_end":300,"line_start":275},{"file":"SKILL.md","line_end":313,"line_start":300},{"file":"SKILL.md","line_end":319,"line_start":313},{"file":"templates/generator_template.js","line_end":133,"line_start":133}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":280,"line_start":280},{"file":"templates/viewer.html","line_end":23,"line_start":23},{"file":"templates/viewer.html","line_end":24,"line_start":24},{"file":"templates/viewer.html","line_end":25,"line_start":25},{"file":"templates/viewer.html","line_end":26,"line_start":26}]},{"factor":"scripts","evidence":[{"file":"templates/generator_template.js","line_end":133,"line_start":133}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":280,"line_start":280}],"confidence":0.95,"description":"<script src=\"https://cdnjs.cloudflare.com/ajax/libs/p5.js/1.7.0/p5.min.js\"></script>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Confirmed. The skill documentation instructs generated HTML to load p5.js from cdnjs. This is external network loading, but it is transparent and limited to a public library CDN."},{"title":"Hardcoded URL","locations":[{"file":"templates/viewer.html","line_end":23,"line_start":23}],"confidence":0.95,"description":"<script src=\"https://cdnjs.cloudflare.com/ajax/libs/p5.js/1.7.0/p5.min.js\"></script>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Confirmed. The viewer template loads p5.js from cdnjs at runtime. This is an external dependency and should be disclosed to users."},{"title":"Hardcoded URL","locations":[{"file":"templates/viewer.html","line_end":24,"line_start":24}],"confidence":0.95,"description":"<link rel=\"preconnect\" href=\"https://fonts.googleapis.com\">","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Confirmed. The template preconnects to Google Fonts, which creates an external network request."},{"title":"Hardcoded URL","locations":[{"file":"templates/viewer.html","line_end":25,"line_start":25}],"confidence":0.95,"description":"<link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Confirmed. The template preconnects to the Google Fonts static asset host, which creates an external network dependency."},{"title":"Hardcoded URL","locations":[{"file":"templates/viewer.html","line_end":26,"line_start":26}],"confidence":0.95,"description":"<link href=\"https://fonts.googleapis.com/css2?family=Poppins:wght@400;500;600&family=Lora:wght@400;5","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Confirmed. The template loads Poppins and Lora from Google Fonts, which requires external network access."}],"dangerous_patterns":[],"files_scanned":4,"total_lines":1429,"audit_model":"codex","audited_at":"2026-07-06T02:25:06.059+00:00","created_at":"2026-07-07T02:35:06.422721+00:00","static_findings":[{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Read** `templates/viewer.html` using the Read tool","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":141,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":147,"severity":"medium","line_start":141},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":159,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":189,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":199,"severity":"medium","line_start":189},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":215,"severity":"medium","line_start":199},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Single HTML Artifact** - Self-contained interactive generative art built from `templates/viewer","category":"external_commands","line_end":223,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:223:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**REMINDER: `templates/viewer.html` should have already been read (see STEP 0). Use that file as the","category":"external_commands","line_end":229,"severity":"medium","line_start":223},{"id":"external_commands:SKILL.md:229:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `templates/viewer.html` file is the foundation. It contains the exact structure and styling need","category":"external_commands","line_end":275,"severity":"medium","line_start":229},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":300,"severity":"medium","line_start":275},{"id":"external_commands:SKILL.md:300:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":313,"severity":"medium","line_start":300},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":319,"severity":"medium","line_start":313},{"id":"network:SKILL.md:280:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<script src=\"https://cdnjs.cloudflare.com/ajax/libs/p5.js/1.7.0/p5.min.js\"></script>","category":"network","line_end":280,"severity":"low","line_start":280},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: Creating algorithmic art using p5.js with seeded randomness and interactive parameter e","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:SKILL.md:48:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Avoid redundancy**: Each algorithmic aspect should be mentioned once. Avoid repeating concepts a","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"blocker:SKILL.md:86:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"**The algorithmic philosophy should be 4-6 paragraphs long.** Fill it with poetic computational phil","category":"blocker","line_end":86,"severity":"low","line_start":86},{"id":"blocker:SKILL.md:167:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"To express the philosophy through code, avoid thinking \"which pattern should I use?\" and instead thi","category":"blocker","line_end":167,"severity":"low","line_start":167},{"id":"blocker:SKILL.md:83:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- **PURE GENERATIVE ART**: This is about making LIVING ALGORITHMS, not static images with randomness","category":"blocker","line_end":84,"severity":"low","line_start":83},{"id":"scripts:templates/generator_template.js:133:python-exec-function","file":"templates/generator_template.js","pattern":"Python exec() function","snippet":"const result = /^#?([a-f\\d]{2})([a-f\\d]{2})([a-f\\d]{2})$/i.exec(hex);","category":"scripts","line_end":133,"severity":"high","line_start":133},{"id":"external_commands:templates/generator_template.js:133:process-exec","file":"templates/generator_template.js","pattern":"Process exec","snippet":"const result = /^#?([a-f\\d]{2})([a-f\\d]{2})([a-f\\d]{2})$/i.exec(hex);","category":"external_commands","line_end":133,"severity":"high","line_start":133},{"id":"blocker:templates/generator_template.js:62:system-reconnaissance","file":"templates/generator_template.js","pattern":"System reconnaissance","snippet":"// - Grid structures","category":"blocker","line_end":62,"severity":"low","line_start":62},{"id":"network:templates/viewer.html:23:hardcoded-url","file":"templates/viewer.html","pattern":"Hardcoded URL","snippet":"<script src=\"https://cdnjs.cloudflare.com/ajax/libs/p5.js/1.7.0/p5.min.js\"></script>","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:templates/viewer.html:24:hardcoded-url","file":"templates/viewer.html","pattern":"Hardcoded URL","snippet":"<link rel=\"preconnect\" href=\"https://fonts.googleapis.com\">","category":"network","line_end":24,"severity":"low","line_start":24},{"id":"network:templates/viewer.html:25:hardcoded-url","file":"templates/viewer.html","pattern":"Hardcoded URL","snippet":"<link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin>","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:templates/viewer.html:26:hardcoded-url","file":"templates/viewer.html","pattern":"Hardcoded URL","snippet":"<link href=\"https://fonts.googleapis.com/css2?family=Poppins:wght@400;500;600&family=Lora:wght@400;5","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"blocker:templates/viewer.html:117:system-reconnaissance","file":"templates/viewer.html","pattern":"System reconnaissance","snippet":"border: 1px solid var(--anthropic-light-gray);","category":"blocker","line_end":117,"severity":"low","line_start":117},{"id":"blocker:templates/viewer.html:545:system-reconnaissance","file":"templates/viewer.html","pattern":"System reconnaissance","snippet":"// Reset to current seed if invalid","category":"blocker","line_end":546,"severity":"low","line_start":545}],"finding_verdicts":[{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:223:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:229:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:300:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","reason":"False positive. The cited SKILL.md lines are markdown instructions or fenced examples. They do not direct the assistant to run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:280:hardcoded-url","reason":"Confirmed. The skill documentation instructs generated HTML to load p5.js from cdnjs. This is external network loading, but it is transparent and limited to a public library CDN.","verdict":"confirmed","severity":"low","confidence":0.95},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"False positive. The cited text describes generative art concepts or template styling. It does not request reconnaissance, privilege changes, or security bypasses.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:48:system-reconnaissance","reason":"False positive. The cited text describes generative art concepts or template styling. It does not request reconnaissance, privilege changes, or security bypasses.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:86:system-reconnaissance","reason":"False positive. The cited text describes generative art concepts or template styling. It does not request reconnaissance, privilege changes, or security bypasses.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:167:system-reconnaissance","reason":"False positive. The cited text describes generative art concepts or template styling. It does not request reconnaissance, privilege changes, or security bypasses.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:83:network-reconnaissance","reason":"False positive. The cited text describes generative art concepts or template styling. It does not request reconnaissance, privilege changes, or security bypasses.","verdict":"false_positive","confidence":0.96},{"id":"scripts:templates/generator_template.js:133:python-exec-function","reason":"False positive. The code calls JavaScript RegExp.prototype.exec on a color validation regex. It is not Python exec and does not execute code.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:templates/generator_template.js:133:process-exec","reason":"False positive. The code calls JavaScript RegExp.prototype.exec on a hex color string. It does not spawn a process or invoke a shell.","verdict":"false_positive","confidence":0.96},{"id":"blocker:templates/generator_template.js:62:system-reconnaissance","reason":"False positive. The cited text describes generative art concepts or template styling. It does not request reconnaissance, privilege changes, or security bypasses.","verdict":"false_positive","confidence":0.96},{"id":"network:templates/viewer.html:23:hardcoded-url","reason":"Confirmed. The viewer template loads p5.js from cdnjs at runtime. This is an external dependency and should be disclosed to users.","verdict":"confirmed","severity":"low","confidence":0.95},{"id":"network:templates/viewer.html:24:hardcoded-url","reason":"Confirmed. The template preconnects to Google Fonts, which creates an external network request.","verdict":"confirmed","severity":"low","confidence":0.95},{"id":"network:templates/viewer.html:25:hardcoded-url","reason":"Confirmed. The template preconnects to the Google Fonts static asset host, which creates an external network dependency.","verdict":"confirmed","severity":"low","confidence":0.95},{"id":"network:templates/viewer.html:26:hardcoded-url","reason":"Confirmed. The template loads Poppins and Lora from Google Fonts, which requires external network access.","verdict":"confirmed","severity":"low","confidence":0.95},{"id":"blocker:templates/viewer.html:117:system-reconnaissance","reason":"False positive. The cited text describes generative art concepts or template styling. It does not request reconnaissance, privilege changes, or security bypasses.","verdict":"false_positive","confidence":0.96},{"id":"blocker:templates/viewer.html:545:system-reconnaissance","reason":"False positive. The cited text describes generative art concepts or template styling. It does not request reconnaissance, privilege changes, or security bypasses.","verdict":"false_positive","confidence":0.96}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":5,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}