{"data":{"skill":{"slug":"alinaqi-pwa-development","name":"pwa-development","icon":"📦","repo":"https://github.com/alinaqi/maggy/tree/55aabe2493627e1de9cd09459d555181d66f3111/skills/pwa-development","status":"approved","author":"alinaqi","authorVersion":null,"skillstoreRevision":1,"license":null},"licenseCorrection":null,"audit":{"id":"983fa2a7-fa9a-4a5e-9b98-fb6d4d2b3c4a","skill_id":"18687323-89d3-4d96-a777-3177dc026ba2","version":1,"content_hash":"v3:c993c6abcbffafea2683d7748b53b3dfaf438415:16e56227d54b1ad94c4d4ee1582eef547bcd32bd10d12c9fd77496bbd9cb2f7d:5bc7066fed15eb90f2f732001bafbbff34d5bdcb42b86b1ada78b54cba9ea6e5:736b696c6c732f616c696e6171692f7077612d646576656c6f706d656e74:1d108a9bbb70c53b1aa1505d65c71ab9","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 92 static alerts are false positives for the reported threats, including Markdown backticks, fixed imports, routine requests, and misidentified identifiers. Two contextual risks remain: shared caches can retain private responses across sessions, and activation deletes unrelated caches on the same origin. No evidence found of prompt injection, credential theft, or malicious execution instructions.","remediation":[{"issue":"Generic API and navigation caching can retain authenticated responses across user sessions.","severity":"medium","suggestion":"Allowlist public cacheable responses, bypass private endpoints, and partition approved user caches by session with deletion on logout or account change."},{"issue":"Activation deletes every origin cache except the current application cache.","severity":"medium","suggestion":"Use an application-specific cache prefix and delete only obsolete versions owned by that application."}],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"SKILL.md","line_end":730,"line_start":730},{"file":"SKILL.md","line_end":731,"line_start":731},{"file":"SKILL.md","line_end":732,"line_start":732}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":43,"line_start":19},{"file":"SKILL.md","line_end":51,"line_start":43},{"file":"SKILL.md","line_end":79,"line_start":51},{"file":"SKILL.md","line_end":83,"line_start":79},{"file":"SKILL.md","line_end":163,"line_start":83},{"file":"SKILL.md","line_end":167,"line_start":163},{"file":"SKILL.md","line_end":167,"line_start":167},{"file":"SKILL.md","line_end":169,"line_start":168},{"file":"SKILL.md","line_end":169,"line_start":169},{"file":"SKILL.md","line_end":173,"line_start":172},{"file":"SKILL.md","line_end":183,"line_start":173},{"file":"SKILL.md","line_end":224,"line_start":183},{"file":"SKILL.md","line_end":228,"line_start":224},{"file":"SKILL.md","line_end":242,"line_start":228},{"file":"SKILL.md","line_end":260,"line_start":242},{"file":"SKILL.md","line_end":281,"line_start":260},{"file":"SKILL.md","line_end":285,"line_start":281},{"file":"SKILL.md","line_end":302,"line_start":285},{"file":"SKILL.md","line_end":306,"line_start":302},{"file":"SKILL.md","line_end":323,"line_start":306},{"file":"SKILL.md","line_end":339,"line_start":323},{"file":"SKILL.md","line_end":342,"line_start":339},{"file":"SKILL.md","line_end":346,"line_start":342},{"file":"SKILL.md","line_end":394,"line_start":346},{"file":"SKILL.md","line_end":398,"line_start":394},{"file":"SKILL.md","line_end":449,"line_start":398},{"file":"SKILL.md","line_end":457,"line_start":449},{"file":"SKILL.md","line_end":502,"line_start":457},{"file":"SKILL.md","line_end":506,"line_start":502},{"file":"SKILL.md","line_end":520,"line_start":506},{"file":"SKILL.md","line_end":524,"line_start":520},{"file":"SKILL.md","line_end":541,"line_start":524},{"file":"SKILL.md","line_end":543,"line_start":541},{"file":"SKILL.md","line_end":558,"line_start":543},{"file":"SKILL.md","line_end":566,"line_start":558},{"file":"SKILL.md","line_end":581,"line_start":566},{"file":"SKILL.md","line_end":590,"line_start":581},{"file":"SKILL.md","line_end":594,"line_start":590},{"file":"SKILL.md","line_end":606,"line_start":594},{"file":"SKILL.md","line_end":610,"line_start":606},{"file":"SKILL.md","line_end":656,"line_start":610},{"file":"SKILL.md","line_end":660,"line_start":656},{"file":"SKILL.md","line_end":673,"line_start":660},{"file":"SKILL.md","line_end":677,"line_start":673},{"file":"SKILL.md","line_end":685,"line_start":677},{"file":"SKILL.md","line_end":698,"line_start":685},{"file":"SKILL.md","line_end":702,"line_start":698},{"file":"SKILL.md","line_end":723,"line_start":702},{"file":"SKILL.md","line_end":727,"line_start":723},{"file":"SKILL.md","line_end":742,"line_start":727}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":220,"line_start":220},{"file":"SKILL.md","line_end":270,"line_start":270},{"file":"SKILL.md","line_end":290,"line_start":290},{"file":"SKILL.md","line_end":313,"line_start":313},{"file":"SKILL.md","line_end":547,"line_start":547},{"file":"SKILL.md","line_end":629,"line_start":629},{"file":"SKILL.md","line_end":752,"line_start":752}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":901,"line_start":901},{"file":"SKILL.md","line_end":901,"line_start":901}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Shared Response Caches Lack User Isolation","locations":[{"file":"SKILL.md","line_end":299,"line_start":285},{"file":"SKILL.md","line_end":447,"line_start":424}],"confidence":0.95,"description":"API and navigation examples store responses in shared caches without user partitioning or logout cleanup. Authenticated content can remain accessible after account changes or offline.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"Both examples cache broad API or page responses without session isolation. Disclosure depends on deploying them with authenticated content, but no safeguards are shown."},{"title":"Activation Deletes Unrelated Origin Caches","locations":[{"file":"SKILL.md","line_end":213,"line_start":203}],"confidence":0.99,"description":"Activation deletes every cache whose name differs from CACHE_NAME. Cache Storage is shared by origin, so this can destroy other applications' offline data.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The filter excludes only the current cache name before deleting all others. No application prefix or ownership restriction protects unrelated caches."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":961,"audit_model":"codex","audited_at":"2026-11-07T14:39:23.433+00:00","created_at":"2026-11-09T15:32:34.500715+00:00","static_findings":[{"id":"scripts:SKILL.md:730:dynamic-import-expression","file":"SKILL.md","pattern":"Dynamic import() expression","snippet":"'/': () => import('./pages/Home.js'),","category":"scripts","line_end":730,"severity":"medium","line_start":730},{"id":"scripts:SKILL.md:731:dynamic-import-expression","file":"SKILL.md","pattern":"Dynamic import() expression","snippet":"'/about': () => import('./pages/About.js'),","category":"scripts","line_end":731,"severity":"medium","line_start":731},{"id":"scripts:SKILL.md:732:dynamic-import-expression","file":"SKILL.md","pattern":"Dynamic import() expression","snippet":"'/settings': () => import('./pages/Settings.js')","category":"scripts","line_end":732,"severity":"medium","line_start":732},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":43,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":51,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":79,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":83,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":163,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":167,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [ ] `name` and `short_name` defined","category":"external_commands","line_end":167,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [ ] `start_url` set (use query param for analytics)","category":"external_commands","line_end":169,"severity":"medium","line_start":168},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [ ] `display` set to `standalone` or `fullscreen`","category":"external_commands","line_end":169,"severity":"medium","line_start":169},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [ ] `theme_color` matches app design","category":"external_commands","line_end":173,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [ ] `background_color` for splash screen","category":"external_commands","line_end":183,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":224,"severity":"medium","line_start":183},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":228,"severity":"medium","line_start":224},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":242,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":260,"severity":"medium","line_start":242},{"id":"external_commands:SKILL.md:260:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":281,"severity":"medium","line_start":260},{"id":"external_commands:SKILL.md:281:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":285,"severity":"medium","line_start":281},{"id":"external_commands:SKILL.md:285:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":302,"severity":"medium","line_start":285},{"id":"external_commands:SKILL.md:302:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":306,"severity":"medium","line_start":302},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":323,"severity":"medium","line_start":306},{"id":"external_commands:SKILL.md:323:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":339,"severity":"medium","line_start":323},{"id":"external_commands:SKILL.md:339:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":342,"severity":"medium","line_start":339},{"id":"external_commands:SKILL.md:342:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":346,"severity":"medium","line_start":342},{"id":"external_commands:SKILL.md:346:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":394,"severity":"medium","line_start":346},{"id":"external_commands:SKILL.md:394:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":398,"severity":"medium","line_start":394},{"id":"external_commands:SKILL.md:398:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":449,"severity":"medium","line_start":398},{"id":"external_commands:SKILL.md:449:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":457,"severity":"medium","line_start":449},{"id":"external_commands:SKILL.md:457:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":502,"severity":"medium","line_start":457},{"id":"external_commands:SKILL.md:502:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":506,"severity":"medium","line_start":502},{"id":"external_commands:SKILL.md:506:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":520,"severity":"medium","line_start":506},{"id":"external_commands:SKILL.md:520:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":524,"severity":"medium","line_start":520},{"id":"external_commands:SKILL.md:524:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":541,"severity":"medium","line_start":524},{"id":"external_commands:SKILL.md:541:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":543,"severity":"medium","line_start":541},{"id":"external_commands:SKILL.md:543:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":558,"severity":"medium","line_start":543},{"id":"external_commands:SKILL.md:558:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":566,"severity":"medium","line_start":558},{"id":"external_commands:SKILL.md:566:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":581,"severity":"medium","line_start":566},{"id":"external_commands:SKILL.md:581:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`User ${outcome === 'accepted' ? 'accepted' : 'dismissed'} install`);","category":"external_commands","line_end":590,"severity":"medium","line_start":581},{"id":"external_commands:SKILL.md:590:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":594,"severity":"medium","line_start":590},{"id":"external_commands:SKILL.md:594:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":606,"severity":"medium","line_start":594},{"id":"external_commands:SKILL.md:606:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":610,"severity":"medium","line_start":606},{"id":"external_commands:SKILL.md:610:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":656,"severity":"medium","line_start":610},{"id":"external_commands:SKILL.md:656:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":660,"severity":"medium","line_start":656},{"id":"external_commands:SKILL.md:660:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":673,"severity":"medium","line_start":660},{"id":"external_commands:SKILL.md:673:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"return Response.redirect(`/?shared=true&title=${encodeURIComponent(title)}`);","category":"external_commands","line_end":677,"severity":"medium","line_start":673},{"id":"external_commands:SKILL.md:677:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":685,"severity":"medium","line_start":677},{"id":"external_commands:SKILL.md:685:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":698,"severity":"medium","line_start":685},{"id":"external_commands:SKILL.md:698:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":702,"severity":"medium","line_start":698},{"id":"external_commands:SKILL.md:702:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":723,"severity":"medium","line_start":702},{"id":"external_commands:SKILL.md:723:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":727,"severity":"medium","line_start":723},{"id":"external_commands:SKILL.md:727:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":742,"severity":"medium","line_start":727},{"id":"external_commands:SKILL.md:742:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":750,"severity":"medium","line_start":742},{"id":"external_commands:SKILL.md:750:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":759,"severity":"medium","line_start":750},{"id":"external_commands:SKILL.md:759:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":794,"severity":"medium","line_start":759},{"id":"external_commands:SKILL.md:794:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":807,"severity":"medium","line_start":794},{"id":"external_commands:SKILL.md:807:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":813,"severity":"medium","line_start":807},{"id":"external_commands:SKILL.md:813:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":844,"severity":"medium","line_start":813},{"id":"external_commands:SKILL.md:844:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":852,"severity":"medium","line_start":844},{"id":"external_commands:SKILL.md:852:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Missing maskable icon | Add icon with `\"purpose\": \"maskable\"` |","category":"external_commands","line_end":853,"severity":"medium","line_start":852},{"id":"external_commands:SKILL.md:853:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| No offline fallback | Create `offline.html` and cache it |","category":"external_commands","line_end":854,"severity":"medium","line_start":853},{"id":"external_commands:SKILL.md:854:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Cache never expires | Use `ExpirationPlugin` with Workbox |","category":"external_commands","line_end":856,"severity":"medium","line_start":854},{"id":"external_commands:SKILL.md:856:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| No update mechanism | Implement `skipWaiting()` + reload prompt |","category":"external_commands","line_end":859,"severity":"medium","line_start":856},{"id":"external_commands:SKILL.md:859:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Large cache size | Set `maxEntries` and `maxAgeSeconds` |","category":"external_commands","line_end":859,"severity":"medium","line_start":859},{"id":"external_commands:SKILL.md:860:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Stale API responses | Use `NetworkFirst` for dynamic data |","category":"external_commands","line_end":861,"severity":"medium","line_start":860},{"id":"external_commands:SKILL.md:861:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Missing start_url tracking | Add query param: `/?source=pwa` |","category":"external_commands","line_end":893,"severity":"medium","line_start":861},{"id":"external_commands:SKILL.md:893:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":895,"severity":"medium","line_start":893},{"id":"external_commands:SKILL.md:895:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":897,"severity":"medium","line_start":895},{"id":"external_commands:SKILL.md:897:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":907,"severity":"medium","line_start":897},{"id":"external_commands:SKILL.md:907:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":911,"severity":"medium","line_start":907},{"id":"external_commands:SKILL.md:911:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":914,"severity":"medium","line_start":911},{"id":"external_commands:SKILL.md:914:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":918,"severity":"medium","line_start":914},{"id":"external_commands:SKILL.md:918:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":920,"severity":"medium","line_start":918},{"id":"external_commands:SKILL.md:920:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":930,"severity":"medium","line_start":920},{"id":"external_commands:SKILL.md:930:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":936,"severity":"medium","line_start":930},{"id":"external_commands:SKILL.md:936:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":940,"severity":"medium","line_start":936},{"id":"external_commands:SKILL.md:940:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":951,"severity":"medium","line_start":940},{"id":"external_commands:SKILL.md:951:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":955,"severity":"medium","line_start":951},{"id":"external_commands:SKILL.md:955:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":960,"severity":"medium","line_start":955},{"id":"network:SKILL.md:220:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":".then((cached) => cached || fetch(event.request))","category":"network","line_end":220,"severity":"low","line_start":220},{"id":"network:SKILL.md:270:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"return fetch(event.request).then((response) => {","category":"network","line_end":270,"severity":"low","line_start":270},{"id":"network:SKILL.md:290:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"fetch(event.request)","category":"network","line_end":290,"severity":"low","line_start":290},{"id":"network:SKILL.md:313:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"const fetchPromise = fetch(event.request).then((response) => {","category":"network","line_end":313,"severity":"low","line_start":313},{"id":"network:SKILL.md:547:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"const response = await fetch('/api/submit', {","category":"network","line_end":547,"severity":"low","line_start":547},{"id":"network:SKILL.md:629:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"await fetch('/api/push/subscribe', {","category":"network","line_end":629,"severity":"low","line_start":629},{"id":"network:SKILL.md:752:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"npx lighthouse https://your-app.com --view","category":"network","line_end":752,"severity":"low","line_start":752},{"id":"env_access:SKILL.md:901:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"disable: process.env.NODE_ENV === 'development'","category":"env_access","line_end":901,"severity":"low","line_start":901},{"id":"env_access:SKILL.md:901:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"disable: process.env.NODE_ENV === 'development'","category":"env_access","line_end":901,"severity":"low","line_start":901},{"id":"sensitive:SKILL.md:901:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"disable: process.env.NODE_ENV === 'development'","category":"sensitive","line_end":901,"severity":"high","line_start":901},{"id":"sensitive:SKILL.md:206:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"caches.keys()","category":"sensitive","line_end":206,"severity":"high","line_start":206},{"id":"blocker:SKILL.md:171:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- [ ] Maskable icon included for Android adaptive icons","category":"blocker","line_end":171,"severity":"low","line_start":171}],"finding_verdicts":[{"id":"scripts:SKILL.md:730:dynamic-import-expression","reason":"The route loader imports a fixed local Home module. User input cannot supply an arbitrary import target.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:731:dynamic-import-expression","reason":"The About route imports a fixed local module for code splitting. There is no constructed or remote import target.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:732:dynamic-import-expression","reason":"The Settings route imports a fixed local module. Route lookup selects existing loaders rather than executing a user-supplied module path.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"These backticks open a Markdown diagram of PWA requirements, not a shell or Ruby expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"These backticks close the requirements diagram and precede another Markdown example. No command substitution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"This is a Markdown JSON fence containing manifest metadata. JSON does not execute these formatting delimiters.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The matched backticks delimit manifest examples in Markdown. They are not evaluated by a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"This fence encloses an enhanced manifest example. The backticks are document formatting rather than executable syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"The closing manifest fence and following checklist use Markdown delimiters. Neither invokes external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"Inline backticks mark the name and short_name manifest properties. They are documentation, not command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","reason":"Inline formatting marks the start_url property in a checklist. There is no shell evaluation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","reason":"Inline backticks identify manifest display values. This checklist contains no executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"The theme_color and background_color property names are formatted as inline Markdown code. They do not run commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"The property reference and following example fence are Markdown formatting. No shell or Ruby interpreter is invoked.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"This fence encloses a browser service worker example, not a shell expression. Cache behavior is assessed separately.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","reason":"The backticks separate service worker and registration examples in Markdown. They do not execute external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"This JavaScript fence documents browser service worker registration. The delimiter is not shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","reason":"The matched delimiters close registration documentation and open a caching example. They are Markdown syntax only.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:260:ruby-shell-backtick-execution","reason":"This fence introduces a browser cache-first example. No shell or Ruby backtick execution occurs.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:281:ruby-shell-backtick-execution","reason":"The backticks delimit adjacent JavaScript caching examples. They are document formatting rather than executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:285:ruby-shell-backtick-execution","reason":"This is a Markdown fence for a network-first browser example. Its cache privacy risk is assessed separately.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:302:ruby-shell-backtick-execution","reason":"These delimiters separate caching strategy examples. They are not interpreted as shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","reason":"This JavaScript fence illustrates stale-while-revalidate caching in a browser. The backticks themselves execute nothing.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:323:ruby-shell-backtick-execution","reason":"The matched backticks close a JavaScript example and precede a Bash fence. They are Markdown boundaries, not command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:339:ruby-shell-backtick-execution","reason":"The Bash fence documents npm dependency installation for PWA tooling. There is no backtick substitution or injected shell argument.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:342:ruby-shell-backtick-execution","reason":"The backticks close installation instructions and open a JavaScript configuration example. They are Markdown formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:346:ruby-shell-backtick-execution","reason":"This Markdown fence contains a Vite PWA configuration example. It is not shell or Ruby execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:394:ruby-shell-backtick-execution","reason":"The delimiters separate Vite configuration from a manual Workbox example. No backtick command execution occurs.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:398:ruby-shell-backtick-execution","reason":"This fence encloses browser Workbox routing examples. Markdown delimiters do not invoke an external interpreter.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:449:ruby-shell-backtick-execution","reason":"These backticks delimit Workbox and offline HTML examples. They are document syntax, not shell expressions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:457:ruby-shell-backtick-execution","reason":"This HTML fence documents an offline fallback page. It does not execute shell or Ruby commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:502:ruby-shell-backtick-execution","reason":"The backticks separate HTML and JavaScript examples in Markdown. No external command is invoked.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:506:ruby-shell-backtick-execution","reason":"This JavaScript fence documents online and offline browser events. It is not shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:520:ruby-shell-backtick-execution","reason":"The matched delimiters separate offline detection and background sync examples. They are Markdown syntax only.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:524:ruby-shell-backtick-execution","reason":"This fence encloses Workbox background sync configuration. There is no Ruby or shell backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:541:ruby-shell-backtick-execution","reason":"The backticks delimit two background sync examples. They are not executable command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:543:ruby-shell-backtick-execution","reason":"This JavaScript fence contains an application form submission example. Its delimiters do not execute external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:558:ruby-shell-backtick-execution","reason":"The backticks separate form submission and install prompt documentation. They are Markdown formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:566:ruby-shell-backtick-execution","reason":"The fence opens install prompt documentation; the later backtick begins a JavaScript template literal. Neither is shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:581:ruby-shell-backtick-execution","reason":"The console message uses a JavaScript template literal to report installation consent. It is never passed to a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:590:ruby-shell-backtick-execution","reason":"These delimiters separate browser install prompt and display-mode examples. They are Markdown syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:594:ruby-shell-backtick-execution","reason":"This JavaScript fence documents standalone display-mode detection. No shell or Ruby command is executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:606:ruby-shell-backtick-execution","reason":"The backticks separate standalone-mode and push notification examples. They are formatting delimiters only.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:610:ruby-shell-backtick-execution","reason":"This fence contains browser push notification examples. The Markdown backticks do not invoke an operating system command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:656:ruby-shell-backtick-execution","reason":"These delimiters separate push and share-target examples. They are Markdown formatting rather than command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:660:ruby-shell-backtick-execution","reason":"The fence opens a share-target example, and the later backtick starts a JavaScript string. Neither executes a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:673:ruby-shell-backtick-execution","reason":"The redirect uses a JavaScript template literal with an encoded title and a fixed relative route. It is not shell evaluation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:677:ruby-shell-backtick-execution","reason":"These backticks delimit share-target and performance examples. They are document formatting only.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:685:ruby-shell-backtick-execution","reason":"This HTML fence documents resource loading techniques. There is no shell or Ruby command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:698:ruby-shell-backtick-execution","reason":"The delimiters separate HTML performance examples. Markdown backticks are not executable in this context.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:702:ruby-shell-backtick-execution","reason":"This HTML fence contains responsive image examples. It does not invoke external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:723:ruby-shell-backtick-execution","reason":"These backticks separate image markup and code-splitting documentation. They are Markdown boundaries.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:727:ruby-shell-backtick-execution","reason":"This JavaScript fence documents route-based imports. No shell command is constructed or executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:742:ruby-shell-backtick-execution","reason":"The delimiters separate code splitting and Lighthouse examples. They are not shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:750:ruby-shell-backtick-execution","reason":"The Bash fence documents a Lighthouse audit command with a placeholder site. It contains no backtick substitution or injected arguments.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:759:ruby-shell-backtick-execution","reason":"These backticks close audit instructions and precede an update example. They are Markdown formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:794:ruby-shell-backtick-execution","reason":"This JavaScript fence illustrates checking service worker updates. It is not external command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:807:ruby-shell-backtick-execution","reason":"The backticks separate an update example and a project tree. No command substitution occurs.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:813:ruby-shell-backtick-execution","reason":"This fence encloses an illustrative project directory tree. The listed paths are documentation, not executed shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:844:ruby-shell-backtick-execution","reason":"The closing project-tree fence and later inline code are Markdown formatting. They do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:852:ruby-shell-backtick-execution","reason":"Inline backticks format a manifest property and value in a troubleshooting table. No shell interpreter is involved.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:853:ruby-shell-backtick-execution","reason":"The offline page name is inline Markdown code in troubleshooting advice. It is not an executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:854:ruby-shell-backtick-execution","reason":"The Workbox plugin reference is formatted as inline code. It does not invoke shell or Ruby execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:856:ruby-shell-backtick-execution","reason":"Inline code identifies a service worker lifecycle API and cache configuration fields. These references are not shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:859:ruby-shell-backtick-execution","reason":"The maxEntries and maxAgeSeconds field names use inline Markdown formatting. There is no command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:860:ruby-shell-backtick-execution","reason":"The NetworkFirst strategy and following URL example are inline documentation. Neither executes an external command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:861:ruby-shell-backtick-execution","reason":"The relative tracking URL and later Bash fence are Markdown syntax. They are not evaluated as backtick expressions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:893:ruby-shell-backtick-execution","reason":"The Bash fence documents installing next-pwa for the stated framework integration. It contains no shell backtick substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:895:ruby-shell-backtick-execution","reason":"These delimiters separate package installation and Next.js configuration examples. They are Markdown formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:897:ruby-shell-backtick-execution","reason":"This JavaScript fence documents Next.js PWA configuration. The delimiter is not shell or Ruby execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:907:ruby-shell-backtick-execution","reason":"These backticks separate framework configuration and scaffolding examples. They are Markdown syntax only.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:911:ruby-shell-backtick-execution","reason":"The Bash example uses create-react-app with fixed project and template arguments. The Markdown fence is not command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:914:ruby-shell-backtick-execution","reason":"These delimiters separate framework scaffolding and Vite installation instructions. They do not execute shell backticks.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:918:ruby-shell-backtick-execution","reason":"The Bash fence documents installing vite-plugin-pwa as a development dependency. No backtick substitution or user-controlled command exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:920:ruby-shell-backtick-execution","reason":"The backticks close installation documentation and precede a strategy reference. They are Markdown formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:930:ruby-shell-backtick-execution","reason":"This fence encloses a plain-text caching strategy reference. It is not executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:936:ruby-shell-backtick-execution","reason":"The delimiters separate a plain-text reference and manifest JSON. They do not invoke external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:940:ruby-shell-backtick-execution","reason":"This JSON fence contains minimum manifest fields. Markdown formatting is not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:951:ruby-shell-backtick-execution","reason":"The backticks separate a manifest example and lifecycle diagram. There is no executable command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:955:ruby-shell-backtick-execution","reason":"This fence contains a service worker lifecycle diagram. It is documentation rather than shell or Ruby code.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:220:fetch-api-call","reason":"The fetch forwards the original browser request when no cached response exists. It adds no secret payload or external collection destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:270:fetch-api-call","reason":"The fetch retrieves the requested image, style, or script in a cache-first example. There is no credential extraction or unrelated destination.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:290:fetch-api-call","reason":"The fetch forwards the original API request without adding a collection endpoint. Shared-cache privacy is a separate contextual finding.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:313:fetch-api-call","reason":"The fetch revalidates the original article request as part of the documented caching strategy. It does not send data to an added collector.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:547:fetch-api-call","reason":"The example submits caller-provided form data to a fixed same-origin application endpoint. This is the stated offline submission workflow, not covert exfiltration.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:629:fetch-api-call","reason":"After notification permission is granted, the example registers a push subscription with a fixed same-origin endpoint. No external collection service is present.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:752:hardcoded-url","reason":"The URL is a placeholder audit target for Lighthouse. It is not a callback, download source, or exfiltration destination.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:901:environment-variable-access-dot-notation","reason":"The configuration checks only NODE_ENV to disable PWA generation during development. It does not read or transmit credentials.","verdict":"false_positive","confidence":1},{"id":"env_access:SKILL.md:901:environment-variable-object","reason":"The example accesses one ordinary build-mode variable, NODE_ENV. It does not enumerate the environment or collect secret values.","verdict":"false_positive","confidence":1},{"id":"sensitive:SKILL.md:901:environment-file-access","reason":"The matched expression reads process.env.NODE_ENV, not an environment file. No filesystem read or secret extraction occurs.","verdict":"false_positive","confidence":1},{"id":"sensitive:SKILL.md:206:certificate-key-files","reason":"caches.keys() enumerates browser Cache Storage names, not certificate or private-key files. Overbroad cache deletion is assessed separately.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:171:system-reconnaissance","reason":"The checklist requests a maskable Android app icon. It performs no host inspection, command execution, or system reconnaissance.","verdict":"false_positive","confidence":1}],"semantic_findings":[{"title":"Shared Response Caches Lack User Isolation","severity":"medium","locations":[{"file":"SKILL.md","line_end":299,"line_start":285},{"file":"SKILL.md","line_end":447,"line_start":424}],"confidence":0.95,"description":"API and navigation examples store responses in shared caches without user partitioning or logout cleanup. Authenticated content can remain accessible after account changes or offline.","confidence_reasoning":"Both examples cache broad API or page responses without session isolation. Disclosure depends on deploying them with authenticated content, but no safeguards are shown."},{"title":"Activation Deletes Unrelated Origin Caches","severity":"medium","locations":[{"file":"SKILL.md","line_end":213,"line_start":203}],"confidence":0.99,"description":"Activation deletes every cache whose name differs from CACHE_NAME. Cache Storage is shared by origin, so this can destroy other applications' offline data.","confidence_reasoning":"The filter excludes only the current cache name before deleting all others. No application prefix or ownership restriction protects unrelated caches."}],"subject_marketplace_commit_sha":"c993c6abcbffafea2683d7748b53b3dfaf438415","subject_content_hash":"16e56227d54b1ad94c4d4ee1582eef547bcd32bd10d12c9fd77496bbd9cb2f7d","subject_tree_hash":"5bc7066fed15eb90f2f732001bafbbff34d5bdcb42b86b1ada78b54cba9ea6e5","subject_plugin_path":"skills/alinaqi/pwa-development","audit_payload_hash":"1d108a9bbb70c53b1aa1505d65c71ab9","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"c993c6abcbffafea2683d7748b53b3dfaf438415","contentHash":"16e56227d54b1ad94c4d4ee1582eef547bcd32bd10d12c9fd77496bbd9cb2f7d","treeHash":"5bc7066fed15eb90f2f732001bafbbff34d5bdcb42b86b1ada78b54cba9ea6e5","pluginPath":"skills/alinaqi/pwa-development","auditPayloadHash":"1d108a9bbb70c53b1aa1505d65c71ab9"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/alinaqi-pwa-development/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}