{"data":{"skill":{"slug":"allra-fintech-allra-api-design","name":"allra-api-design","icon":"📦","repo":"https://github.com/Allra-Fintech/allra-ai-skills/tree/main/backend-plugin/skills/api-design","status":"approved","author":"Allra-Fintech","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"2198f023-92a0-4980-a89f-91c68baf9646","skill_id":"9a799613-bb16-49dd-b70e-fef9899edea7","version":6,"content_hash":"456ea2e8c0d83f72ee0da81471d70972","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported external command, weak cryptography, and reconnaissance patterns in SKILL.md. Manual review found these are false positives from Markdown code fences, inline examples, and descriptive text. No executable scripts, network access, filesystem access, prompt injection, or malicious intent were found.","remediation":[],"risk_factor_evidence":[],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"False Positive: Markdown Backtick Examples","locations":[{"file":"SKILL.md","line_end":32,"line_start":24},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":55,"line_start":38},{"file":"SKILL.md","line_end":64,"line_start":61},{"file":"SKILL.md","line_end":71,"line_start":68},{"file":"SKILL.md","line_end":96,"line_start":77},{"file":"SKILL.md","line_end":137,"line_start":102},{"file":"SKILL.md","line_end":139,"line_start":139},{"file":"SKILL.md","line_end":158,"line_start":145},{"file":"SKILL.md","line_end":181,"line_start":165},{"file":"SKILL.md","line_end":236,"line_start":199},{"file":"SKILL.md","line_end":257,"line_start":240}],"confidence":0.97,"description":"FALSE_POSITIVE. The external command detections are Markdown code fences and inline formatting for package trees, DTO names, Java examples, JSON examples, and checklist text. They are documentation examples, not shell execution instructions or runnable skill scripts.","confidence_reasoning":"The flagged lines are inside Markdown examples or inline backtick formatting. No command interpreter, subprocess call, or instruction to execute external commands appears in SKILL.md."},{"title":"False Positive: Weak Cryptography Match","locations":[{"file":"SKILL.md","line_end":3,"line_start":2}],"confidence":0.96,"description":"FALSE_POSITIVE. The weak cryptography detections at the front matter are text matches in the skill name and description. They do not define or recommend DES, MD5, SHA1, or any other weak algorithm.","confidence_reasoning":"Manual review of lines 2 and 3 found only the skill name and natural language description. There is no cryptographic implementation or guidance in this file."},{"title":"False Positive: REST Controller Examples","locations":[{"file":"SKILL.md","line_end":117,"line_start":117},{"file":"SKILL.md","line_end":123,"line_start":123},{"file":"SKILL.md","line_end":130,"line_start":130},{"file":"SKILL.md","line_end":135,"line_start":135},{"file":"SKILL.md","line_end":231,"line_start":231}],"confidence":0.95,"description":"FALSE_POSITIVE. The system reconnaissance detections are Spring controller examples using request bodies and path variables. They describe API design conventions and do not collect host, user, network, or environment information.","confidence_reasoning":"The listed lines are method signatures in illustrative Java API snippets. No system inspection commands, environment reads, or reconnaissance behavior are present."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":269,"audit_model":"codex","audited_at":"2026-06-28T09:23:00.987+00:00","created_at":"2026-06-28T09:35:01.505542+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}