{"data":{"skill":{"slug":"allra-fintech-allra-api-design","name":"allra-api-design","icon":"📦","repo":"https://github.com/Allra-Fintech/allra-ai-skills/tree/main/backend-plugin/skills/api-design","status":"approved","author":"Allra-Fintech","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"68497895-a47e-4ee4-b39d-c00900c14543","skill_id":"9a799613-bb16-49dd-b70e-fef9899edea7","version":9,"content_hash":"v3:31bc7611b504c197d3e993aef7943461c871616f:eef0f1d1eafad8f54af014fdbd152247552c2deb1089b8405038ffcb866b6034:af5b115589ca71a2e6bd1730d8948c6f4261fba2ac7194e66a76d8ac5fa50ce6:736b696c6c732f616c6c72612d66696e746563682f616c6c72612d6170692d64657369676e:8102e7c7f497574ce8e4894e37d1deeb","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 31 static findings are false positives caused by Markdown backticks, fenced examples, and ordinary Java request parameters. The skill is a documentation-only API design guide with no command execution, system reconnaissance, or prompt injection behavior.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":32,"line_start":24},{"file":"SKILL.md","line_end":34,"line_start":32},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":55,"line_start":38},{"file":"SKILL.md","line_end":61,"line_start":55},{"file":"SKILL.md","line_end":62,"line_start":61},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":64,"line_start":63},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":71,"line_start":68},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":96,"line_start":77},{"file":"SKILL.md","line_end":102,"line_start":96},{"file":"SKILL.md","line_end":137,"line_start":102},{"file":"SKILL.md","line_end":139,"line_start":137},{"file":"SKILL.md","line_end":145,"line_start":139},{"file":"SKILL.md","line_end":158,"line_start":145},{"file":"SKILL.md","line_end":165,"line_start":158},{"file":"SKILL.md","line_end":170,"line_start":165},{"file":"SKILL.md","line_end":173,"line_start":170},{"file":"SKILL.md","line_end":181,"line_start":173},{"file":"SKILL.md","line_end":199,"line_start":181},{"file":"SKILL.md","line_end":236,"line_start":199},{"file":"SKILL.md","line_end":240,"line_start":236},{"file":"SKILL.md","line_end":257,"line_start":240},{"file":"SKILL.md","line_end":268,"line_start":257}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":269,"audit_model":"codex","audited_at":"2026-07-23T05:14:14.74+00:00","created_at":"2026-07-24T05:58:22.172369+00:00","static_findings":[{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```text","category":"external_commands","line_end":32,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":34,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**참고**: 프로젝트에 따라 `controller`, `model`, `dao` 등 다른 이름을 사용할 수 있습니다. 중요한 것은 레이어별 책임을 명확히 분리하는 것입니다.","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```text","category":"external_commands","line_end":55,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":61,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Request**: `{Operation}Request`","category":"external_commands","line_end":62,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 예: `SignUpRequest`, `UpdateUserRequest`","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Response**: `{Operation}Response`","category":"external_commands","line_end":64,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 예: `SignUpResponse`, `UserDetailResponse`","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"내부에서만 사용하는 DTO는 `Dto` 접미사 추가:","category":"external_commands","line_end":71,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 예: `UserSignUpEventDto`, `UserSummaryDto`","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":96,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":102,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":137,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":139,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**참고**: API 버저닝(`/api/v1/...`)은 프로젝트 정책에 따라 선택적으로 적용합니다.","category":"external_commands","line_end":145,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":158,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":165,"severity":"medium","line_start":158},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":170,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":173,"severity":"medium","line_start":170},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":181,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":199,"severity":"medium","line_start":181},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":236,"severity":"medium","line_start":199},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":240,"severity":"medium","line_start":236},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":257,"severity":"medium","line_start":240},{"id":"external_commands:SKILL.md:257:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":268,"severity":"medium","line_start":257},{"id":"blocker:SKILL.md:117:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"public SignUpResponse createUser(@RequestBody @Valid SignUpRequest request) { }","category":"blocker","line_end":117,"severity":"low","line_start":117},{"id":"blocker:SKILL.md:123:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"@RequestBody @Valid UpdateUserRequest request","category":"blocker","line_end":123,"severity":"low","line_start":123},{"id":"blocker:SKILL.md:130:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"@RequestBody @Valid PatchUserRequest request","category":"blocker","line_end":130,"severity":"low","line_start":130},{"id":"blocker:SKILL.md:135:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"public void deleteUser(@PathVariable Long id) { }","category":"blocker","line_end":135,"severity":"low","line_start":135},{"id":"blocker:SKILL.md:231:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"@RequestBody @Valid CreateProductRequest request","category":"blocker","line_end":231,"severity":"low","line_start":231}],"finding_verdicts":[{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"Lines 24-32 are a fenced text diagram describing package folders. The backticks are Markdown delimiters and do not execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"Line 32 closes a Markdown text fence. It contains no Ruby expression, shell invocation, or executable instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"Line 34 uses inline Markdown code to name controller, model, and dao packages. These identifiers are documentation, not commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Lines 38-55 present a fenced package-tree example. The block is labeled text and contains no executable shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"Line 55 closes the package-tree Markdown fence. A fence delimiter has no command execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"Lines 61-62 document a Request class naming template and examples with inline code formatting. No external process is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"Line 62 lists Java class names in inline Markdown code. The backticks are typographic formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"Lines 63-64 document a Response class naming template. The inline backticks do not represent Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"Line 64 lists example Java response class names using Markdown code formatting. It contains no command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"Lines 68-71 explain the Dto suffix for internal classes. Inline code formatting around the suffix cannot execute anything.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"Line 71 provides two Java DTO class-name examples in inline code. There is no process execution or command interpolation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"Lines 77-96 are a fenced Java example defining record DTOs. The opening backticks are a Markdown language fence.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"Line 96 closes a Java code example. It is a Markdown delimiter with no execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"Lines 102-137 contain a static Spring controller example inside a Java fence. It documents mappings and method signatures without invoking commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"Line 137 is the closing Markdown delimiter for the controller example. It cannot launch an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","reason":"Lines 139-145 discuss an API path and introduce validation guidance. The inline API path and Java fence are documentation only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"Lines 145-158 define a Java request record with validation annotations. The fenced code contains no shell or subprocess call.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","reason":"Line 158 closes the Java validation example. The detected backticks are Markdown syntax, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"Lines 165-170 show a static JSON response example. A JSON Markdown fence does not execute external commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","reason":"Line 170 closes a JSON example fence. It has no Ruby or shell execution context.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"Lines 173-181 display a static JSON error response. The backticks only delimit the documentation example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","reason":"Line 181 closes the JSON error response fence. No command or interpreter is involved.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","reason":"Lines 199-236 are a fenced Java and package-layout example for a product API. It contains source examples but no command execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","reason":"Line 236 closes the product API example fence. This is inert Markdown syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","reason":"Lines 240-257 contain Java record examples for QueryDSL and events. The fenced source does not spawn a process or run a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:257:ruby-shell-backtick-execution","reason":"Line 257 closes the final Java code fence. The finding mistakes a Markdown delimiter for shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:117:system-reconnaissance","reason":"Line 117 is an illustrative Spring POST controller signature using a request DTO. It does not inspect the host or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:123:system-reconnaissance","reason":"Line 123 is a Spring RequestBody parameter for an update example. The word request refers to HTTP input, not reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:130:system-reconnaissance","reason":"Line 130 is a Spring RequestBody parameter for a patch endpoint. No system enumeration or environment probing occurs.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:135:system-reconnaissance","reason":"Line 135 is an empty illustrative delete endpoint accepting a path ID. It performs no host discovery or system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:231:system-reconnaissance","reason":"Line 231 is a Spring RequestBody parameter in a product creation example. It processes an API DTO and does not inspect system state.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"31bc7611b504c197d3e993aef7943461c871616f","subject_content_hash":"eef0f1d1eafad8f54af014fdbd152247552c2deb1089b8405038ffcb866b6034","subject_tree_hash":"af5b115589ca71a2e6bd1730d8948c6f4261fba2ac7194e66a76d8ac5fa50ce6","subject_plugin_path":"skills/allra-fintech/allra-api-design","audit_payload_hash":"8102e7c7f497574ce8e4894e37d1deeb","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"31bc7611b504c197d3e993aef7943461c871616f","contentHash":"eef0f1d1eafad8f54af014fdbd152247552c2deb1089b8405038ffcb866b6034","treeHash":"af5b115589ca71a2e6bd1730d8948c6f4261fba2ac7194e66a76d8ac5fa50ce6","pluginPath":"skills/allra-fintech/allra-api-design","auditPayloadHash":"8102e7c7f497574ce8e4894e37d1deeb"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/allra-fintech-allra-api-design/audits/9/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}