{"data":{"skill":{"slug":"allra-fintech-allra-error-handling","name":"allra-error-handling","icon":"📦","repo":"https://github.com/Allra-Fintech/allra-ai-skills/tree/main/backend-plugin/skills/error-handling","status":"approved","author":"Allra-Fintech","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"ae79261c-b9bb-4d04-8ae6-38b8539a5d81","skill_id":"c35ab10b-0ae1-4da4-a927-21573d955d4d","version":10,"content_hash":"v3:31bc7611b504c197d3e993aef7943461c871616f:79fa8a797a6038a620948cf9942debc41f243b7ffbba4e230d9c413bcb9879f1:b5fd21fa183ad2092d2a5ae028611f99dd5cf979146881114ca4483fce3eecd2:736b696c6c732f616c6c72612d66696e746563682f616c6c72612d6572726f722d68616e646c696e67:16cebd4246759d29f50c9a7199dc39da","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 21 static findings are false positives caused by Markdown code fences or ordinary Java identifiers; the skill executes no external commands. One medium-severity design concern remains because examples may expose personal or sensitive values through logs and validation responses.","remediation":[{"issue":"Logging and validation examples can expose email addresses, rejected values, or exception details.","severity":"medium","suggestion":"Use allowlisted fields, mask personal data, omit rejected values, and sanitize validation messages before logging or returning them."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":73,"line_start":14},{"file":"SKILL.md","line_end":79,"line_start":73},{"file":"SKILL.md","line_end":116,"line_start":79},{"file":"SKILL.md","line_end":122,"line_start":116},{"file":"SKILL.md","line_end":176,"line_start":122},{"file":"SKILL.md","line_end":182,"line_start":176},{"file":"SKILL.md","line_end":223,"line_start":182},{"file":"SKILL.md","line_end":230,"line_start":223},{"file":"SKILL.md","line_end":237,"line_start":230},{"file":"SKILL.md","line_end":240,"line_start":237},{"file":"SKILL.md","line_end":253,"line_start":240},{"file":"SKILL.md","line_end":259,"line_start":253},{"file":"SKILL.md","line_end":271,"line_start":259},{"file":"SKILL.md","line_end":275,"line_start":271},{"file":"SKILL.md","line_end":303,"line_start":275},{"file":"SKILL.md","line_end":309,"line_start":303},{"file":"SKILL.md","line_end":326,"line_start":309},{"file":"SKILL.md","line_end":332,"line_start":326},{"file":"SKILL.md","line_end":342,"line_start":332}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Potential Sensitive Data Exposure in Logs and Errors","locations":[{"file":"SKILL.md","line_end":156,"line_start":144},{"file":"SKILL.md","line_end":220,"line_start":217},{"file":"SKILL.md","line_end":338,"line_start":333}],"confidence":0.9,"description":"Examples log exception details and email addresses, then return rejected values without redaction. Reuse could expose passwords, tokens, or personal data.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The examples explicitly log email and exception content and expose rejected input values. Secret exposure depends on which request fields reach these paths."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":366,"audit_model":"codex","audited_at":"2026-07-23T05:19:30.256+00:00","created_at":"2026-07-24T05:58:40.66223+00:00","static_findings":[{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":73,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":79,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":116,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":122,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":176,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":182,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":223,"severity":"medium","line_start":182},{"id":"external_commands:SKILL.md:223:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":230,"severity":"medium","line_start":223},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":237,"severity":"medium","line_start":230},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":240,"severity":"medium","line_start":237},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":253,"severity":"medium","line_start":240},{"id":"external_commands:SKILL.md:253:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":259,"severity":"medium","line_start":253},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":271,"severity":"medium","line_start":259},{"id":"external_commands:SKILL.md:271:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":275,"severity":"medium","line_start":271},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":303,"severity":"medium","line_start":275},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":309,"severity":"medium","line_start":303},{"id":"external_commands:SKILL.md:309:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":326,"severity":"medium","line_start":309},{"id":"external_commands:SKILL.md:326:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":332,"severity":"medium","line_start":326},{"id":"external_commands:SKILL.md:332:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":342,"severity":"medium","line_start":332},{"id":"blocker:SKILL.md:291:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"public void deleteUser(Long id, Long currentUserId) {","category":"blocker","line_end":291,"severity":"low","line_start":291},{"id":"blocker:SKILL.md:338:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"email, \"Invalid password\");","category":"blocker","line_end":338,"severity":"low","line_start":338}],"finding_verdicts":[{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"Line 14 opens a fenced Java example in Markdown. The enclosed text defines exception classes and does not invoke a shell or external process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"Line 73 closes a Markdown code fence. It is documentation syntax, not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"Line 79 opens a fenced Java example containing custom exception classes. No command execution API or shell input is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"Line 116 closes a Markdown code fence. The backticks only delimit the preceding Java example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"Line 122 opens a fenced Java example for a Spring exception handler. The example uses Java methods but does not start external commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","reason":"Line 176 closes the Spring handler example's Markdown fence. It has no executable shell semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","reason":"Line 182 opens a fenced Java record example for error responses. No subprocess, shell, or command construction appears in the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:223:ruby-shell-backtick-execution","reason":"Line 223 closes a Markdown code fence after the Java record example. The detector has mistaken documentation syntax for execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","reason":"Line 230 opens a fenced JSON response example. Static response data cannot execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","reason":"Line 237 closes a Markdown JSON fence. It is a documentation delimiter without command execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","reason":"Line 240 opens a fenced JSON validation-error example. The content is illustrative response data, not an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:253:ruby-shell-backtick-execution","reason":"Line 253 closes the JSON example's Markdown fence. No Ruby or shell execution is involved.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","reason":"Line 259 opens a fenced Java service example using a repository lookup. It contains no process invocation or shell interpolation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:271:ruby-shell-backtick-execution","reason":"Line 271 closes a Markdown code fence after the Java service example. The backticks are not executable.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","reason":"Line 275 opens a fenced Java business-validation example. Repository operations shown there do not launch external commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","reason":"Line 303 closes a Markdown Java fence. It only terminates the documented service example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:309:ruby-shell-backtick-execution","reason":"Line 309 opens a fenced Java logging example. Calls to the application logger are not shell or external command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:326:ruby-shell-backtick-execution","reason":"Line 326 closes the Markdown logging example. The fence itself has no execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:332:ruby-shell-backtick-execution","reason":"Line 332 opens a fenced Java example comparing logging formats. It demonstrates logger calls and never invokes an operating-system command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:291:system-reconnaissance","reason":"Line 291 declares a deleteUser method with resource and current-user identifiers. The surrounding code performs an authorization check, not system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:338:system-reconnaissance","reason":"Line 338 supplies an email and reason to an application warning log. This may raise privacy concerns, but it does not inspect the host system.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Potential Sensitive Data Exposure in Logs and Errors","severity":"medium","locations":[{"file":"SKILL.md","line_end":156,"line_start":144},{"file":"SKILL.md","line_end":220,"line_start":217},{"file":"SKILL.md","line_end":338,"line_start":333}],"confidence":0.9,"description":"Examples log exception details and email addresses, then return rejected values without redaction. Reuse could expose passwords, tokens, or personal data.","confidence_reasoning":"The examples explicitly log email and exception content and expose rejected input values. Secret exposure depends on which request fields reach these paths."}],"subject_marketplace_commit_sha":"31bc7611b504c197d3e993aef7943461c871616f","subject_content_hash":"79fa8a797a6038a620948cf9942debc41f243b7ffbba4e230d9c413bcb9879f1","subject_tree_hash":"b5fd21fa183ad2092d2a5ae028611f99dd5cf979146881114ca4483fce3eecd2","subject_plugin_path":"skills/allra-fintech/allra-error-handling","audit_payload_hash":"16cebd4246759d29f50c9a7199dc39da","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"31bc7611b504c197d3e993aef7943461c871616f","contentHash":"79fa8a797a6038a620948cf9942debc41f243b7ffbba4e230d9c413bcb9879f1","treeHash":"b5fd21fa183ad2092d2a5ae028611f99dd5cf979146881114ca4483fce3eecd2","pluginPath":"skills/allra-fintech/allra-error-handling","auditPayloadHash":"16cebd4246759d29f50c9a7199dc39da"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/allra-fintech-allra-error-handling/audits/10/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}