{"data":{"skill":{"slug":"andresnaza-roadmap-planning-expert","name":"Roadmap Planning Expert","icon":"📦","repo":"https://github.com/AndresNaza/claude-plugins/tree/main/roadmap-planner/skills/roadmap-planning","status":"approved","author":"AndresNaza","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"bcf08a51-2933-484e-bc0c-1d7296702dad","skill_id":"fd429f1e-b96d-4e56-a70b-91fcda71c371","version":8,"content_hash":"869f918335df3031be936d220afce3e0","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All static findings are false positives caused by Markdown code fences and inline backticks in SKILL.md. The skill contains planning guidance, file naming conventions, and slash command references, with no evidence of executable shell code, prompt injection, or data exfiltration intent.","remediation":[{"issue":"Markdown backticks were flagged as command execution by static analysis.","severity":"safe","suggestion":"No security fix is required. Consider avoiding fenced diagrams if marketplace scanners continue to treat Markdown backticks as executable code."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":60,"line_start":51},{"file":"SKILL.md","line_end":64,"line_start":60},{"file":"SKILL.md","line_end":65,"line_start":64},{"file":"SKILL.md","line_end":66,"line_start":65},{"file":"SKILL.md","line_end":67,"line_start":66},{"file":"SKILL.md","line_end":68,"line_start":67},{"file":"SKILL.md","line_end":69,"line_start":68},{"file":"SKILL.md","line_end":74,"line_start":69},{"file":"SKILL.md","line_end":75,"line_start":74},{"file":"SKILL.md","line_end":76,"line_start":75},{"file":"SKILL.md","line_end":77,"line_start":76},{"file":"SKILL.md","line_end":78,"line_start":77},{"file":"SKILL.md","line_end":81,"line_start":78},{"file":"SKILL.md","line_end":82,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":82},{"file":"SKILL.md","line_end":86,"line_start":83},{"file":"SKILL.md","line_end":101,"line_start":86},{"file":"SKILL.md","line_end":102,"line_start":101}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":107,"audit_model":"codex","audited_at":"2026-07-06T03:33:07.563+00:00","created_at":"2026-07-06T04:26:50.887814+00:00","static_findings":[{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":60,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":64,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"All roadmap files in `.roadmap/`:","category":"external_commands","line_end":65,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `config.json` - Team configuration","category":"external_commands","line_end":66,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `quarters/` - Quarterly roadmaps","category":"external_commands","line_end":67,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `epics/` - Epic files with milestones","category":"external_commands","line_end":68,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `sprints/` - Sprint plans","category":"external_commands","line_end":69,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `templates/` - File templates","category":"external_commands","line_end":74,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:init` - Initialize roadmap structure","category":"external_commands","line_end":75,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:team` - Configure team","category":"external_commands","line_end":76,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:plan-quarter` - Plan quarterly epics (collaborative)","category":"external_commands","line_end":77,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:plan-epic` - Break epic into milestones (collaborative)","category":"external_commands","line_end":78,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:plan-sprint` - Allocate milestones to sprint (collaborative)","category":"external_commands","line_end":81,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:status` - View progress at any level","category":"external_commands","line_end":82,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:update` - Mark milestones done","category":"external_commands","line_end":83,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:capacity` - Show capacity calculations","category":"external_commands","line_end":86,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:schedule` - Assign start/end dates to milestones for Gantt visualization","category":"external_commands","line_end":101,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/clickup-sync:push` - Push epics and milestones","category":"external_commands","line_end":102,"severity":"medium","line_start":101}],"finding_verdicts":[{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"This is a Markdown fenced diagram showing roadmap hierarchy, not Ruby or shell code. The backticks delimit documentation and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"This closes a Markdown fenced diagram and does not represent shell execution. No executable code or command interpolation is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The backticks mark the documented .roadmap directory name in prose. This is inline Markdown formatting, not command execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The backticks mark a documented config.json filename. This is a roadmap file reference and contains no executable command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The backticks mark a documented quarters directory name. This is inline Markdown formatting and has no shell behavior.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The backticks mark a documented epics directory name. This is a file location reference, not executable code.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The backticks mark a documented sprints directory name. This is inline Markdown formatting with no command execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The backticks mark a documented templates directory name. This is a file location reference and does not execute anything.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The backticks mark a slash command name for the roadmap planner. It is documentation of a skill command, not Ruby or shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The backticks mark a slash command name for team configuration. It is a documented command label, not shell backtick execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The backticks mark a slash command name for quarterly planning. It is documentation and contains no executable shell syntax.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The backticks mark a slash command name for epic planning. It is a command label in Markdown, not code execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The backticks mark a slash command name for sprint planning. It is documentation of an interactive workflow, not shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The backticks mark a slash command name for status viewing. The line documents plugin behavior and contains no executable code.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The backticks mark a slash command name for updates. It is inline Markdown formatting and not Ruby or shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The backticks mark a slash command name for capacity calculations. This is documentation, not executable command invocation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The backticks mark a slash command name for scheduling. The surrounding text describes planning behavior and does not run shell commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"The backticks mark a ClickUp sync slash command name. It is a documented integration command label, not shell backtick execution.","verdict":"false_positive","confidence":0.96}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}