{"data":{"skill":{"slug":"andresnaza-roadmap-planning-expert","name":"Roadmap Planning Expert","icon":"📦","repo":"https://github.com/AndresNaza/claude-plugins/tree/main/roadmap-planner/skills/roadmap-planning","status":"approved","author":"AndresNaza","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"714edc05-9509-4676-87f4-48388d015cc5","skill_id":"fd429f1e-b96d-4e56-a70b-91fcda71c371","version":9,"content_hash":"v2:1b5b6c4962b2ad5a7a34603cab2685bbbd1b61ef:4c6e978d28a8363d0cdc14062f25cfdcaad15f7259a9a06cacfd0102d3d5b767:83f485cfa4a76577b2aa297f0dd006f6140b5e01032257c4707425de37a86d96:928008694ffd204faa588639f30a6f29","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 18 static external command alerts are false positives from Markdown code fences, inline file names, and documented slash commands. No prompt injection or executable shell instructions were found in SKILL.md. The remaining concern is the documented ClickUp synchronization, which should require explicit user consent before sharing roadmap data.","remediation":[{"issue":"ClickUp synchronization can share roadmap details outside the local workspace.","severity":"low","suggestion":"Require explicit confirmation before push or pull actions, document which fields are sent, and use only user-provided credentials."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":60,"line_start":51},{"file":"SKILL.md","line_end":64,"line_start":60},{"file":"SKILL.md","line_end":65,"line_start":64},{"file":"SKILL.md","line_end":66,"line_start":65},{"file":"SKILL.md","line_end":67,"line_start":66},{"file":"SKILL.md","line_end":68,"line_start":67},{"file":"SKILL.md","line_end":69,"line_start":68},{"file":"SKILL.md","line_end":74,"line_start":69},{"file":"SKILL.md","line_end":75,"line_start":74},{"file":"SKILL.md","line_end":76,"line_start":75},{"file":"SKILL.md","line_end":77,"line_start":76},{"file":"SKILL.md","line_end":78,"line_start":77},{"file":"SKILL.md","line_end":81,"line_start":78},{"file":"SKILL.md","line_end":82,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":82},{"file":"SKILL.md","line_end":86,"line_start":83},{"file":"SKILL.md","line_end":101,"line_start":86},{"file":"SKILL.md","line_end":102,"line_start":101}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"External Roadmap Synchronization Requires Consent","locations":[{"file":"SKILL.md","line_end":102,"line_start":98}],"confidence":0.68,"description":"The skill describes pushing epics and milestones to ClickUp and pulling status updates. This can share internal roadmap data with a third-party service if implemented without explicit user approval.","review_kind":"security","source_category":"semantic","source_severity":"low","confidence_reasoning":"The text clearly describes ClickUp synchronization, but the scanned file contains no implementation details. The risk is limited to the stated integration behavior."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":107,"audit_model":"codex","audited_at":"2026-07-07T20:07:53.002+00:00","created_at":"2026-07-08T00:13:07.676985+00:00","static_findings":[{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":60,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":64,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"All roadmap files in `.roadmap/`:","category":"external_commands","line_end":65,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `config.json` - Team configuration","category":"external_commands","line_end":66,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `quarters/` - Quarterly roadmaps","category":"external_commands","line_end":67,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `epics/` - Epic files with milestones","category":"external_commands","line_end":68,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `sprints/` - Sprint plans","category":"external_commands","line_end":69,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `templates/` - File templates","category":"external_commands","line_end":74,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:init` - Initialize roadmap structure","category":"external_commands","line_end":75,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:team` - Configure team","category":"external_commands","line_end":76,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:plan-quarter` - Plan quarterly epics (collaborative)","category":"external_commands","line_end":77,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:plan-epic` - Break epic into milestones (collaborative)","category":"external_commands","line_end":78,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:plan-sprint` - Allocate milestones to sprint (collaborative)","category":"external_commands","line_end":81,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:status` - View progress at any level","category":"external_commands","line_end":82,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:update` - Mark milestones done","category":"external_commands","line_end":83,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:capacity` - Show capacity calculations","category":"external_commands","line_end":86,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/roadmap-planner:schedule` - Assign start/end dates to milestones for Gantt visualization","category":"external_commands","line_end":101,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/clickup-sync:push` - Push epics and milestones","category":"external_commands","line_end":102,"severity":"medium","line_start":101}],"finding_verdicts":[{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"Line 51 is an opening Markdown code fence for an ASCII planning hierarchy. It is not Ruby, shell, or executable command syntax.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"Line 60 is the closing Markdown code fence for the planning hierarchy block. It contains no command invocation or command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The backticks format the .roadmap directory name as inline documentation. This is a file location description, not shell execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The backticks format the config.json filename in a documentation list. There is no execution path or user-controlled command.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The backticks format the quarters directory name in prose. This is documentation-only and does not invoke a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The backticks format the epics directory name in prose. This is a safe documentation pattern, not command execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The backticks format the sprints directory name in prose. It does not describe or execute a Ruby or shell command.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The backticks format the templates directory name in prose. No executable command or dynamic input is present.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"This line documents a roadmap-planner slash command name. It is not shell syntax and does not execute an external process by itself.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"This line documents a team configuration slash command name. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"This line documents a collaborative planning slash command. It is a product command reference, not external process execution.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"This line documents a slash command for epic planning. There is no shell command, interpolation, or command substitution.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"This line documents a slash command for sprint planning. The text is a command reference, not executable shell code.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"This line documents a status slash command. It does not invoke a shell or describe running an external binary.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"This line documents an update slash command for roadmap state. The backticks are Markdown formatting, not Ruby or shell execution.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"This line documents a capacity slash command. It is a safe command reference with no external process or user-controlled execution.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"This line documents a scheduling slash command for roadmap visualization. It is not a shell command or command substitution pattern.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"This line documents a ClickUp sync slash command name, not a Ruby or shell backtick execution. The integration may need consent, but this static finding is not external command execution.","verdict":"false_positive","confidence":0.9}],"semantic_findings":[{"title":"External Roadmap Synchronization Requires Consent","severity":"low","locations":[{"file":"SKILL.md","line_end":102,"line_start":98}],"confidence":0.68,"description":"The skill describes pushing epics and milestones to ClickUp and pulling status updates. This can share internal roadmap data with a third-party service if implemented without explicit user approval.","confidence_reasoning":"The text clearly describes ClickUp synchronization, but the scanned file contains no implementation details. The risk is limited to the stated integration behavior."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"low","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}