{"data":{"skill":{"slug":"ariegoldkin-design-system-starter","name":"design-system-starter","icon":"📦","repo":"https://github.com/ArieGoldkin/ai-agent-hub/tree/main/skills/design-system-starter","status":"approved","author":"AI Agent Hub","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"99c9be42-22de-4f50-b728-cc8f40286881","skill_id":"398e5c6c-2da8-4fb3-baad-9b1d035da2f9","version":8,"content_hash":"v2:3e6bce382a07b29df5b58d82b6d06ee6abed972c:8d12dcbc9a1afe25da168ea2ded548495951273e09bfc0bc201f2d28f7dbfb47:3019e0fca45fd7fb1079b9540636ec010bcf2cf0d2ea51d6e4be0f761f5a7cd4:252413f3ec585a29dd73156789e26973","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The static alerts are false positives caused by Markdown formatting, React template literals, relative imports, keyboard event checks, and documentation links. I found no evidence of shell execution, path traversal, credential handling, system reconnaissance, prompt injection, or malicious network activity.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"references/component-examples.md","line_end":500,"line_start":493},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":95,"line_start":75},{"file":"SKILL.md","line_end":98,"line_start":95},{"file":"SKILL.md","line_end":128,"line_start":98},{"file":"SKILL.md","line_end":137,"line_start":128},{"file":"SKILL.md","line_end":175,"line_start":137},{"file":"SKILL.md","line_end":181,"line_start":175},{"file":"SKILL.md","line_end":199,"line_start":181},{"file":"SKILL.md","line_end":202,"line_start":199},{"file":"SKILL.md","line_end":216,"line_start":202},{"file":"SKILL.md","line_end":220,"line_start":216},{"file":"SKILL.md","line_end":233,"line_start":220},{"file":"SKILL.md","line_end":237,"line_start":233},{"file":"SKILL.md","line_end":248,"line_start":237},{"file":"SKILL.md","line_end":270,"line_start":248},{"file":"SKILL.md","line_end":279,"line_start":270},{"file":"SKILL.md","line_end":281,"line_start":279},{"file":"SKILL.md","line_end":292,"line_start":281},{"file":"SKILL.md","line_end":301,"line_start":292},{"file":"SKILL.md","line_end":303,"line_start":301},{"file":"SKILL.md","line_end":332,"line_start":303},{"file":"SKILL.md","line_end":340,"line_start":332},{"file":"SKILL.md","line_end":343,"line_start":340},{"file":"SKILL.md","line_end":357,"line_start":343},{"file":"SKILL.md","line_end":360,"line_start":357},{"file":"SKILL.md","line_end":378,"line_start":360},{"file":"SKILL.md","line_end":382,"line_start":378},{"file":"SKILL.md","line_end":385,"line_start":382},{"file":"SKILL.md","line_end":387,"line_start":385},{"file":"SKILL.md","line_end":395,"line_start":387},{"file":"SKILL.md","line_end":428,"line_start":395},{"file":"SKILL.md","line_end":433,"line_start":428},{"file":"SKILL.md","line_end":443,"line_start":433},{"file":"SKILL.md","line_end":446,"line_start":443},{"file":"SKILL.md","line_end":450,"line_start":446},{"file":"SKILL.md","line_end":453,"line_start":450},{"file":"SKILL.md","line_end":460,"line_start":453},{"file":"SKILL.md","line_end":476,"line_start":460},{"file":"SKILL.md","line_end":491,"line_start":476},{"file":"SKILL.md","line_end":495,"line_start":491},{"file":"SKILL.md","line_end":496,"line_start":495},{"file":"SKILL.md","line_end":497,"line_start":496},{"file":"SKILL.md","line_end":498,"line_start":497},{"file":"SKILL.md","line_end":501,"line_start":498},{"file":"SKILL.md","line_end":501,"line_start":501},{"file":"SKILL.md","line_end":523,"line_start":505},{"file":"templates/component-template.tsx","line_end":11,"line_start":7}]},{"factor":"filesystem","evidence":[{"file":"references/component-examples.md","line_end":13,"line_start":13},{"file":"templates/component-template.tsx","line_end":15,"line_start":15}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":473,"line_start":473},{"file":"templates/design-tokens-template.json","line_end":2,"line_start":2}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":5,"total_lines":2557,"audit_model":"codex","audited_at":"2026-07-08T00:06:12.705+00:00","created_at":"2026-07-08T00:13:17.627717+00:00","static_findings":[{"id":"blocker:checklists/design-system-checklist.md:154:system-reconnaissance","file":"checklists/design-system-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] **Grid System**: Responsive grid (12-column or flexbox/grid-based)","category":"blocker","line_end":154,"severity":"low","line_start":154},{"id":"blocker:checklists/design-system-checklist.md:209:system-reconnaissance","file":"checklists/design-system-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] **Valid HTML**: Markup validates","category":"blocker","line_end":209,"severity":"low","line_start":209},{"id":"external_commands:references/component-examples.md:493:ruby-shell-backtick-execution","file":"references/component-examples.md","pattern":"Ruby/shell backtick execution","snippet":"aria-label={`Switch to ${theme === 'light' ? 'dark' : 'light'} mode`}","category":"external_commands","line_end":500,"severity":"medium","line_start":493},{"id":"filesystem:references/component-examples.md:13:path-traversal-sequence","file":"references/component-examples.md","pattern":"Path traversal sequence","snippet":"import { cn } from '../utils/cn';","category":"filesystem","line_end":13,"severity":"high","line_start":13},{"id":"sensitive:references/component-examples.md:296:certificate-key-files","file":"references/component-examples.md","pattern":"Certificate/key files","snippet":"if (e.key === 'Escape') onClose();","category":"sensitive","line_end":296,"severity":"high","line_start":296},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `references/component-examples.md` - Complete component implementations","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `templates/design-tokens-template.json` - W3C design token format","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `templates/component-template.tsx` - React component template","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `checklists/design-system-checklist.md` - Design system audit checklist","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":95,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":98,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":128,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":137,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":175,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":181,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":199,"severity":"medium","line_start":181},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":202,"severity":"medium","line_start":199},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":216,"severity":"medium","line_start":202},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":220,"severity":"medium","line_start":216},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":233,"severity":"medium","line_start":220},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":237,"severity":"medium","line_start":233},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":248,"severity":"medium","line_start":237},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":270,"severity":"medium","line_start":248},{"id":"external_commands:SKILL.md:270:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":279,"severity":"medium","line_start":270},{"id":"external_commands:SKILL.md:279:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":281,"severity":"medium","line_start":279},{"id":"external_commands:SKILL.md:281:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `references/component-examples.md` for complete Button implementation with variants, sizes, and ","category":"external_commands","line_end":292,"severity":"medium","line_start":281},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":301,"severity":"medium","line_start":292},{"id":"external_commands:SKILL.md:301:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":303,"severity":"medium","line_start":301},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `references/component-examples.md` for FormField, Card (compound component pattern), Input with ","category":"external_commands","line_end":332,"severity":"medium","line_start":303},{"id":"external_commands:SKILL.md:332:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":340,"severity":"medium","line_start":332},{"id":"external_commands:SKILL.md:340:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":343,"severity":"medium","line_start":340},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":357,"severity":"medium","line_start":343},{"id":"external_commands:SKILL.md:357:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":360,"severity":"medium","line_start":357},{"id":"external_commands:SKILL.md:360:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":378,"severity":"medium","line_start":360},{"id":"external_commands:SKILL.md:378:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":382,"severity":"medium","line_start":378},{"id":"external_commands:SKILL.md:382:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":385,"severity":"medium","line_start":382},{"id":"external_commands:SKILL.md:385:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":387,"severity":"medium","line_start":385},{"id":"external_commands:SKILL.md:387:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `references/component-examples.md` for complete polymorphic component TypeScript patterns.","category":"external_commands","line_end":395,"severity":"medium","line_start":387},{"id":"external_commands:SKILL.md:395:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":428,"severity":"medium","line_start":395},{"id":"external_commands:SKILL.md:428:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":433,"severity":"medium","line_start":428},{"id":"external_commands:SKILL.md:433:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```css","category":"external_commands","line_end":443,"severity":"medium","line_start":433},{"id":"external_commands:SKILL.md:443:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":446,"severity":"medium","line_start":443},{"id":"external_commands:SKILL.md:446:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":450,"severity":"medium","line_start":446},{"id":"external_commands:SKILL.md:450:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":453,"severity":"medium","line_start":450},{"id":"external_commands:SKILL.md:453:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":460,"severity":"medium","line_start":453},{"id":"external_commands:SKILL.md:460:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":476,"severity":"medium","line_start":460},{"id":"external_commands:SKILL.md:476:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":491,"severity":"medium","line_start":476},{"id":"external_commands:SKILL.md:491:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":495,"severity":"medium","line_start":491},{"id":"external_commands:SKILL.md:495:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `aria-label`: Provide accessible names","category":"external_commands","line_end":496,"severity":"medium","line_start":495},{"id":"external_commands:SKILL.md:496:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `aria-expanded`: Communicate expanded/collapsed state","category":"external_commands","line_end":497,"severity":"medium","line_start":496},{"id":"external_commands:SKILL.md:497:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `aria-controls`: Associate controls with content","category":"external_commands","line_end":498,"severity":"medium","line_start":497},{"id":"external_commands:SKILL.md:498:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `aria-live`: Announce dynamic content changes","category":"external_commands","line_end":501,"severity":"medium","line_start":498},{"id":"external_commands:SKILL.md:501:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use semantic HTML elements (`<button>`, `<nav>`, `<main>`)","category":"external_commands","line_end":501,"severity":"medium","line_start":501},{"id":"external_commands:SKILL.md:505:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `references/component-examples.md` for complete accessibility examples including Skip Links, foc","category":"external_commands","line_end":523,"severity":"medium","line_start":505},{"id":"network:SKILL.md:473:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"**Tools**: Use contrast checkers like [WebAIM Contrast Checker](https://webaim.org/resources/contras","category":"network","line_end":473,"severity":"low","line_start":473},{"id":"sensitive:SKILL.md:480:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"onKeyDown={(e) => e.key === 'Enter' && handleClick()}","category":"sensitive","line_end":480,"severity":"high","line_start":480},{"id":"blocker:SKILL.md:310:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Product Card Grid","category":"blocker","line_end":311,"severity":"low","line_start":310},{"id":"blocker:SKILL.md:502:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid div/span soup for interactive elements","category":"blocker","line_end":502,"severity":"low","line_start":502},{"id":"blocker:SKILL.md:558:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"### Rapid UI Designer","category":"blocker","line_end":558,"severity":"low","line_start":558},{"id":"external_commands:templates/component-template.tsx:7:ruby-shell-backtick-execution","file":"templates/component-template.tsx","pattern":"Ruby/shell backtick execution","snippet":"* ```tsx","category":"external_commands","line_end":11,"severity":"medium","line_start":7},{"id":"filesystem:templates/component-template.tsx:15:path-traversal-sequence","file":"templates/component-template.tsx","pattern":"Path traversal sequence","snippet":"import { cn } from '../utils/cn'; // Utility for className merging","category":"filesystem","line_end":15,"severity":"high","line_start":15},{"id":"sensitive:templates/component-template.tsx:131:certificate-key-files","file":"templates/component-template.tsx","pattern":"Certificate/key files","snippet":"if (event.key === 'Enter' || event.key === ' ') {","category":"sensitive","line_end":131,"severity":"high","line_start":131},{"id":"network:templates/design-tokens-template.json:2:hardcoded-url","file":"templates/design-tokens-template.json","pattern":"Hardcoded URL","snippet":"\"$schema\": \"https://design-tokens.org/schemas/v1.0.0/design-tokens.schema.json\",","category":"network","line_end":2,"severity":"low","line_start":2}],"finding_verdicts":[{"id":"blocker:checklists/design-system-checklist.md:154:system-reconnaissance","reason":"The referenced line is design system documentation about UI layout, accessibility, or agent roles, not system reconnaissance. It does not request host, network, or environment discovery.","verdict":"false_positive","confidence":0.95},{"id":"blocker:checklists/design-system-checklist.md:209:system-reconnaissance","reason":"The referenced line is design system documentation about UI layout, accessibility, or agent roles, not system reconnaissance. It does not request host, network, or environment discovery.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/component-examples.md:493:ruby-shell-backtick-execution","reason":"This is a React template literal used to build accessible label text. It does not invoke a shell, Ruby backticks, or an external process.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/component-examples.md:13:path-traversal-sequence","reason":"This is a static relative import of a local utility module in an example component. It does not read arbitrary paths or include user-controlled traversal.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:references/component-examples.md:296:certificate-key-files","reason":"The line checks KeyboardEvent.key for accessibility behavior. It does not reference certificate files, private keys, credentials, or secret storage.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting for file names, ARIA attributes, or HTML element names. It does not execute commands or invoke an interpreter.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting for file names, ARIA attributes, or HTML element names. It does not execute commands or invoke an interpreter.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting for file names, ARIA attributes, or HTML element names. It does not execute commands or invoke an interpreter.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting for file names, ARIA attributes, or HTML element names. It does not execute commands or invoke an interpreter.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:270:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:279:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:281:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting for file names, ARIA attributes, or HTML element names. It does not execute commands or invoke an interpreter.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:301:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting for file names, ARIA attributes, or HTML element names. It does not execute commands or invoke an interpreter.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:332:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:340:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:357:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:360:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:378:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:382:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:385:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:387:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting for file names, ARIA attributes, or HTML element names. It does not execute commands or invoke an interpreter.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:395:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:428:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:433:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:443:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:446:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:450:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:453:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:460:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:476:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:491:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:495:ruby-shell-backtick-execution","reason":"This is a React template literal used to build accessible label text. It does not invoke a shell, Ruby backticks, or an external process.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:496:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting for file names, ARIA attributes, or HTML element names. It does not execute commands or invoke an interpreter.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:497:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting for file names, ARIA attributes, or HTML element names. It does not execute commands or invoke an interpreter.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:498:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting for file names, ARIA attributes, or HTML element names. It does not execute commands or invoke an interpreter.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:501:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting for file names, ARIA attributes, or HTML element names. It does not execute commands or invoke an interpreter.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:505:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting for file names, ARIA attributes, or HTML element names. It does not execute commands or invoke an interpreter.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:473:hardcoded-url","reason":"This is a documentation link to the public WebAIM contrast checker. It does not perform a network request or send user data.","verdict":"false_positive","confidence":0.95},{"id":"sensitive:SKILL.md:480:certificate-key-files","reason":"The line checks KeyboardEvent.key for accessibility behavior. It does not reference certificate files, private keys, credentials, or secret storage.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:310:system-reconnaissance","reason":"The referenced line is design system documentation about UI layout, accessibility, or agent roles, not system reconnaissance. It does not request host, network, or environment discovery.","verdict":"false_positive","confidence":0.95},{"id":"blocker:SKILL.md:502:system-reconnaissance","reason":"The referenced line is design system documentation about UI layout, accessibility, or agent roles, not system reconnaissance. It does not request host, network, or environment discovery.","verdict":"false_positive","confidence":0.95},{"id":"blocker:SKILL.md:558:system-reconnaissance","reason":"The referenced line is design system documentation about UI layout, accessibility, or agent roles, not system reconnaissance. It does not request host, network, or environment discovery.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:templates/component-template.tsx:7:ruby-shell-backtick-execution","reason":"This is a Markdown code fence inside documentation or a comment example. It is not command execution and no shell API is called.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:templates/component-template.tsx:15:path-traversal-sequence","reason":"This is a static relative import of a local utility module in an example component. It does not read arbitrary paths or include user-controlled traversal.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:templates/component-template.tsx:131:certificate-key-files","reason":"The line checks KeyboardEvent.key for accessibility behavior. It does not reference certificate files, private keys, credentials, or secret storage.","verdict":"false_positive","confidence":0.97},{"id":"network:templates/design-tokens-template.json:2:hardcoded-url","reason":"The URL is a JSON schema identifier for design token metadata. It is not executable code and does not exfiltrate data.","verdict":"false_positive","confidence":0.93}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}