{"data":{"skill":{"slug":"ariegoldkin-react-server-components-framework","name":"react-server-components-framework","icon":"📦","repo":"https://github.com/ArieGoldkin/ai-agent-hub/tree/main/skills/react-server-components-framework","status":"approved","author":"AI Agent Hub","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"2f1adb7a-7c81-4a36-9a5b-e3a6a6a3d0d7","skill_id":"7147efec-d53b-4fe5-9462-6d5831c73741","version":6,"content_hash":"bd113a1c004700b62420ba05de14b215","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported many command, network, environment, and browser-storage patterns, but review found these are primarily markdown and TypeScript examples for Next.js development rather than hidden executable behavior. No prompt-injection text or confirmed malicious intent was found. The skill should publish with a warning because some copyable examples need stronger security caveats, especially stored HTML rendering and authorization checks for destructive actions.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"checklists/rsc-implementation-checklist.md","line_end":8,"line_start":8},{"file":"checklists/rsc-implementation-checklist.md","line_end":9,"line_start":9},{"file":"checklists/rsc-implementation-checklist.md","line_end":16,"line_start":16},{"file":"checklists/rsc-implementation-checklist.md","line_end":18,"line_start":18},{"file":"checklists/rsc-implementation-checklist.md","line_end":25,"line_start":25},{"file":"checklists/rsc-implementation-checklist.md","line_end":32,"line_start":32},{"file":"checklists/rsc-implementation-checklist.md","line_end":33,"line_start":33},{"file":"checklists/rsc-implementation-checklist.md","line_end":34,"line_start":34},{"file":"checklists/rsc-implementation-checklist.md","line_end":35,"line_start":35},{"file":"checklists/rsc-implementation-checklist.md","line_end":36,"line_start":36},{"file":"checklists/rsc-implementation-checklist.md","line_end":45,"line_start":45},{"file":"checklists/rsc-implementation-checklist.md","line_end":50,"line_start":50},{"file":"checklists/rsc-implementation-checklist.md","line_end":51,"line_start":51},{"file":"checklists/rsc-implementation-checklist.md","line_end":51,"line_start":51},{"file":"checklists/rsc-implementation-checklist.md","line_end":52,"line_start":52},{"file":"checklists/rsc-implementation-checklist.md","line_end":58,"line_start":58},{"file":"checklists/rsc-implementation-checklist.md","line_end":66,"line_start":66},{"file":"checklists/rsc-implementation-checklist.md","line_end":67,"line_start":67},{"file":"checklists/rsc-implementation-checklist.md","line_end":68,"line_start":68},{"file":"checklists/rsc-implementation-checklist.md","line_end":69,"line_start":69},{"file":"checklists/rsc-implementation-checklist.md","line_end":81,"line_start":81},{"file":"checklists/rsc-implementation-checklist.md","line_end":82,"line_start":82},{"file":"checklists/rsc-implementation-checklist.md","line_end":83,"line_start":83},{"file":"checklists/rsc-implementation-checklist.md","line_end":89,"line_start":89},{"file":"checklists/rsc-implementation-checklist.md","line_end":90,"line_start":90},{"file":"checklists/rsc-implementation-checklist.md","line_end":91,"line_start":91},{"file":"checklists/rsc-implementation-checklist.md","line_end":92,"line_start":92},{"file":"checklists/rsc-implementation-checklist.md","line_end":93,"line_start":93},{"file":"checklists/rsc-implementation-checklist.md","line_end":94,"line_start":94},{"file":"checklists/rsc-implementation-checklist.md","line_end":97,"line_start":97},{"file":"checklists/rsc-implementation-checklist.md","line_end":98,"line_start":98},{"file":"checklists/rsc-implementation-checklist.md","line_end":99,"line_start":99},{"file":"checklists/rsc-implementation-checklist.md","line_end":100,"line_start":100},{"file":"checklists/rsc-implementation-checklist.md","line_end":101,"line_start":101},{"file":"checklists/rsc-implementation-checklist.md","line_end":104,"line_start":104},{"file":"checklists/rsc-implementation-checklist.md","line_end":105,"line_start":105},{"file":"checklists/rsc-implementation-checklist.md","line_end":106,"line_start":106},{"file":"checklists/rsc-implementation-checklist.md","line_end":107,"line_start":107},{"file":"checklists/rsc-implementation-checklist.md","line_end":107,"line_start":107},{"file":"checklists/rsc-implementation-checklist.md","line_end":108,"line_start":108},{"file":"checklists/rsc-implementation-checklist.md","line_end":108,"line_start":108},{"file":"checklists/rsc-implementation-checklist.md","line_end":113,"line_start":113},{"file":"checklists/rsc-implementation-checklist.md","line_end":123,"line_start":123},{"file":"checklists/rsc-implementation-checklist.md","line_end":129,"line_start":129},{"file":"checklists/rsc-implementation-checklist.md","line_end":136,"line_start":136},{"file":"checklists/rsc-implementation-checklist.md","line_end":138,"line_start":138},{"file":"checklists/rsc-implementation-checklist.md","line_end":145,"line_start":145},{"file":"checklists/rsc-implementation-checklist.md","line_end":146,"line_start":146},{"file":"checklists/rsc-implementation-checklist.md","line_end":152,"line_start":152},{"file":"checklists/rsc-implementation-checklist.md","line_end":153,"line_start":153},{"file":"checklists/rsc-implementation-checklist.md","line_end":161,"line_start":161},{"file":"checklists/rsc-implementation-checklist.md","line_end":169,"line_start":169},{"file":"checklists/rsc-implementation-checklist.md","line_end":175,"line_start":175},{"file":"checklists/rsc-implementation-checklist.md","line_end":176,"line_start":176},{"file":"checklists/rsc-implementation-checklist.md","line_end":177,"line_start":177},{"file":"checklists/rsc-implementation-checklist.md","line_end":178,"line_start":178},{"file":"checklists/rsc-implementation-checklist.md","line_end":182,"line_start":182},{"file":"checklists/rsc-implementation-checklist.md","line_end":188,"line_start":188},{"file":"checklists/rsc-implementation-checklist.md","line_end":192,"line_start":192},{"file":"checklists/rsc-implementation-checklist.md","line_end":220,"line_start":220},{"file":"checklists/rsc-implementation-checklist.md","line_end":227,"line_start":227},{"file":"checklists/rsc-implementation-checklist.md","line_end":242,"line_start":242},{"file":"checklists/rsc-implementation-checklist.md","line_end":243,"line_start":243},{"file":"checklists/rsc-implementation-checklist.md","line_end":247,"line_start":247},{"file":"checklists/rsc-implementation-checklist.md","line_end":248,"line_start":248},{"file":"checklists/rsc-implementation-checklist.md","line_end":255,"line_start":255},{"file":"checklists/rsc-implementation-checklist.md","line_end":256,"line_start":256},{"file":"checklists/rsc-implementation-checklist.md","line_end":257,"line_start":257},{"file":"checklists/rsc-implementation-checklist.md","line_end":258,"line_start":258},{"file":"checklists/rsc-implementation-checklist.md","line_end":258,"line_start":258},{"file":"checklists/rsc-implementation-checklist.md","line_end":259,"line_start":259},{"file":"checklists/rsc-implementation-checklist.md","line_end":259,"line_start":259},{"file":"checklists/rsc-implementation-checklist.md","line_end":261,"line_start":261},{"file":"checklists/rsc-implementation-checklist.md","line_end":261,"line_start":261},{"file":"checklists/rsc-implementation-checklist.md","line_end":262,"line_start":262},{"file":"checklists/rsc-implementation-checklist.md","line_end":262,"line_start":262},{"file":"checklists/rsc-implementation-checklist.md","line_end":264,"line_start":264},{"file":"examples/blog-app-example.tsx","line_end":93,"line_start":93},{"file":"examples/blog-app-example.tsx","line_end":118,"line_start":118},{"file":"examples/blog-app-example.tsx","line_end":226,"line_start":226},{"file":"examples/blog-app-example.tsx","line_end":424,"line_start":424},{"file":"references/component-patterns.md","line_end":8,"line_start":8},{"file":"references/component-patterns.md","line_end":8,"line_start":8},{"file":"references/component-patterns.md","line_end":10,"line_start":10},{"file":"references/component-patterns.md","line_end":10,"line_start":10},{"file":"references/component-patterns.md","line_end":10,"line_start":10},{"file":"references/component-patterns.md","line_end":14,"line_start":14},{"file":"references/component-patterns.md","line_end":17,"line_start":17},{"file":"references/component-patterns.md","line_end":19,"line_start":19},{"file":"references/component-patterns.md","line_end":24,"line_start":24},{"file":"references/component-patterns.md","line_end":51,"line_start":32},{"file":"references/component-patterns.md","line_end":55,"line_start":51},{"file":"references/component-patterns.md","line_end":61,"line_start":55},{"file":"references/component-patterns.md","line_end":62,"line_start":61},{"file":"references/component-patterns.md","line_end":67,"line_start":62},{"file":"references/component-patterns.md","line_end":75,"line_start":67},{"file":"references/component-patterns.md","line_end":104,"line_start":75},{"file":"references/component-patterns.md","line_end":108,"line_start":104},{"file":"references/component-patterns.md","line_end":127,"line_start":108},{"file":"references/component-patterns.md","line_end":137,"line_start":127},{"file":"references/component-patterns.md","line_end":172,"line_start":137},{"file":"references/component-patterns.md","line_end":176,"line_start":172},{"file":"references/component-patterns.md","line_end":178,"line_start":176},{"file":"references/component-patterns.md","line_end":204,"line_start":178},{"file":"references/component-patterns.md","line_end":210,"line_start":204},{"file":"references/component-patterns.md","line_end":225,"line_start":210},{"file":"references/component-patterns.md","line_end":235,"line_start":225},{"file":"references/component-patterns.md","line_end":249,"line_start":235},{"file":"references/component-patterns.md","line_end":255,"line_start":249},{"file":"references/component-patterns.md","line_end":280,"line_start":255},{"file":"references/component-patterns.md","line_end":288,"line_start":280},{"file":"references/component-patterns.md","line_end":309,"line_start":288},{"file":"references/component-patterns.md","line_end":313,"line_start":309},{"file":"references/component-patterns.md","line_end":334,"line_start":313},{"file":"references/component-patterns.md","line_end":338,"line_start":334},{"file":"references/component-patterns.md","line_end":361,"line_start":338},{"file":"references/component-patterns.md","line_end":371,"line_start":361},{"file":"references/component-patterns.md","line_end":392,"line_start":371},{"file":"references/component-patterns.md","line_end":398,"line_start":392},{"file":"references/component-patterns.md","line_end":417,"line_start":398},{"file":"references/component-patterns.md","line_end":422,"line_start":417},{"file":"references/data-fetching.md","line_end":29,"line_start":9},{"file":"references/data-fetching.md","line_end":33,"line_start":29},{"file":"references/data-fetching.md","line_end":48,"line_start":33},{"file":"references/data-fetching.md","line_end":56,"line_start":48},{"file":"references/data-fetching.md","line_end":73,"line_start":56},{"file":"references/data-fetching.md","line_end":81,"line_start":73},{"file":"references/data-fetching.md","line_end":95,"line_start":81},{"file":"references/data-fetching.md","line_end":103,"line_start":95},{"file":"references/data-fetching.md","line_end":122,"line_start":103},{"file":"references/data-fetching.md","line_end":130,"line_start":122},{"file":"references/data-fetching.md","line_end":147,"line_start":130},{"file":"references/data-fetching.md","line_end":155,"line_start":147},{"file":"references/data-fetching.md","line_end":170,"line_start":155},{"file":"references/migration-guide.md","line_end":7,"line_start":7},{"file":"references/migration-guide.md","line_end":8,"line_start":8},{"file":"references/migration-guide.md","line_end":28,"line_start":18},{"file":"references/migration-guide.md","line_end":32,"line_start":28},{"file":"references/migration-guide.md","line_end":38,"line_start":32},{"file":"references/migration-guide.md","line_end":46,"line_start":38},{"file":"references/migration-guide.md","line_end":65,"line_start":46},{"file":"references/migration-guide.md","line_end":69,"line_start":65},{"file":"references/migration-guide.md","line_end":75,"line_start":69},{"file":"references/migration-guide.md","line_end":83,"line_start":75},{"file":"references/migration-guide.md","line_end":97,"line_start":83},{"file":"references/migration-guide.md","line_end":101,"line_start":97},{"file":"references/migration-guide.md","line_end":113,"line_start":101},{"file":"references/migration-guide.md","line_end":121,"line_start":113},{"file":"references/migration-guide.md","line_end":130,"line_start":121},{"file":"references/migration-guide.md","line_end":134,"line_start":130},{"file":"references/migration-guide.md","line_end":145,"line_start":134},{"file":"references/migration-guide.md","line_end":153,"line_start":145},{"file":"references/migration-guide.md","line_end":167,"line_start":153},{"file":"references/migration-guide.md","line_end":171,"line_start":167},{"file":"references/migration-guide.md","line_end":187,"line_start":171},{"file":"references/routing-patterns.md","line_end":16,"line_start":8},{"file":"references/routing-patterns.md","line_end":20,"line_start":16},{"file":"references/routing-patterns.md","line_end":41,"line_start":20},{"file":"references/routing-patterns.md","line_end":50,"line_start":41},{"file":"references/routing-patterns.md","line_end":59,"line_start":50},{"file":"references/routing-patterns.md","line_end":63,"line_start":59},{"file":"references/routing-patterns.md","line_end":91,"line_start":63},{"file":"references/routing-patterns.md","line_end":101,"line_start":91},{"file":"references/routing-patterns.md","line_end":108,"line_start":101},{"file":"references/routing-patterns.md","line_end":112,"line_start":108},{"file":"references/routing-patterns.md","line_end":136,"line_start":112},{"file":"references/routing-patterns.md","line_end":145,"line_start":136},{"file":"references/routing-patterns.md","line_end":155,"line_start":145},{"file":"references/routing-patterns.md","line_end":158,"line_start":155},{"file":"references/routing-patterns.md","line_end":159,"line_start":158},{"file":"references/routing-patterns.md","line_end":165,"line_start":159},{"file":"references/routing-patterns.md","line_end":180,"line_start":165},{"file":"references/server-actions.md","line_end":22,"line_start":5},{"file":"references/server-actions.md","line_end":24,"line_start":22},{"file":"references/server-actions.md","line_end":32,"line_start":24},{"file":"references/server-actions.md","line_end":45,"line_start":32},{"file":"references/server-actions.md","line_end":53,"line_start":45},{"file":"references/server-actions.md","line_end":81,"line_start":53},{"file":"references/server-actions.md","line_end":89,"line_start":81},{"file":"references/server-actions.md","line_end":122,"line_start":89},{"file":"references/server-actions.md","line_end":130,"line_start":122},{"file":"references/server-actions.md","line_end":146,"line_start":130},{"file":"references/server-actions.md","line_end":152,"line_start":146},{"file":"references/server-actions.md","line_end":181,"line_start":152},{"file":"references/server-actions.md","line_end":187,"line_start":181},{"file":"references/server-actions.md","line_end":206,"line_start":187},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":56,"line_start":56},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":80,"line_start":68},{"file":"SKILL.md","line_end":83,"line_start":80},{"file":"SKILL.md","line_end":87,"line_start":83},{"file":"SKILL.md","line_end":89,"line_start":87},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":98,"line_start":89},{"file":"SKILL.md","line_end":107,"line_start":98},{"file":"SKILL.md","line_end":109,"line_start":107},{"file":"SKILL.md","line_end":113,"line_start":109},{"file":"SKILL.md","line_end":124,"line_start":113},{"file":"SKILL.md","line_end":140,"line_start":124},{"file":"SKILL.md","line_end":147,"line_start":140},{"file":"SKILL.md","line_end":152,"line_start":147},{"file":"SKILL.md","line_end":157,"line_start":152},{"file":"SKILL.md","line_end":160,"line_start":157},{"file":"SKILL.md","line_end":164,"line_start":160},{"file":"SKILL.md","line_end":167,"line_start":164},{"file":"SKILL.md","line_end":171,"line_start":167},{"file":"SKILL.md","line_end":173,"line_start":171},{"file":"SKILL.md","line_end":186,"line_start":173},{"file":"SKILL.md","line_end":201,"line_start":186},{"file":"SKILL.md","line_end":212,"line_start":201},{"file":"SKILL.md","line_end":220,"line_start":212},{"file":"SKILL.md","line_end":244,"line_start":220},{"file":"SKILL.md","line_end":245,"line_start":244},{"file":"SKILL.md","line_end":246,"line_start":245},{"file":"SKILL.md","line_end":254,"line_start":246},{"file":"SKILL.md","line_end":267,"line_start":254},{"file":"SKILL.md","line_end":283,"line_start":267},{"file":"SKILL.md","line_end":300,"line_start":283},{"file":"SKILL.md","line_end":304,"line_start":300},{"file":"SKILL.md","line_end":317,"line_start":304},{"file":"SKILL.md","line_end":321,"line_start":317},{"file":"SKILL.md","line_end":334,"line_start":321},{"file":"SKILL.md","line_end":340,"line_start":334},{"file":"SKILL.md","line_end":340,"line_start":340},{"file":"SKILL.md","line_end":343,"line_start":340},{"file":"SKILL.md","line_end":344,"line_start":343},{"file":"SKILL.md","line_end":346,"line_start":344},{"file":"SKILL.md","line_end":346,"line_start":346},{"file":"SKILL.md","line_end":347,"line_start":346},{"file":"SKILL.md","line_end":347,"line_start":347},{"file":"SKILL.md","line_end":349,"line_start":347},{"file":"SKILL.md","line_end":360,"line_start":349},{"file":"SKILL.md","line_end":363,"line_start":360},{"file":"SKILL.md","line_end":366,"line_start":363},{"file":"SKILL.md","line_end":369,"line_start":366},{"file":"SKILL.md","line_end":369,"line_start":369},{"file":"SKILL.md","line_end":369,"line_start":369},{"file":"templates/server-action-template.ts","line_end":58,"line_start":58},{"file":"templates/server-action-template.ts","line_end":95,"line_start":95},{"file":"templates/server-action-template.ts","line_end":221,"line_start":221}]},{"factor":"scripts","evidence":[{"file":"references/component-patterns.md","line_end":375,"line_start":375}]},{"factor":"network","evidence":[{"file":"references/component-patterns.md","line_end":61,"line_start":61},{"file":"references/component-patterns.md","line_end":61,"line_start":61},{"file":"references/data-fetching.md","line_end":11,"line_start":11},{"file":"references/data-fetching.md","line_end":16,"line_start":16},{"file":"references/data-fetching.md","line_end":21,"line_start":21},{"file":"references/data-fetching.md","line_end":26,"line_start":26},{"file":"references/data-fetching.md","line_end":160,"line_start":160},{"file":"references/data-fetching.md","line_end":11,"line_start":11},{"file":"references/data-fetching.md","line_end":16,"line_start":16},{"file":"references/data-fetching.md","line_end":21,"line_start":21},{"file":"references/data-fetching.md","line_end":26,"line_start":26},{"file":"references/data-fetching.md","line_end":160,"line_start":160},{"file":"references/migration-guide.md","line_end":54,"line_start":54},{"file":"references/migration-guide.md","line_end":72,"line_start":72},{"file":"references/migration-guide.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":375,"line_start":375},{"file":"SKILL.md","line_end":376,"line_start":376},{"file":"SKILL.md","line_end":377,"line_start":377},{"file":"SKILL.md","line_end":378,"line_start":378},{"file":"templates/client-component-template.tsx","line_end":41,"line_start":41}]},{"factor":"env_access","evidence":[{"file":"references/component-patterns.md","line_end":59,"line_start":59},{"file":"references/component-patterns.md","line_end":59,"line_start":59},{"file":"references/component-patterns.md","line_end":59,"line_start":59},{"file":"templates/server-component-template.tsx","line_end":30,"line_start":30},{"file":"templates/server-component-template.tsx","line_end":30,"line_start":30},{"file":"templates/server-component-template.tsx","line_end":30,"line_start":30}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Copyable Stored HTML Rendering Example","category":"xss","severity":"medium","locations":[{"file":"examples/blog-app-example.tsx","line_end":279,"line_start":276}],"confidence":0.86,"description":"The blog example renders post content with dangerouslySetInnerHTML. In a real application, stored HTML must be sanitized before rendering or it can create stored cross-site scripting risk.","remediation":"Add explicit sanitization guidance and show a safe renderer or trusted-content boundary before using dangerouslySetInnerHTML.","confidence_reasoning":"The code directly maps stored post.content into dangerouslySetInnerHTML. The file is an educational example, so malicious intent is not confirmed, but the copy-paste security risk is clear."},{"title":"Destructive Server Actions Lack Authorization in Template","category":"authorization","severity":"medium","locations":[{"file":"templates/server-action-template.ts","line_end":117,"line_start":110},{"file":"templates/server-action-template.ts","line_end":161,"line_start":151}],"confidence":0.78,"description":"The delete and bulk update Server Action examples mutate records by id without the same session and ownership checks shown in the update example. Copied as-is, this can teach insecure authorization patterns.","remediation":"Mirror the ownership checks used in updateResource for deleteResource, toggleComplete, and bulkUpdateResources.","confidence_reasoning":"The mutation examples are concrete and lack visible authorization checks in the cited blocks. They are templates, not active marketplace code, so the risk is educational rather than direct compromise."}],"low_findings":[{"title":"Static Command Findings Are Markdown and Framework Syntax","category":"false_positive","severity":"low","locations":[{"file":"SKILL.md","line_end":58,"line_start":45},{"file":"checklists/rsc-implementation-checklist.md","line_end":18,"line_start":8}],"confidence":0.91,"description":"The reported Ruby or shell backtick execution findings are mostly inline markdown code spans, JSX template literals, and framework snippets. They are not invoked by install scripts or runtime automation in this skill.","remediation":"No code change is required for execution risk, but clearer labels for examples can reduce scanner noise.","confidence_reasoning":"The cited lines are documentation bullets and fenced examples. I did not find evidence that the skill executes shell commands from these strings."},{"title":"Environment and Network Examples Use Placeholder Endpoints","category":"secret_handling","severity":"low","locations":[{"file":"references/component-patterns.md","line_end":63,"line_start":57}],"confidence":0.74,"description":"The environment-variable and fetch findings occur in server-component examples that show how to call an API with a server-side secret. This is a legitimate framework pattern, but users should avoid logging or returning secrets.","remediation":"Keep the server-only warning and add a note not to pass secret values to Client Components or rendered props.","confidence_reasoning":"The example intentionally demonstrates server-only secret use with api.example.com. It is not exfiltration, but it is security-sensitive guidance that should remain clearly server-only."},{"title":"Browser Storage Example Parses Local Data","category":"browser_storage","severity":"low","locations":[{"file":"templates/client-component-template.tsx","line_end":33,"line_start":27}],"confidence":0.69,"description":"The Client Component template reads localStorage and parses JSON. This is normal client-side behavior, but copied code should handle parse failures and avoid storing sensitive data in browser storage.","remediation":"Wrap JSON.parse in error handling and document that secrets should not be stored in localStorage.","confidence_reasoning":"The browser API usage is explicit and limited to an example. The main concern is missing defensive parsing and storage guidance, not malicious data collection."}],"dangerous_patterns":[{"title":"Static Dangerous Combination Dismissed After Context Review","category":"heuristic_false_positive","severity":"low","locations":[{"file":"references/component-patterns.md","line_end":63,"line_start":57},{"file":"templates/client-component-template.tsx","line_end":41,"line_start":27},{"file":"SKILL.md","line_end":58,"line_start":45}],"confidence":0.88,"description":"The scanner combined code execution, network, and credential-access indicators into a critical heuristic. Context review found these indicators distributed across documentation and templates, with no hidden script, installer, or exfiltration flow tying them together.","remediation":"Treat the skill as medium risk due to copyable insecure examples, not as blocked malware.","confidence_reasoning":"The underlying patterns exist, but they appear in educational examples and framework documentation. I did not find semantic evidence of a combined malicious behavior chain."}],"files_scanned":11,"total_lines":2709,"audit_model":"codex","audited_at":"2026-06-28T10:26:53.88+00:00","created_at":"2026-06-28T11:01:59.631798+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":3,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}