{"data":{"skill":{"slug":"ariegoldkin-react-server-components-framework","name":"react-server-components-framework","icon":"📦","repo":"https://github.com/ArieGoldkin/ai-agent-hub/tree/main/skills/react-server-components-framework","status":"approved","author":"AI Agent Hub","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"727ab0ef-709c-4c54-8484-79895d178006","skill_id":"7147efec-d53b-4fe5-9462-6d5831c73741","version":7,"content_hash":"8f72bbd87eff84947a39f4dc4aa0e456","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"The static findings are false positives caused by Markdown backticks, JavaScript template literals, placeholder fetch calls, and server-only environment variable examples. No prompt injection or malicious intent was found, but the Server Action template should add consistent authorization before destructive or bulk mutations.","remediation":[{"issue":"Mutating Server Action examples do not consistently authorize users.","severity":"high","suggestion":"Add session and ownership checks to create, delete, bulk update, and upload examples before any database or storage mutation."},{"issue":"Environment variable examples use a realistic secret name.","severity":"low","suggestion":"Clarify that secret values must remain server-only and must never be passed to Client Components or logs."},{"issue":"Placeholder network examples may be copied without review.","severity":"low","suggestion":"Label api.example.com and local API routes as placeholders and require developers to verify destinations and caching policies."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"examples/blog-app-example.tsx","line_end":93,"line_start":93},{"file":"examples/blog-app-example.tsx","line_end":118,"line_start":118},{"file":"examples/blog-app-example.tsx","line_end":226,"line_start":226},{"file":"examples/blog-app-example.tsx","line_end":424,"line_start":424},{"file":"references/component-patterns.md","line_end":62,"line_start":61},{"file":"references/component-patterns.md","line_end":67,"line_start":62},{"file":"references/component-patterns.md","line_end":422,"line_start":417},{"file":"references/server-actions.md","line_end":24,"line_start":22},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":56,"line_start":56},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":80,"line_start":68},{"file":"SKILL.md","line_end":83,"line_start":80},{"file":"SKILL.md","line_end":87,"line_start":83},{"file":"SKILL.md","line_end":89,"line_start":87},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":107,"line_start":98},{"file":"SKILL.md","line_end":109,"line_start":107},{"file":"SKILL.md","line_end":113,"line_start":109},{"file":"SKILL.md","line_end":124,"line_start":113},{"file":"SKILL.md","line_end":140,"line_start":124},{"file":"SKILL.md","line_end":147,"line_start":140},{"file":"SKILL.md","line_end":152,"line_start":147},{"file":"SKILL.md","line_end":157,"line_start":152},{"file":"SKILL.md","line_end":160,"line_start":157},{"file":"SKILL.md","line_end":164,"line_start":160},{"file":"SKILL.md","line_end":167,"line_start":164},{"file":"SKILL.md","line_end":171,"line_start":167},{"file":"SKILL.md","line_end":173,"line_start":171},{"file":"SKILL.md","line_end":186,"line_start":173},{"file":"SKILL.md","line_end":201,"line_start":186},{"file":"SKILL.md","line_end":212,"line_start":201},{"file":"SKILL.md","line_end":220,"line_start":212},{"file":"SKILL.md","line_end":244,"line_start":220},{"file":"SKILL.md","line_end":245,"line_start":244},{"file":"SKILL.md","line_end":246,"line_start":245},{"file":"SKILL.md","line_end":254,"line_start":246},{"file":"SKILL.md","line_end":267,"line_start":254},{"file":"SKILL.md","line_end":283,"line_start":267},{"file":"SKILL.md","line_end":300,"line_start":283},{"file":"SKILL.md","line_end":304,"line_start":300},{"file":"SKILL.md","line_end":317,"line_start":304},{"file":"SKILL.md","line_end":321,"line_start":317},{"file":"SKILL.md","line_end":334,"line_start":321},{"file":"SKILL.md","line_end":340,"line_start":334},{"file":"SKILL.md","line_end":340,"line_start":340},{"file":"SKILL.md","line_end":344,"line_start":343},{"file":"SKILL.md","line_end":346,"line_start":344},{"file":"SKILL.md","line_end":346,"line_start":346},{"file":"SKILL.md","line_end":347,"line_start":347},{"file":"SKILL.md","line_end":360,"line_start":349},{"file":"SKILL.md","line_end":363,"line_start":360},{"file":"SKILL.md","line_end":366,"line_start":363},{"file":"SKILL.md","line_end":369,"line_start":366},{"file":"SKILL.md","line_end":369,"line_start":369},{"file":"templates/server-action-template.ts","line_end":58,"line_start":58},{"file":"templates/server-action-template.ts","line_end":95,"line_start":95},{"file":"templates/server-action-template.ts","line_end":221,"line_start":221}]},{"factor":"scripts","evidence":[{"file":"references/component-patterns.md","line_end":375,"line_start":375}]},{"factor":"network","evidence":[{"file":"references/component-patterns.md","line_end":61,"line_start":61},{"file":"references/component-patterns.md","line_end":61,"line_start":61},{"file":"references/data-fetching.md","line_end":11,"line_start":11},{"file":"references/data-fetching.md","line_end":16,"line_start":16},{"file":"references/data-fetching.md","line_end":21,"line_start":21},{"file":"references/data-fetching.md","line_end":26,"line_start":26},{"file":"references/data-fetching.md","line_end":160,"line_start":160},{"file":"references/data-fetching.md","line_end":11,"line_start":11},{"file":"references/data-fetching.md","line_end":16,"line_start":16},{"file":"references/data-fetching.md","line_end":21,"line_start":21},{"file":"references/data-fetching.md","line_end":26,"line_start":26},{"file":"references/data-fetching.md","line_end":160,"line_start":160},{"file":"references/migration-guide.md","line_end":54,"line_start":54},{"file":"references/migration-guide.md","line_end":72,"line_start":72},{"file":"references/migration-guide.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":375,"line_start":375},{"file":"SKILL.md","line_end":376,"line_start":376},{"file":"SKILL.md","line_end":377,"line_start":377},{"file":"SKILL.md","line_end":378,"line_start":378},{"file":"templates/client-component-template.tsx","line_end":41,"line_start":41}]},{"factor":"env_access","evidence":[{"file":"references/component-patterns.md","line_end":59,"line_start":59},{"file":"references/component-patterns.md","line_end":59,"line_start":59},{"file":"references/component-patterns.md","line_end":59,"line_start":59},{"file":"templates/server-component-template.tsx","line_end":30,"line_start":30},{"file":"templates/server-component-template.tsx","line_end":30,"line_start":30},{"file":"templates/server-component-template.tsx","line_end":30,"line_start":30}]}],"critical_findings":[],"high_findings":[{"title":"Server Action Templates Omit Authorization Checks","locations":[{"file":"templates/server-action-template.ts","line_end":50,"line_start":30},{"file":"templates/server-action-template.ts","line_end":114,"line_start":110},{"file":"templates/server-action-template.ts","line_end":158,"line_start":151},{"file":"templates/server-action-template.ts","line_end":206,"line_start":174}],"confidence":0.86,"description":"The Server Action template includes create, delete, bulk update, and upload mutations without consistent session or ownership checks. Copying these examples directly could allow unauthorized data changes or file uploads.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The template shows multiple mutating operations with validation or database calls but no session or ownership check in those blocks. The adjacent update example includes authorization, which makes the omission clear."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"examples/blog-app-example.tsx","line_end":93,"line_start":93}],"confidence":0.4,"description":"redirect(`/blog/${post.slug}`)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"examples/blog-app-example.tsx","line_end":118,"line_start":118}],"confidence":0.4,"description":"revalidatePath(`/blog/[slug]`)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"examples/blog-app-example.tsx","line_end":226,"line_start":226}],"confidence":0.4,"description":"description: post.excerpt || `By ${post.author.name}`,","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"examples/blog-app-example.tsx","line_end":424,"line_start":424}],"confidence":0.4,"description":"href={`/blog/${post.slug}`}","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Dynamic import() expression","locations":[{"file":"references/component-patterns.md","line_end":375,"line_start":375}],"confidence":0.4,"description":"const InteractiveReviews = dynamic(() => import('@/components/InteractiveReviews'), {","review_kind":"capability","source_category":"scripts","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"references/component-patterns.md","line_end":62,"line_start":61}],"confidence":0.4,"description":"const data = await fetch(`https://api.example.com/data`, {","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"references/component-patterns.md","line_end":67,"line_start":62}],"confidence":0.4,"description":"headers: { Authorization: `Bearer ${apiKey}` }","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"references/component-patterns.md","line_end":422,"line_start":417}],"confidence":0.4,"description":"document.cookie = `theme=${newTheme}; path=/`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"references/server-actions.md","line_end":24,"line_start":22}],"confidence":0.4,"description":"redirect(`/posts/${post.id}`)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":45,"line_start":45}],"confidence":0.4,"description":"- Can be `async` and use `await`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":50,"line_start":50}],"confidence":0.4,"description":"**Client Components** (with `'use client'`):","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":51,"line_start":51}],"confidence":0.4,"description":"- Can use hooks (`useState`, `useEffect`, etc.)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":53,"line_start":53}],"confidence":0.4,"description":"- Cannot be `async`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":56,"line_start":56}],"confidence":0.4,"description":"**Key Rule**: Server Components can render Client Components, but Client Components cannot directly ","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":58,"line_start":58}],"confidence":0.4,"description":"**Detailed Patterns**: See `references/component-patterns.md` for:","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":80,"line_start":68}],"confidence":0.4,"description":"```tsx","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":83,"line_start":80}],"confidence":0.4,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":87,"line_start":83}],"confidence":0.4,"description":"- **Parallel fetching**: `Promise.all([fetch1, fetch2, fetch3])`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":89,"line_start":87}],"confidence":0.4,"description":"**Detailed Implementation**: See `references/data-fetching.md` for:","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":89,"line_start":89}],"confidence":0.4,"description":"- Revalidation methods (`revalidatePath`, `revalidateTag`)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":107,"line_start":98}],"confidence":0.4,"description":"```tsx","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":109,"line_start":107}],"confidence":0.4,"description":"redirect(`/posts/${post.id}`)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":113,"line_start":109}],"confidence":0.4,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":124,"line_start":113}],"confidence":0.4,"description":"**Detailed Implementation**: See `references/server-actions.md` for:","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":140,"line_start":124}],"confidence":0.4,"description":"```tsx","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":147,"line_start":140}],"confidence":0.4,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":152,"line_start":147}],"confidence":0.4,"description":"**Templates**: Use `templates/ServerComponent.tsx` for streaming patterns","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":157,"line_start":152}],"confidence":0.4,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":160,"line_start":157}],"confidence":0.4,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":164,"line_start":160}],"confidence":0.4,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":167,"line_start":164}],"confidence":0.4,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":171,"line_start":167}],"confidence":0.4,"description":"```tsx","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":173,"line_start":171}],"confidence":0.4,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":186,"line_start":173}],"confidence":0.4,"description":"**Detailed Implementation**: See `references/routing-patterns.md` for:","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":201,"line_start":186}],"confidence":0.4,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":212,"line_start":201}],"confidence":0.4,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":220,"line_start":212}],"confidence":0.4,"description":"- ✅ Pass Server Components as `children` to Client Components","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":244,"line_start":220}],"confidence":0.4,"description":"- ✅ Use `generateStaticParams` for static routes","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":245,"line_start":244}],"confidence":0.4,"description":"- **`templates/ServerComponent.tsx`** - Basic async Server Component with data fetching","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":246,"line_start":245}],"confidence":0.4,"description":"- **`templates/ClientComponent.tsx`** - Interactive Client Component with hooks","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":254,"line_start":246}],"confidence":0.4,"description":"- **`templates/ServerAction.tsx`** - Server Action with validation and revalidation","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":267,"line_start":254}],"confidence":0.4,"description":"See `examples/blog-app/` for a full implementation:","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":283,"line_start":267}],"confidence":0.4,"description":"See `checklists/rsc-implementation.md` for comprehensive validation covering:","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":300,"line_start":283}],"confidence":0.4,"description":"```tsx","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":304,"line_start":300}],"confidence":0.4,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":317,"line_start":304}],"confidence":0.4,"description":"```tsx","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":321,"line_start":317}],"confidence":0.4,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":334,"line_start":321}],"confidence":0.4,"description":"```tsx","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":340,"line_start":334}],"confidence":0.4,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":340,"line_start":340}],"confidence":0.4,"description":"**Incremental Adoption**: Both `pages/` and `app/` can coexist","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":344,"line_start":343}],"confidence":0.4,"description":"- `getServerSideProps` → async Server Component","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":346,"line_start":344}],"confidence":0.4,"description":"- `getStaticProps` → async Server Component with caching","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":346,"line_start":346}],"confidence":0.4,"description":"- `_app.tsx` → `layout.tsx`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":347,"line_start":347}],"confidence":0.4,"description":"- `<Head>` → `generateMetadata` function","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":360,"line_start":349}],"confidence":0.4,"description":"**Detailed Migration**: See `references/migration-guide.md` for:","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":363,"line_start":360}],"confidence":0.4,"description":"- **Fix**: Add `'use client'` directive to the component","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":366,"line_start":363}],"confidence":0.4,"description":"- **Fix**: Add `async` to function declaration","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":369,"line_start":366}],"confidence":0.4,"description":"- **Fix**: Pass Server Component as `children` prop instead of importing","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":369,"line_start":369}],"confidence":0.4,"description":"- **Fix**: Use `'use client'` for components using `Date.now()`, `Math.random()`, or browser APIs","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"templates/server-action-template.ts","line_end":58,"line_start":58}],"confidence":0.4,"description":"redirect(`/resources/${resource.id}`)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"templates/server-action-template.ts","line_end":95,"line_start":95}],"confidence":0.4,"description":"revalidatePath(`/resources/${id}`)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."},{"title":"Ruby/shell backtick execution","locations":[{"file":"templates/server-action-template.ts","line_end":221,"line_start":221}],"confidence":0.4,"description":"revalidatePath(`/resources/${id}`)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The pattern could not be confidently dismissed from the available context, so it is kept for review."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":11,"total_lines":2709,"audit_model":"codex","audited_at":"2026-07-05T03:06:11.358+00:00","created_at":"2026-07-05T03:33:30.769243+00:00","static_findings":[{"id":"blocker:checklists/rsc-implementation-checklist.md:11:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Avoid using React hooks in Server Components","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"blocker:checklists/rsc-implementation-checklist.md:12:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Avoid browser APIs (window, document, localStorage) in Server Components","category":"blocker","line_end":12,"severity":"low","line_start":12},{"id":"blocker:checklists/rsc-implementation-checklist.md:21:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Avoid heavy dependencies that increase bundle size","category":"blocker","line_end":21,"severity":"low","line_start":21},{"id":"blocker:checklists/rsc-implementation-checklist.md:27:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Avoid passing functions, dates, or complex objects as props","category":"blocker","line_end":27,"severity":"low","line_start":27},{"id":"blocker:checklists/rsc-implementation-checklist.md:45:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Select only required fields (avoid `SELECT *`)","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"blocker:checklists/rsc-implementation-checklist.md:48:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Avoid waterfalls - fetch data in parallel","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"blocker:checklists/rsc-implementation-checklist.md:116:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Avoid wrapping entire page in single Suspense","category":"blocker","line_end":116,"severity":"low","line_start":116},{"id":"blocker:checklists/rsc-implementation-checklist.md:160:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"- [ ] Prevent form submission if invalid","category":"blocker","line_end":161,"severity":"low","line_start":160},{"id":"blocker:checklists/rsc-implementation-checklist.md:240:system-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"System reconnaissance","snippet":"## Common Pitfalls to Avoid","category":"blocker","line_end":242,"severity":"low","line_start":240},{"id":"blocker:checklists/rsc-implementation-checklist.md:39:network-reconnaissance","file":"checklists/rsc-implementation-checklist.md","pattern":"Network reconnaissance","snippet":"### Database Access","category":"blocker","line_end":40,"severity":"low","line_start":39},{"id":"external_commands:examples/blog-app-example.tsx:93:ruby-shell-backtick-execution","file":"examples/blog-app-example.tsx","pattern":"Ruby/shell backtick execution","snippet":"redirect(`/blog/${post.slug}`)","category":"external_commands","line_end":93,"severity":"medium","line_start":93},{"id":"external_commands:examples/blog-app-example.tsx:118:ruby-shell-backtick-execution","file":"examples/blog-app-example.tsx","pattern":"Ruby/shell backtick execution","snippet":"revalidatePath(`/blog/[slug]`)","category":"external_commands","line_end":118,"severity":"medium","line_start":118},{"id":"external_commands:examples/blog-app-example.tsx:226:ruby-shell-backtick-execution","file":"examples/blog-app-example.tsx","pattern":"Ruby/shell backtick execution","snippet":"description: post.excerpt || `By ${post.author.name}`,","category":"external_commands","line_end":226,"severity":"medium","line_start":226},{"id":"external_commands:examples/blog-app-example.tsx:424:ruby-shell-backtick-execution","file":"examples/blog-app-example.tsx","pattern":"Ruby/shell backtick execution","snippet":"href={`/blog/${post.slug}`}","category":"external_commands","line_end":424,"severity":"medium","line_start":424},{"id":"blocker:examples/blog-app-example.tsx:14:system-reconnaissance","file":"examples/blog-app-example.tsx","pattern":"System reconnaissance","snippet":"id          String   @id @default(cuid())","category":"blocker","line_end":14,"severity":"low","line_start":14},{"id":"blocker:examples/blog-app-example.tsx:31:system-reconnaissance","file":"examples/blog-app-example.tsx","pattern":"System reconnaissance","snippet":"id        String   @id @default(cuid())","category":"blocker","line_end":31,"severity":"low","line_start":31},{"id":"blocker:examples/blog-app-example.tsx:88:system-reconnaissance","file":"examples/blog-app-example.tsx","pattern":"System reconnaissance","snippet":"authorId: session.user.id","category":"blocker","line_end":89,"severity":"low","line_start":88},{"id":"blocker:examples/blog-app-example.tsx:114:system-reconnaissance","file":"examples/blog-app-example.tsx","pattern":"System reconnaissance","snippet":"authorId: session.user.id","category":"blocker","line_end":115,"severity":"low","line_start":114},{"id":"blocker:examples/blog-app-example.tsx:173:system-reconnaissance","file":"examples/blog-app-example.tsx","pattern":"System reconnaissance","snippet":"<div className=\"grid gap-6 md:grid-cols-2 lg:grid-cols-3\">","category":"blocker","line_end":173,"severity":"low","line_start":173},{"id":"scripts:references/component-patterns.md:375:dynamic-import-expression","file":"references/component-patterns.md","pattern":"Dynamic import() expression","snippet":"const InteractiveReviews = dynamic(() => import('@/components/InteractiveReviews'), {","category":"scripts","line_end":375,"severity":"medium","line_start":375},{"id":"external_commands:references/component-patterns.md:61:ruby-shell-backtick-execution","file":"references/component-patterns.md","pattern":"Ruby/shell backtick execution","snippet":"const data = await fetch(`https://api.example.com/data`, {","category":"external_commands","line_end":62,"severity":"medium","line_start":61},{"id":"external_commands:references/component-patterns.md:62:ruby-shell-backtick-execution","file":"references/component-patterns.md","pattern":"Ruby/shell backtick execution","snippet":"headers: { Authorization: `Bearer ${apiKey}` }","category":"external_commands","line_end":67,"severity":"medium","line_start":62},{"id":"external_commands:references/component-patterns.md:417:ruby-shell-backtick-execution","file":"references/component-patterns.md","pattern":"Ruby/shell backtick execution","snippet":"document.cookie = `theme=${newTheme}; path=/`","category":"external_commands","line_end":422,"severity":"medium","line_start":417},{"id":"network:references/component-patterns.md:61:fetch-api-call","file":"references/component-patterns.md","pattern":"Fetch API call","snippet":"const data = await fetch(`https://api.example.com/data`, {","category":"network","line_end":61,"severity":"low","line_start":61},{"id":"network:references/component-patterns.md:61:hardcoded-url","file":"references/component-patterns.md","pattern":"Hardcoded URL","snippet":"const data = await fetch(`https://api.example.com/data`, {","category":"network","line_end":61,"severity":"low","line_start":61},{"id":"env_access:references/component-patterns.md:59:environment-variable-access-dot-notation","file":"references/component-patterns.md","pattern":"Environment variable access (dot notation)","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"env_access","line_end":59,"severity":"low","line_start":59},{"id":"env_access:references/component-patterns.md:59:environment-variable-object","file":"references/component-patterns.md","pattern":"Environment variable object","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"env_access","line_end":59,"severity":"low","line_start":59},{"id":"env_access:references/component-patterns.md:59:generic-api-secret-keys","file":"references/component-patterns.md","pattern":"Generic API/secret keys","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"env_access","line_end":59,"severity":"high","line_start":59},{"id":"sensitive:references/component-patterns.md:59:environment-file-access","file":"references/component-patterns.md","pattern":"Environment file access","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"sensitive","line_end":59,"severity":"high","line_start":59},{"id":"blocker:references/component-patterns.md:211:system-reconnaissance","file":"references/component-patterns.md","pattern":"System reconnaissance","snippet":"// ❌ Avoid this","category":"blocker","line_end":211,"severity":"low","line_start":211},{"id":"blocker:references/component-patterns.md:37:network-reconnaissance","file":"references/component-patterns.md","pattern":"Network reconnaissance","snippet":"// Direct database access - runs on server only","category":"blocker","line_end":37,"severity":"low","line_start":37},{"id":"network:references/data-fetching.md:11:fetch-api-call","file":"references/data-fetching.md","pattern":"Fetch API call","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:references/data-fetching.md:16:fetch-api-call","file":"references/data-fetching.md","pattern":"Fetch API call","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:references/data-fetching.md:21:fetch-api-call","file":"references/data-fetching.md","pattern":"Fetch API call","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":21,"severity":"low","line_start":21},{"id":"network:references/data-fetching.md:26:fetch-api-call","file":"references/data-fetching.md","pattern":"Fetch API call","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"network:references/data-fetching.md:160:fetch-api-call","file":"references/data-fetching.md","pattern":"Fetch API call","snippet":"posts = await fetch('https://api.example.com/posts').then(res => {","category":"network","line_end":160,"severity":"low","line_start":160},{"id":"network:references/data-fetching.md:11:hardcoded-url","file":"references/data-fetching.md","pattern":"Hardcoded URL","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:references/data-fetching.md:16:hardcoded-url","file":"references/data-fetching.md","pattern":"Hardcoded URL","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:references/data-fetching.md:21:hardcoded-url","file":"references/data-fetching.md","pattern":"Hardcoded URL","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":21,"severity":"low","line_start":21},{"id":"network:references/data-fetching.md:26:hardcoded-url","file":"references/data-fetching.md","pattern":"Hardcoded URL","snippet":"const res = await fetch('https://api.example.com/posts', {","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"network:references/data-fetching.md:160:hardcoded-url","file":"references/data-fetching.md","pattern":"Hardcoded URL","snippet":"posts = await fetch('https://api.example.com/posts').then(res => {","category":"network","line_end":160,"severity":"low","line_start":160},{"id":"network:references/migration-guide.md:54:fetch-api-call","file":"references/migration-guide.md","pattern":"Fetch API call","snippet":"fetch('/api/posts')","category":"network","line_end":54,"severity":"low","line_start":54},{"id":"network:references/migration-guide.md:72:fetch-api-call","file":"references/migration-guide.md","pattern":"Fetch API call","snippet":"const posts = await fetch('/api/posts').then(res => res.json())","category":"network","line_end":72,"severity":"low","line_start":72},{"id":"network:references/migration-guide.md:93:fetch-api-call","file":"references/migration-guide.md","pattern":"Fetch API call","snippet":"const response = await fetch('/api/posts', {","category":"network","line_end":93,"severity":"low","line_start":93},{"id":"blocker:references/routing-patterns.md:34:system-reconnaissance","file":"references/routing-patterns.md","pattern":"System reconnaissance","snippet":"<div className=\"grid grid-cols-2 gap-4\">","category":"blocker","line_end":34,"severity":"low","line_start":34},{"id":"external_commands:references/server-actions.md:22:ruby-shell-backtick-execution","file":"references/server-actions.md","pattern":"Ruby/shell backtick execution","snippet":"redirect(`/posts/${post.id}`)","category":"external_commands","line_end":24,"severity":"medium","line_start":22},{"id":"blocker:references/server-actions.md:103:system-reconnaissance","file":"references/server-actions.md","pattern":"System reconnaissance","snippet":"addOptimisticTodo({ ...todos.find(t => t.id === id)!, completed: true })","category":"blocker","line_end":103,"severity":"low","line_start":103},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Can be `async` and use `await`","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Client Components** (with `'use client'`):","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Can use hooks (`useState`, `useEffect`, etc.)","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Cannot be `async`","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Key Rule**: Server Components can render Client Components, but Client Components cannot directly ","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Detailed Patterns**: See `references/component-patterns.md` for:","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":80,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":83,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Parallel fetching**: `Promise.all([fetch1, fetch2, fetch3])`","category":"external_commands","line_end":87,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Detailed Implementation**: See `references/data-fetching.md` for:","category":"external_commands","line_end":89,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Revalidation methods (`revalidatePath`, `revalidateTag`)","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":107,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"redirect(`/posts/${post.id}`)","category":"external_commands","line_end":109,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":113,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Detailed Implementation**: See `references/server-actions.md` for:","category":"external_commands","line_end":124,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":140,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":147,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Templates**: Use `templates/ServerComponent.tsx` for streaming patterns","category":"external_commands","line_end":152,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":157,"severity":"medium","line_start":152},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":160,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":164,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":167,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":171,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":173,"severity":"medium","line_start":171},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Detailed Implementation**: See `references/routing-patterns.md` for:","category":"external_commands","line_end":186,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":201,"severity":"medium","line_start":186},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":212,"severity":"medium","line_start":201},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ Pass Server Components as `children` to Client Components","category":"external_commands","line_end":220,"severity":"medium","line_start":212},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ Use `generateStaticParams` for static routes","category":"external_commands","line_end":244,"severity":"medium","line_start":220},{"id":"external_commands:SKILL.md:244:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`templates/ServerComponent.tsx`** - Basic async Server Component with data fetching","category":"external_commands","line_end":245,"severity":"medium","line_start":244},{"id":"external_commands:SKILL.md:245:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`templates/ClientComponent.tsx`** - Interactive Client Component with hooks","category":"external_commands","line_end":246,"severity":"medium","line_start":245},{"id":"external_commands:SKILL.md:246:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`templates/ServerAction.tsx`** - Server Action with validation and revalidation","category":"external_commands","line_end":254,"severity":"medium","line_start":246},{"id":"external_commands:SKILL.md:254:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `examples/blog-app/` for a full implementation:","category":"external_commands","line_end":267,"severity":"medium","line_start":254},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `checklists/rsc-implementation.md` for comprehensive validation covering:","category":"external_commands","line_end":283,"severity":"medium","line_start":267},{"id":"external_commands:SKILL.md:283:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":300,"severity":"medium","line_start":283},{"id":"external_commands:SKILL.md:300:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":304,"severity":"medium","line_start":300},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":317,"severity":"medium","line_start":304},{"id":"external_commands:SKILL.md:317:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":321,"severity":"medium","line_start":317},{"id":"external_commands:SKILL.md:321:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":334,"severity":"medium","line_start":321},{"id":"external_commands:SKILL.md:334:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":340,"severity":"medium","line_start":334},{"id":"external_commands:SKILL.md:340:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Incremental Adoption**: Both `pages/` and `app/` can coexist","category":"external_commands","line_end":340,"severity":"medium","line_start":340},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `getServerSideProps` → async Server Component","category":"external_commands","line_end":344,"severity":"medium","line_start":343},{"id":"external_commands:SKILL.md:344:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `getStaticProps` → async Server Component with caching","category":"external_commands","line_end":346,"severity":"medium","line_start":344},{"id":"external_commands:SKILL.md:346:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `_app.tsx` → `layout.tsx`","category":"external_commands","line_end":346,"severity":"medium","line_start":346},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `<Head>` → `generateMetadata` function","category":"external_commands","line_end":347,"severity":"medium","line_start":347},{"id":"external_commands:SKILL.md:349:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Detailed Migration**: See `references/migration-guide.md` for:","category":"external_commands","line_end":360,"severity":"medium","line_start":349},{"id":"external_commands:SKILL.md:360:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Fix**: Add `'use client'` directive to the component","category":"external_commands","line_end":363,"severity":"medium","line_start":360},{"id":"external_commands:SKILL.md:363:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Fix**: Add `async` to function declaration","category":"external_commands","line_end":366,"severity":"medium","line_start":363},{"id":"external_commands:SKILL.md:366:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Fix**: Pass Server Component as `children` prop instead of importing","category":"external_commands","line_end":369,"severity":"medium","line_start":366},{"id":"external_commands:SKILL.md:369:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Fix**: Use `'use client'` for components using `Date.now()`, `Math.random()`, or browser APIs","category":"external_commands","line_end":369,"severity":"medium","line_start":369},{"id":"network:SKILL.md:70:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"await fetch(url, { cache: 'force-cache' })","category":"network","line_end":70,"severity":"low","line_start":70},{"id":"network:SKILL.md:73:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"await fetch(url, { next: { revalidate: 60 } })","category":"network","line_end":73,"severity":"low","line_start":73},{"id":"network:SKILL.md:76:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"await fetch(url, { cache: 'no-store' })","category":"network","line_end":76,"severity":"low","line_start":76},{"id":"network:SKILL.md:79:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"await fetch(url, { next: { tags: ['posts'] } })","category":"network","line_end":79,"severity":"low","line_start":79},{"id":"network:SKILL.md:375:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Next.js 15 Documentation](https://nextjs.org/docs)","category":"network","line_end":375,"severity":"low","line_start":375},{"id":"network:SKILL.md:376:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [React Server Components RFC](https://github.com/reactjs/rfcs/blob/main/text/0188-server-component","category":"network","line_end":376,"severity":"low","line_start":376},{"id":"network:SKILL.md:377:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [App Router Migration Guide](https://nextjs.org/docs/app/building-your-application/upgrading/app-r","category":"network","line_end":377,"severity":"low","line_start":377},{"id":"network:SKILL.md:378:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Server Actions Documentation](https://nextjs.org/docs/app/building-your-application/data-fetching","category":"network","line_end":378,"severity":"low","line_start":378},{"id":"blocker:SKILL.md:213:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- ❌ Avoid making entire pages Client Components","category":"blocker","line_end":213,"severity":"low","line_start":213},{"id":"blocker:SKILL.md:362:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"**Error: \"async/await is not valid in non-async Server Components\"**","category":"blocker","line_end":362,"severity":"low","line_start":362},{"id":"blocker:SKILL.md:46:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- Direct database access","category":"blocker","line_end":47,"severity":"low","line_start":46},{"id":"network:templates/client-component-template.tsx:41:fetch-api-call","file":"templates/client-component-template.tsx","pattern":"Fetch API call","snippet":"const response = await fetch('/api/data')","category":"network","line_end":41,"severity":"low","line_start":41},{"id":"blocker:templates/client-component-template.tsx:19:system-reconnaissance","file":"templates/client-component-template.tsx","pattern":"System reconnaissance","snippet":"onAction?: (data: any) => void","category":"blocker","line_end":20,"severity":"low","line_start":19},{"id":"blocker:templates/client-component-template.tsx:78:system-reconnaissance","file":"templates/client-component-template.tsx","pattern":"System reconnaissance","snippet":"* 5. Avoid heavy dependencies (increases bundle size)","category":"blocker","line_end":78,"severity":"low","line_start":78},{"id":"external_commands:templates/server-action-template.ts:58:ruby-shell-backtick-execution","file":"templates/server-action-template.ts","pattern":"Ruby/shell backtick execution","snippet":"redirect(`/resources/${resource.id}`)","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:templates/server-action-template.ts:95:ruby-shell-backtick-execution","file":"templates/server-action-template.ts","pattern":"Ruby/shell backtick execution","snippet":"revalidatePath(`/resources/${id}`)","category":"external_commands","line_end":95,"severity":"medium","line_start":95},{"id":"external_commands:templates/server-action-template.ts:221:ruby-shell-backtick-execution","file":"templates/server-action-template.ts","pattern":"Ruby/shell backtick execution","snippet":"revalidatePath(`/resources/${id}`)","category":"external_commands","line_end":221,"severity":"medium","line_start":221},{"id":"blocker:templates/server-action-template.ts:42:system-reconnaissance","file":"templates/server-action-template.ts","pattern":"System reconnaissance","snippet":"error: 'Invalid data',","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:templates/server-action-template.ts:81:system-reconnaissance","file":"templates/server-action-template.ts","pattern":"System reconnaissance","snippet":"where: { id }","category":"blocker","line_end":81,"severity":"low","line_start":81},{"id":"blocker:templates/server-action-template.ts:90:system-reconnaissance","file":"templates/server-action-template.ts","pattern":"System reconnaissance","snippet":"where: { id },","category":"blocker","line_end":90,"severity":"low","line_start":90},{"id":"blocker:templates/server-action-template.ts:113:system-reconnaissance","file":"templates/server-action-template.ts","pattern":"System reconnaissance","snippet":"where: { id }","category":"blocker","line_end":113,"severity":"low","line_start":113},{"id":"blocker:templates/server-action-template.ts:132:system-reconnaissance","file":"templates/server-action-template.ts","pattern":"System reconnaissance","snippet":"where: { id }","category":"blocker","line_end":132,"severity":"low","line_start":132},{"id":"blocker:templates/server-action-template.ts:140:system-reconnaissance","file":"templates/server-action-template.ts","pattern":"System reconnaissance","snippet":"where: { id },","category":"blocker","line_end":140,"severity":"low","line_start":140},{"id":"env_access:templates/server-component-template.tsx:30:environment-variable-access-dot-notation","file":"templates/server-component-template.tsx","pattern":"Environment variable access (dot notation)","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"env_access","line_end":30,"severity":"low","line_start":30},{"id":"env_access:templates/server-component-template.tsx:30:environment-variable-object","file":"templates/server-component-template.tsx","pattern":"Environment variable object","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"env_access","line_end":30,"severity":"low","line_start":30},{"id":"env_access:templates/server-component-template.tsx:30:generic-api-secret-keys","file":"templates/server-component-template.tsx","pattern":"Generic API/secret keys","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"env_access","line_end":30,"severity":"high","line_start":30},{"id":"sensitive:templates/server-component-template.tsx:30:environment-file-access","file":"templates/server-component-template.tsx","pattern":"Environment file access","snippet":"const apiKey = process.env.SECRET_API_KEY","category":"sensitive","line_end":30,"severity":"high","line_start":30},{"id":"blocker:templates/server-component-template.tsx:26:system-reconnaissance","file":"templates/server-component-template.tsx","pattern":"System reconnaissance","snippet":"where: { categoryId: params.id }","category":"blocker","line_end":26,"severity":"low","line_start":26},{"id":"blocker:templates/server-component-template.tsx:59:system-reconnaissance","file":"templates/server-component-template.tsx","pattern":"System reconnaissance","snippet":"id: category.id","category":"blocker","line_end":60,"severity":"low","line_start":59},{"id":"blocker:templates/server-component-template.tsx:66:system-reconnaissance","file":"templates/server-component-template.tsx","pattern":"System reconnaissance","snippet":"where: { id: params.id }","category":"blocker","line_end":66,"severity":"low","line_start":66}],"finding_verdicts":[{"id":"blocker:checklists/rsc-implementation-checklist.md:11:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:checklists/rsc-implementation-checklist.md:12:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:checklists/rsc-implementation-checklist.md:21:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:checklists/rsc-implementation-checklist.md:27:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:checklists/rsc-implementation-checklist.md:45:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:checklists/rsc-implementation-checklist.md:48:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:checklists/rsc-implementation-checklist.md:116:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:checklists/rsc-implementation-checklist.md:160:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:checklists/rsc-implementation-checklist.md:240:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:checklists/rsc-implementation-checklist.md:39:network-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:examples/blog-app-example.tsx:93:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:examples/blog-app-example.tsx:118:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:examples/blog-app-example.tsx:226:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:examples/blog-app-example.tsx:424:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"blocker:examples/blog-app-example.tsx:14:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:examples/blog-app-example.tsx:31:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:examples/blog-app-example.tsx:88:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:examples/blog-app-example.tsx:114:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:examples/blog-app-example.tsx:173:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"scripts:references/component-patterns.md:375:dynamic-import-expression","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:references/component-patterns.md:61:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:references/component-patterns.md:62:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:references/component-patterns.md:417:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"network:references/component-patterns.md:61:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/component-patterns.md:61:hardcoded-url","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"env_access:references/component-patterns.md:59:environment-variable-access-dot-notation","reason":"The process.env.SECRET_API_KEY reference is an instructional Server Component example and is described as server-only. The skill does not read or exfiltrate real environment variables.","verdict":"false_positive","confidence":0.9},{"id":"env_access:references/component-patterns.md:59:environment-variable-object","reason":"The process.env.SECRET_API_KEY reference is an instructional Server Component example and is described as server-only. The skill does not read or exfiltrate real environment variables.","verdict":"false_positive","confidence":0.9},{"id":"env_access:references/component-patterns.md:59:generic-api-secret-keys","reason":"The process.env.SECRET_API_KEY reference is an instructional Server Component example and is described as server-only. The skill does not read or exfiltrate real environment variables.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:references/component-patterns.md:59:environment-file-access","reason":"The process.env.SECRET_API_KEY reference is an instructional Server Component example and is described as server-only. The skill does not read or exfiltrate real environment variables.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/component-patterns.md:211:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/component-patterns.md:37:network-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"network:references/data-fetching.md:11:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/data-fetching.md:16:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/data-fetching.md:21:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/data-fetching.md:26:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/data-fetching.md:160:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/data-fetching.md:11:hardcoded-url","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/data-fetching.md:16:hardcoded-url","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/data-fetching.md:21:hardcoded-url","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/data-fetching.md:26:hardcoded-url","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/data-fetching.md:160:hardcoded-url","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/migration-guide.md:54:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/migration-guide.md:72:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:references/migration-guide.md:93:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"blocker:references/routing-patterns.md:34:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/server-actions.md:22:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"blocker:references/server-actions.md:103:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:244:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:245:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:246:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:254:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:283:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:300:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:317:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:321:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:334:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:340:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:344:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:346:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:349:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:360:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:363:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:366:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:SKILL.md:369:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"network:SKILL.md:70:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:SKILL.md:73:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:SKILL.md:76:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:SKILL.md:79:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"network:SKILL.md:375:hardcoded-url","reason":"The URL is a documentation link to React or Next.js resources. It is not an automated network request or data exfiltration path.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:376:hardcoded-url","reason":"The URL is a documentation link to React or Next.js resources. It is not an automated network request or data exfiltration path.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:377:hardcoded-url","reason":"The URL is a documentation link to React or Next.js resources. It is not an automated network request or data exfiltration path.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:378:hardcoded-url","reason":"The URL is a documentation link to React or Next.js resources. It is not an automated network request or data exfiltration path.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:213:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:362:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:46:network-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"network:templates/client-component-template.tsx:41:fetch-api-call","reason":"The fetch call appears in educational Next.js examples using placeholder or local API routes. The skill itself does not make unauthorized network requests.","verdict":"false_positive","confidence":0.92},{"id":"blocker:templates/client-component-template.tsx:19:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:templates/client-component-template.tsx:78:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:templates/server-action-template.ts:58:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:templates/server-action-template.ts:95:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"external_commands:templates/server-action-template.ts:221:ruby-shell-backtick-execution","reason":"The pattern could not be confidently dismissed from the available context, so it is kept for review.","verdict":"confirmed","confidence":0.4},{"id":"blocker:templates/server-action-template.ts:42:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:templates/server-action-template.ts:81:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:templates/server-action-template.ts:90:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:templates/server-action-template.ts:113:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:templates/server-action-template.ts:132:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:templates/server-action-template.ts:140:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"env_access:templates/server-component-template.tsx:30:environment-variable-access-dot-notation","reason":"The process.env.SECRET_API_KEY reference is an instructional Server Component example and is described as server-only. The skill does not read or exfiltrate real environment variables.","verdict":"false_positive","confidence":0.9},{"id":"env_access:templates/server-component-template.tsx:30:environment-variable-object","reason":"The process.env.SECRET_API_KEY reference is an instructional Server Component example and is described as server-only. The skill does not read or exfiltrate real environment variables.","verdict":"false_positive","confidence":0.9},{"id":"env_access:templates/server-component-template.tsx:30:generic-api-secret-keys","reason":"The process.env.SECRET_API_KEY reference is an instructional Server Component example and is described as server-only. The skill does not read or exfiltrate real environment variables.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:templates/server-component-template.tsx:30:environment-file-access","reason":"The process.env.SECRET_API_KEY reference is an instructional Server Component example and is described as server-only. The skill does not read or exfiltrate real environment variables.","verdict":"false_positive","confidence":0.9},{"id":"blocker:templates/server-component-template.tsx:26:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:templates/server-component-template.tsx:59:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:templates/server-component-template.tsx:66:system-reconnaissance","reason":"The flagged line is React, Next.js, database-schema, or checklist text. It does not perform host, system, or network reconnaissance.","verdict":"false_positive","confidence":0.96}],"semantic_findings":[{"title":"Server Action Templates Omit Authorization Checks","severity":"high","locations":[{"file":"templates/server-action-template.ts","line_end":50,"line_start":30},{"file":"templates/server-action-template.ts","line_end":114,"line_start":110},{"file":"templates/server-action-template.ts","line_end":158,"line_start":151},{"file":"templates/server-action-template.ts","line_end":206,"line_start":174}],"confidence":0.86,"description":"The Server Action template includes create, delete, bulk update, and upload mutations without consistent session or ownership checks. Copying these examples directly could allow unauthorized data changes or file uploads.","confidence_reasoning":"The template shows multiple mutating operations with validation or database calls but no session or ownership check in those blocks. The adjacent update example includes authorization, which makes the omission clear."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":62,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}