{"data":{"skill":{"slug":"ariegoldkin-type-safety-validation","name":"type-safety-validation","icon":"📦","repo":"https://github.com/ArieGoldkin/ai-agent-hub/tree/main/skills/type-safety-validation","status":"approved","author":"AI Agent Hub","authorVersion":"1.0.0","skillstoreRevision":2},"audit":{"id":"8b457ad7-e850-4051-adfc-8ab9b624a9b0","skill_id":"62798d70-ca5b-4c1c-b87f-56b5c37d2722","version":10,"content_hash":"v3:89edfdc710d0846129dcee6a929477b04f08052c:c09b69cab4915c7a962bd7dc2e83c923d003c76633250da24dd68c74ed35746b:886fbbff5f3c31b616fdc61264ffea7e3514f378184ccf8b78ba16437c621166:736b696c6c732f61726965676f6c646b696e2f747970652d7361666574792d76616c69646174696f6e:3f322aa294b61e4c12ea9ff87576560d","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 36 static findings are false positives caused by Markdown syntax, TypeScript examples, sample URLs, relative imports, validation chains, and ordinary identifiers. One medium semantic issue remains: the examples expose database reads and writes without authentication or authorization.","remediation":[{"issue":"API examples expose user lookup and post creation without access control.","severity":"medium","suggestion":"Use authenticated procedures, enforce role and ownership checks, and explain authorization requirements before each database read or write."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":53,"line_start":27},{"file":"SKILL.md","line_end":56,"line_start":53},{"file":"SKILL.md","line_end":76,"line_start":56},{"file":"SKILL.md","line_end":80,"line_start":76},{"file":"SKILL.md","line_end":117,"line_start":80},{"file":"SKILL.md","line_end":121,"line_start":117},{"file":"SKILL.md","line_end":139,"line_start":121},{"file":"SKILL.md","line_end":141,"line_start":139},{"file":"SKILL.md","line_end":169,"line_start":141},{"file":"SKILL.md","line_end":173,"line_start":169},{"file":"SKILL.md","line_end":192,"line_start":173},{"file":"SKILL.md","line_end":201,"line_start":192},{"file":"SKILL.md","line_end":205,"line_start":201},{"file":"SKILL.md","line_end":295,"line_start":205},{"file":"SKILL.md","line_end":301,"line_start":295},{"file":"SKILL.md","line_end":304,"line_start":301},{"file":"SKILL.md","line_end":307,"line_start":304},{"file":"SKILL.md","line_end":307,"line_start":307},{"file":"SKILL.md","line_end":309,"line_start":308},{"file":"SKILL.md","line_end":309,"line_start":309},{"file":"SKILL.md","line_end":311,"line_start":311},{"file":"SKILL.md","line_end":315,"line_start":315}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":111,"line_start":111},{"file":"SKILL.md","line_end":184,"line_start":184},{"file":"SKILL.md","line_end":322,"line_start":322},{"file":"SKILL.md","line_end":323,"line_start":323},{"file":"SKILL.md","line_end":324,"line_start":324},{"file":"SKILL.md","line_end":325,"line_start":325}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":225,"line_start":225},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":61,"line_start":61}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Unauthenticated Read and Write Procedures","locations":[{"file":"SKILL.md","line_end":101,"line_start":87},{"file":"SKILL.md","line_end":257,"line_start":248}],"confidence":0.96,"description":"The examples expose user lookup and post creation through procedures with no authentication or authorization checks. Adoption as shown can permit unauthorized reads and writes.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The first example uses a direct t.procedure, and the second explicitly uses publicProcedure for a database write. Neither example includes access control."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":326,"audit_model":"codex","audited_at":"2026-07-23T07:06:31.919+00:00","created_at":"2026-07-24T07:36:13.064312+00:00","static_findings":[{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":53,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":56,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":76,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":117,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":121,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```prisma","category":"external_commands","line_end":139,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":141,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":169,"severity":"medium","line_start":141},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":173,"severity":"medium","line_start":169},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":192,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Calling ${propertyKey}`)","category":"external_commands","line_end":201,"severity":"medium","line_start":192},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":205,"severity":"medium","line_start":201},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":295,"severity":"medium","line_start":205},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":301,"severity":"medium","line_start":295},{"id":"external_commands:SKILL.md:301:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ Use `.safeParse()` to handle errors gracefully","category":"external_commands","line_end":304,"severity":"medium","line_start":301},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ Use branded types for IDs (`z.string().brand<'UserId'>()`)","category":"external_commands","line_end":307,"severity":"medium","line_start":304},{"id":"external_commands:SKILL.md:307:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ Enable `strict: true` in `tsconfig.json`","category":"external_commands","line_end":307,"severity":"medium","line_start":307},{"id":"external_commands:SKILL.md:308:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ Use `noUncheckedIndexedAccess` for safer array access","category":"external_commands","line_end":309,"severity":"medium","line_start":308},{"id":"external_commands:SKILL.md:309:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ Prefer `unknown` over `any`","category":"external_commands","line_end":309,"severity":"medium","line_start":309},{"id":"external_commands:SKILL.md:311:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ Leverage inference with `typeof` and `ReturnType`","category":"external_commands","line_end":311,"severity":"medium","line_start":311},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ Use `.parse()` for known-good data (faster than `.safeParse()`)","category":"external_commands","line_end":315,"severity":"medium","line_start":315},{"id":"network:SKILL.md:111:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"links: [httpBatchLink({ url: 'http://localhost:3000/api/trpc' })]","category":"network","line_end":111,"severity":"low","line_start":111},{"id":"network:SKILL.md:184:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"url: 'https://api.example.com',","category":"network","line_end":184,"severity":"low","line_start":184},{"id":"network:SKILL.md:322:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Zod Documentation](https://zod.dev)","category":"network","line_end":322,"severity":"low","line_start":322},{"id":"network:SKILL.md:323:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [tRPC Documentation](https://trpc.io)","category":"network","line_end":323,"severity":"low","line_start":323},{"id":"network:SKILL.md:324:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Prisma Documentation](https://www.prisma.io/docs)","category":"network","line_end":324,"severity":"low","line_start":324},{"id":"network:SKILL.md:325:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [TypeScript Handbook](https://www.typescriptlang.org/docs/handbook/intro.html)","category":"network","line_end":325,"severity":"low","line_start":325},{"id":"filesystem:SKILL.md:225:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"import { publicProcedure, router } from '../trpc'","category":"filesystem","line_end":225,"severity":"high","line_start":225},{"id":"filesystem:SKILL.md:60:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":".refine((pass) => /[A-Z]/.test(pass), 'Must contain uppercase')","category":"filesystem","line_end":60,"severity":"medium","line_start":60},{"id":"filesystem:SKILL.md:61:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":".refine((pass) => /[0-9]/.test(pass), 'Must contain number')","category":"filesystem","line_end":61,"severity":"medium","line_start":61},{"id":"blocker:SKILL.md:91:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"return await db.user.findUnique({ where: { id: input.id } })","category":"blocker","line_end":91,"severity":"low","line_start":91},{"id":"blocker:SKILL.md:124:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"id        String   @id @default(cuid())","category":"blocker","line_end":124,"severity":"low","line_start":124},{"id":"blocker:SKILL.md:132:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"id        String   @id @default(cuid())","category":"blocker","line_end":132,"severity":"low","line_start":132},{"id":"blocker:SKILL.md:244:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"nextCursor: posts[input.limit]?.id","category":"blocker","line_end":245,"severity":"low","line_start":244},{"id":"blocker:SKILL.md:308:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- ✅ Use `noUncheckedIndexedAccess` for safer array access","category":"blocker","line_end":309,"severity":"low","line_start":308}],"finding_verdicts":[{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Line 27 is an opening Markdown fence for a TypeScript example. It does not invoke Ruby, a shell, or any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"Line 53 closes a Markdown code block. The backticks are document syntax and are not executable.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"Line 56 opens a TypeScript code block containing Zod examples. No shell execution API or command is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"Line 76 is a closing Markdown code fence. It has no command-execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"Line 80 opens a TypeScript block that demonstrates tRPC. The fence is documentation syntax, not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"Line 117 closes the tRPC example block. It cannot execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"Line 121 opens a Prisma schema example. The Markdown fence does not launch a process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","reason":"Line 139 closes a Prisma code block. This is non-executable Markdown syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"Line 141 opens a TypeScript example for Prisma queries. No external command is defined or executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","reason":"Line 169 is only the closing fence of a TypeScript example. It does not represent shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"Line 173 opens a TypeScript feature example. The code fence is not a process invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","reason":"Line 192 uses a TypeScript template literal in console.log. It interpolates a property name but does not execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","reason":"Line 201 closes the TypeScript feature example. These backticks are only a Markdown delimiter.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"Line 205 opens a TypeScript full-stack example. It contains application code but no shell or Ruby command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","reason":"Line 295 closes the full-stack TypeScript example. The Markdown fence is not executable.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:301:ruby-shell-backtick-execution","reason":"Line 301 uses inline Markdown backticks around safeParse in prose. It neither constructs nor executes a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","reason":"Line 304 formats a Zod expression as inline code. It is documentation text with no execution path.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:307:ruby-shell-backtick-execution","reason":"Line 307 formats TypeScript configuration names with inline backticks. No command execution is requested.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:308:ruby-shell-backtick-execution","reason":"Line 308 formats a compiler option as inline code. The content is descriptive and not executable.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:309:ruby-shell-backtick-execution","reason":"Line 309 formats TypeScript type names in Markdown. It contains no shell expression or command API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:311:ruby-shell-backtick-execution","reason":"Line 311 uses inline code formatting for TypeScript operators. It does not launch or describe an external process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","reason":"Line 315 formats Zod method names as inline code. The backticks are prose formatting, not shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:111:hardcoded-url","reason":"The URL is a localhost endpoint in a tRPC client example. It does not contact an external host or transmit sensitive data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:184:hardcoded-url","reason":"The URL uses the reserved example.com domain as placeholder configuration. No request is made by the shown object literal.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:322:hardcoded-url","reason":"Line 322 is a documentation link to the official Zod site. The skill does not fetch it automatically.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:323:hardcoded-url","reason":"Line 323 is a documentation link to the official tRPC site. It is not an executable network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:324:hardcoded-url","reason":"Line 324 links readers to official Prisma documentation. No data transmission or automatic fetch is instructed.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:325:hardcoded-url","reason":"Line 325 links to the official TypeScript handbook. It is a passive reference with no network execution.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:225:path-traversal-sequence","reason":"The sequence is a static parent-directory module import in TypeScript. It does not accept user input or perform dynamic filesystem traversal.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:60:hidden-file-access","reason":"The leading period is a Zod refine method call, not a hidden-file path. The line only tests a password string.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:61:hidden-file-access","reason":"The leading period is chained Zod method syntax. No filesystem path or hidden file is accessed.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:91:system-reconnaissance","reason":"The line performs an application database lookup by user identifier. It does not inspect the host system or gather system metadata.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:124:system-reconnaissance","reason":"The id token is a Prisma model field with a generated cuid default. It is unrelated to system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:132:system-reconnaissance","reason":"This is another Prisma id field declaration. It does not execute a discovery command or inspect the environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:244:system-reconnaissance","reason":"The expression reads an optional post identifier to build a pagination cursor. It performs no host or process reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:308:network-reconnaissance","reason":"The line recommends a TypeScript compiler option for checked indexed access. It does not enumerate or probe any network.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Unauthenticated Read and Write Procedures","severity":"medium","locations":[{"file":"SKILL.md","line_end":101,"line_start":87},{"file":"SKILL.md","line_end":257,"line_start":248}],"confidence":0.96,"description":"The examples expose user lookup and post creation through procedures with no authentication or authorization checks. Adoption as shown can permit unauthorized reads and writes.","confidence_reasoning":"The first example uses a direct t.procedure, and the second explicitly uses publicProcedure for a database write. Neither example includes access control."}],"subject_marketplace_commit_sha":"89edfdc710d0846129dcee6a929477b04f08052c","subject_content_hash":"c09b69cab4915c7a962bd7dc2e83c923d003c76633250da24dd68c74ed35746b","subject_tree_hash":"886fbbff5f3c31b616fdc61264ffea7e3514f378184ccf8b78ba16437c621166","subject_plugin_path":"skills/ariegoldkin/type-safety-validation","audit_payload_hash":"3f322aa294b61e4c12ea9ff87576560d","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"89edfdc710d0846129dcee6a929477b04f08052c","contentHash":"c09b69cab4915c7a962bd7dc2e83c923d003c76633250da24dd68c74ed35746b","treeHash":"886fbbff5f3c31b616fdc61264ffea7e3514f378184ccf8b78ba16437c621166","pluginPath":"skills/ariegoldkin/type-safety-validation","auditPayloadHash":"3f322aa294b61e4c12ea9ff87576560d"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/ariegoldkin-type-safety-validation/audits/10/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}