{"data":{"skill":{"slug":"astrale-os-astrale-cli","name":"astrale-cli","icon":"📦","repo":"https://github.com/astrale-os/cli/tree/db2fc39650aa2fbd37e8439804d5e627ac83bcb0/skills/astrale-cli","status":"approved","author":"astrale-os","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"0b29ef2d-a21c-4d22-8e1d-c90decbc3afc","skill_id":"d0f81bfe-d9b5-4015-addd-c7f3e2306e26","version":1,"content_hash":"v3:e406bf64b5db6e514879399e87b346fa7ff7c2fb:af303f25166fedac3221dad6c6b98a6b2b83eef3537bb334c23902acd6292b63:c121e99c7df0049e1e87e401c854c0289e29803305385ce27bb5d563916d0eb0:736b696c6c732f61737472616c652d6f732f61737472616c652d636c69:03f89c4bd02ebe95912320d387ef8e86","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 269 static findings are documentation false positives, including Markdown delimiters, example URLs, and descriptions of owner-private credential caches. Token examples introduce one semantic risk by passing bearer credentials through command-line arguments. No evidence found of prompt injection, malicious exfiltration, or unauthorized execution; external CLI implementation was not included.","remediation":[{"issue":"Bearer token examples expose credentials through process arguments.","severity":"medium","suggestion":"Prefer the selected identity or --as instead of --creds examples. Document process-list and tracing exposure; provide protected credential input if explicit tokens are required."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":17,"line_start":14},{"file":"SKILL.md","line_end":19,"line_start":17},{"file":"SKILL.md","line_end":20,"line_start":19},{"file":"SKILL.md","line_end":22,"line_start":20},{"file":"SKILL.md","line_end":28,"line_start":22},{"file":"SKILL.md","line_end":48,"line_start":28},{"file":"SKILL.md","line_end":50,"line_start":48},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":55,"line_start":52},{"file":"SKILL.md","line_end":56,"line_start":55},{"file":"SKILL.md","line_end":59,"line_start":56},{"file":"SKILL.md","line_end":60,"line_start":59},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":65,"line_start":64},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":68,"line_start":67},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":80,"line_start":72},{"file":"SKILL.md","line_end":90,"line_start":80},{"file":"SKILL.md","line_end":93,"line_start":90},{"file":"SKILL.md","line_end":98,"line_start":93},{"file":"SKILL.md","line_end":100,"line_start":98},{"file":"SKILL.md","line_end":101,"line_start":100},{"file":"SKILL.md","line_end":102,"line_start":101},{"file":"SKILL.md","line_end":103,"line_start":102},{"file":"SKILL.md","line_end":103,"line_start":103},{"file":"SKILL.md","line_end":106,"line_start":105},{"file":"SKILL.md","line_end":107,"line_start":106},{"file":"SKILL.md","line_end":108,"line_start":107},{"file":"SKILL.md","line_end":111,"line_start":108},{"file":"SKILL.md","line_end":114,"line_start":111},{"file":"SKILL.md","line_end":114,"line_start":114},{"file":"SKILL.md","line_end":125,"line_start":124},{"file":"SKILL.md","line_end":126,"line_start":125},{"file":"SKILL.md","line_end":127,"line_start":126},{"file":"SKILL.md","line_end":128,"line_start":127},{"file":"SKILL.md","line_end":129,"line_start":128},{"file":"SKILL.md","line_end":131,"line_start":129},{"file":"SKILL.md","line_end":132,"line_start":131},{"file":"SKILL.md","line_end":134,"line_start":132},{"file":"SKILL.md","line_end":135,"line_start":134},{"file":"SKILL.md","line_end":135,"line_start":135},{"file":"SKILL.md","line_end":143,"line_start":138},{"file":"SKILL.md","line_end":147,"line_start":143},{"file":"SKILL.md","line_end":149,"line_start":147},{"file":"SKILL.md","line_end":160,"line_start":149},{"file":"SKILL.md","line_end":162,"line_start":160}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":158,"line_start":158},{"file":"SKILL.md","line_end":228,"line_start":228},{"file":"SKILL.md","line_end":274,"line_start":274},{"file":"SKILL.md","line_end":275,"line_start":275},{"file":"SKILL.md","line_end":277,"line_start":277}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":592,"line_start":592},{"file":"SKILL.md","line_end":592,"line_start":592}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Bearer Credentials Exposed Through Command Arguments","locations":[{"file":"SKILL.md","line_end":374,"line_start":373},{"file":"SKILL.md","line_end":387,"line_start":387}],"confidence":0.94,"description":"The examples pass minted bearer credentials using --creds \"$TOKEN\" and --creds \"$(astrale token --raw)\". Shell expansion places credentials in process arguments, potentially exposing them to process inspection or execution logging while tokens remain valid.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The examples directly expand bearer credentials into argv. Exposure depends on local process visibility and logging; short token lifetimes reduce the exploitation window."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":631,"audit_model":"codex","audited_at":"2026-10-10T14:10:07.537+00:00","created_at":"2026-10-11T03:30:29.896911+00:00","static_findings":[{"id":"external_commands:SKILL.md:3:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"description: Reference for the Astrale CLI (binary `astrale`, package `@astrale-os/cli`) - setup, gr","category":"external_commands","line_end":3,"severity":"medium","line_start":3},{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale` connects to existing Astrale Kernels. It selects an instance and","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":17,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":19,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Binary: `astrale`","category":"external_commands","line_end":20,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Package: `@astrale-os/cli`","category":"external_commands","line_end":22,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Dev entrypoint: `bun cli/bin/astrale.ts <command>`","category":"external_commands","line_end":28,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":48,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":50,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Kernel-touching commands share `--format`, `--json`, `--raw`, `--url`,","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`-i/--instance`, `--timeout`, `--as`, `--creds`, `--anonymous`, and `--debug` where","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"applicable. The CLI creates one public Kernel `Call`, and its Client session owns","category":"external_commands","line_end":55,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale ui` is local project tooling and takes no Kernel, instance, identity,","category":"external_commands","line_end":56,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"or credential options, except `astrale ui request`, which is an authenticated","category":"external_commands","line_end":59,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `--anonymous` to omit a caller credential even when a local or bookmark-default identity exists.","category":"external_commands","line_end":60,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"It cannot be combined with `--as` or `--creds`; required callables reject anonymous requests.","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `astrale issue \"Factual title\" --body \"Context and details\"` (or pipe the body","category":"external_commands","line_end":65,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"on stdin). Prefer optional `--project <directory>` and `-i <instance>` when known;","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"attached automatically. `-i` names the affected instance.","category":"external_commands","line_end":68,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Optionally add `Type: bug`, `Type: limitation` (including capability requests), or `Type: friction`.","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If confirmation fails, use the printed `--retry` command.","category":"external_commands","line_end":80,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":90,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":93,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"imports, and `astrale-ui.lock.json`. The lock records the exact package version,","category":"external_commands","line_end":98,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run `astrale ui add` without item arguments for an interactive picker. In CI,","category":"external_commands","line_end":100,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"installed files; review those files, then use `--overwrite --yes` only when","category":"external_commands","line_end":101,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"replacement is intentional. `--dry-run` leaves project files and the lock","category":"external_commands","line_end":102,"severity":"medium","line_start":101},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"unchanged. Use `astrale ui search <free-text> --json` to receive a short ranked candidate list with","category":"external_commands","line_end":103,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"exact demo code and its `command` or runtime `packageImport`.","category":"external_commands","line_end":103,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `astrale ui request <free-text>` when search does not satisfy the need. It calls","category":"external_commands","line_end":106,"severity":"medium","line_start":105},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`/:ui.astrale.ai:function.request` on the selected instance with one bounded intent (1-512","category":"external_commands","line_end":107,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"characters) and prints the returned receipt: `{ state: \"submitted\", requestId, collaborationUrl }`","category":"external_commands","line_end":108,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"or `{ state: \"pending\" | \"outcome-unknown\" | \"failed\" | \"conflict\", requestId }`.","category":"external_commands","line_end":111,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"theme is copied to `components/astrale/theme/` and activated through one relative","category":"external_commands","line_end":114,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`className`, inline `style`, controlled values/actions, and stable `data-slot`","category":"external_commands","line_end":114,"severity":"medium","line_start":114},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Domain root | `/:notes.example.dev` |","category":"external_commands","line_end":125,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Class | `/:notes.example.dev:class.Note` |","category":"external_commands","line_end":126,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Static callable | `/:notes.example.dev:class.Note:list` |","category":"external_commands","line_end":127,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Instance callable | `@node-id::notes.example.dev:class.Note.method.archive` |","category":"external_commands","line_end":128,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Node ID | `@node-id` |","category":"external_commands","line_end":129,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Active caller shorthand | `@self` |","category":"external_commands","line_end":131,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Static dispatch uses one colon before the method. Instance dispatch uses `::` followed by the comple","category":"external_commands","line_end":132,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Discover methods with `astrale introspect <origin> --bundle`. Introspection can use a Class","category":"external_commands","line_end":134,"severity":"medium","line_start":132},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`@self` is expanded by the CLI before signing when it appears at the head of a","category":"external_commands","line_end":135,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"call Path or a bare `key=@self` value. It is not rewritten inside `--data`,","category":"external_commands","line_end":135,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":143,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":147,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale instance` combines admin-provisioned instances and local bookmarks:","category":"external_commands","line_end":149,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":160,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":162,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use explicit `-i <instance>` in scripts. `-i` and `--url` always select the instance a command","category":"external_commands","line_end":162,"severity":"medium","line_start":162},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"acts on; they never select the Admin kernel, and Admin operations (`instance list`, ...) reject them","category":"external_commands","line_end":163,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`domain list` without them uses the active instance. Choose the Admin kernel with","category":"external_commands","line_end":165,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--admin <bookmark>` or `--admin-url <url>`. `instance delete` affects an admin-managed instance; `i","category":"external_commands","line_end":165,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`instance status` reports Admin-owned lifecycle by default; add `--bookmarked`","category":"external_commands","line_end":167,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`instance invite` requires authority to manage the exact Instance and grants","category":"external_commands","line_end":174,"severity":"medium","line_start":169},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`instance invitation status <id>` performs one read-only observation of the","category":"external_commands","line_end":175,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"retained Invitation. Its `user` is the Shell User reserved on the Instance,","category":"external_commands","line_end":176,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"which an Instance administrator can assign to Core `admin` (see the","category":"external_commands","line_end":177,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"astrale-domain `references/users.md`). `completed` means access is","category":"external_commands","line_end":177,"severity":"medium","line_start":177},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"materialized; `accepted`, `registering`, and `registered` are intermediate","category":"external_commands","line_end":178,"severity":"medium","line_start":178},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`instance invitation reconcile <id>` is diagnostic recovery, not the normal","category":"external_commands","line_end":183,"severity":"medium","line_start":181},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Without a deployed Admin Domain, `astrale instance list` cannot fetch managed","category":"external_commands","line_end":185,"severity":"medium","line_start":183},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale instance list --bookmarked`.","category":"external_commands","line_end":187,"severity":"medium","line_start":185},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Fleet administrators may add `--include-retired` to the ordinary Admin inventory. The default","category":"external_commands","line_end":189,"severity":"medium","line_start":187},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"are identified by terminal `state: \"deleted\"`. The optional `issuer` is present only when Admin has","category":"external_commands","line_end":189,"severity":"medium","line_start":189},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"retained exact evidence. Unreachable does not mean retired. Add `--admin-only` when local bookmarks","category":"external_commands","line_end":193,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`instance create` provisions through the configured Admin Domain with a WorkOS caller; Admin owns","category":"external_commands","line_end":197,"severity":"medium","line_start":193},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"access, reports `bookmark.status=pending` with a recovery command under an unused name, and skips","category":"external_commands","line_end":198,"severity":"medium","line_start":197},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"automatic root import. Use `instance use <name>` to switch explicitly.","category":"external_commands","line_end":201,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Neither `instance create` nor `instance root import` accepts `--host`.","category":"external_commands","line_end":201,"severity":"medium","line_start":201},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`instance root import <slug-or-id>` retrieves the target owned Instance's root signing identity","category":"external_commands","line_end":205,"severity":"medium","line_start":203},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`<slug>-root`, not the Admin or Host root identity. Use `--admin <bookmark>` or `--admin-url <url>`","category":"external_commands","line_end":205,"severity":"medium","line_start":205},{"id":"external_commands:SKILL.md:206:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"to select another Admin endpoint. Recovery requires `--yes` in automation, replaces an existing","category":"external_commands","line_end":210,"severity":"medium","line_start":206},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"bookmark's default. Select the imported root explicitly with `--as`:","category":"external_commands","line_end":212,"severity":"medium","line_start":210},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":215,"severity":"medium","line_start":212},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":217,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use an authorized human identity for the import; `development-root` is available for subsequent","category":"external_commands","line_end":221,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale-domain` binary owns `build`, `deploy`, `publish`, `diff`, `yank`, `list`, `lint`,","category":"external_commands","line_end":221,"severity":"medium","line_start":221},{"id":"external_commands:SKILL.md:222:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`package`, and test workflows; a deploy or a publish never installs. Project Environments say how to","category":"external_commands","line_end":224,"severity":"medium","line_start":222},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale domain install` changes what an instance runs.","category":"external_commands","line_end":226,"severity":"medium","line_start":224},{"id":"external_commands:SKILL.md:226:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale domain install` takes deployment URLs and versions:","category":"external_commands","line_end":228,"severity":"medium","line_start":226},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Deployment URLs (`https://`, or `http://` for a local Host) go to the","category":"external_commands","line_end":228,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The CLI reads each URL's canonical `release.json` first (a 503 is read again for up to","category":"external_commands","line_end":235,"severity":"medium","line_start":232},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- A version reference, `<origin>@1.5.0` (or `@2.0.0-rc.1`) for exactly that","category":"external_commands","line_end":235,"severity":"medium","line_start":235},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`<origin>@1.5` for the highest stable 1.5.x that is not yanked, is resolved","category":"external_commands","line_end":238,"severity":"medium","line_start":237},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"in the Admin registry with your own identity (`--admin` / `--admin-url`, or","category":"external_commands","line_end":238,"severity":"medium","line_start":238},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"the configured Admin target). A private Domain needs `domain_installer`,","category":"external_commands","line_end":244,"severity":"medium","line_start":239},{"id":"external_commands:SKILL.md:244:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"A major alone (`@1`), a range or build metadata is refused; an unresolvable","category":"external_commands","line_end":248,"severity":"medium","line_start":244},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"by the Kernel in the installation: `--allow-issuer-change` for a new","category":"external_commands","line_end":249,"severity":"medium","line_start":248},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"deployment of the same line (same `<line>-` prefix and routing domain),","category":"external_commands","line_end":250,"severity":"medium","line_start":249},{"id":"external_commands:SKILL.md:250:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--allow-issuer-change=<origin>` for any other change (a legacy issuer","category":"external_commands","line_end":253,"severity":"medium","line_start":250},{"id":"external_commands:SKILL.md:253:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"drains; `--revoke-previous` cuts it at the activation. A first install from","category":"external_commands","line_end":255,"severity":"medium","line_start":253},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The origin is given only after `=`: a bare `--allow-issuer-change` never","category":"external_commands","line_end":255,"severity":"medium","line_start":255},{"id":"external_commands:SKILL.md:257:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"every unconsented change in `details.origins` (`origin`, `installed`,","category":"external_commands","line_end":257,"severity":"medium","line_start":257},{"id":"external_commands:SKILL.md:258:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`replacement`, `line`) before anything is sent; `--json` reports each","category":"external_commands","line_end":258,"severity":"medium","line_start":258},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"consent as `references[].consent` (`from`, `to`, `previous`).","category":"external_commands","line_end":259,"severity":"medium","line_start":259},{"id":"external_commands:SKILL.md:268:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"and the Kernel decides. `--json` carries it as `precheck` (`compared`,","category":"external_commands","line_end":268,"severity":"medium","line_start":268},{"id":"external_commands:SKILL.md:269:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`dependencies`, `dependents`, `proposals`, `command?`, `skipped`,","category":"external_commands","line_end":269,"severity":"medium","line_start":269},{"id":"external_commands:SKILL.md:270:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`unevaluated`) in the report, and beside a SCHEMA_DEPENDENCY_INCOMPATIBLE or","category":"external_commands","line_end":273,"severity":"medium","line_start":270},{"id":"external_commands:SKILL.md:273:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":282,"severity":"medium","line_start":273},{"id":"external_commands:SKILL.md:282:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":284,"severity":"medium","line_start":282},{"id":"external_commands:SKILL.md:284:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale domain versions <origin>` lists the Domain's published versions from the Admin","category":"external_commands","line_end":285,"severity":"medium","line_start":284},{"id":"external_commands:SKILL.md:285:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"registry, read with your own credential: you need `domain_installer` or `domain_admin` on the","category":"external_commands","line_end":285,"severity":"medium","line_start":285},{"id":"external_commands:SKILL.md:287:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"version is never chosen by a line such as `@1.5`. An absent Domain and one you cannot read give","category":"external_commands","line_end":288,"severity":"medium","line_start":287},{"id":"external_commands:SKILL.md:288:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"the same `REGISTRY_DOMAIN_NOT_FOUND`. `--json` prints one `astrale.registry-index` document;","category":"external_commands","line_end":288,"severity":"medium","line_start":288},{"id":"external_commands:SKILL.md:289:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"refusals print `{ \"error\": { \"code\", \"message\", \"details\" } }` on stdout and exit 1. Rerunning","category":"external_commands","line_end":290,"severity":"medium","line_start":289},{"id":"external_commands:SKILL.md:290:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"the same command is always safe; it can help only when `details.retryable` is `true`.","category":"external_commands","line_end":290,"severity":"medium","line_start":290},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":295,"severity":"medium","line_start":292},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":297,"severity":"medium","line_start":295},{"id":"external_commands:SKILL.md:297:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale domain list` (active instance, or `-i <instance>` / `--url <kernel>`) shows what runs on th","category":"external_commands","line_end":297,"severity":"medium","line_start":297},{"id":"external_commands:SKILL.md:300:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"one naming the same build from the same issuer, as `1.5.0 · staging`; a build digest alone never","category":"external_commands","line_end":302,"severity":"medium","line_start":300},{"id":"external_commands:SKILL.md:302:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(`1.4.2 + 7 commits · a1b2c3d · staging`, printed as computed), and","category":"external_commands","line_end":305,"severity":"medium","line_start":302},{"id":"external_commands:SKILL.md:305:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"installed\". The registry is read as you (`--as` or your default identity) on the Admin kernel;","category":"external_commands","line_end":306,"severity":"medium","line_start":305},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--creds` and `--anonymous` apply to the instance only. `--json` prints one","category":"external_commands","line_end":306,"severity":"medium","line_start":306},{"id":"external_commands:SKILL.md:307:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale.installed-list` document.","category":"external_commands","line_end":309,"severity":"medium","line_start":307},{"id":"external_commands:SKILL.md:309:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":312,"severity":"medium","line_start":309},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":314,"severity":"medium","line_start":312},{"id":"external_commands:SKILL.md:314:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The hidden `astrale __domain-registry bundle|claim|publish|yank` commands are JSON plumbing for","category":"external_commands","line_end":315,"severity":"medium","line_start":314},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale-domain diff`, `publish` and `yank`; do not call them by hand. `astrale-domain publish`","category":"external_commands","line_end":315,"severity":"medium","line_start":315},{"id":"external_commands:SKILL.md:322:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"data. `--destructive` deletes application facts whose concrete Class belongs to a selected Domain;","category":"external_commands","line_end":325,"severity":"medium","line_start":322},{"id":"external_commands:SKILL.md:325:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"interactively, or pass `--yes` in automation.","category":"external_commands","line_end":327,"severity":"medium","line_start":325},{"id":"external_commands:SKILL.md:327:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Bookmarks retain their own TLS trust (`--ca`). `instance use` probes OIDC and","category":"external_commands","line_end":327,"severity":"medium","line_start":327},{"id":"external_commands:SKILL.md:329:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"different CA settings, the CLI warns and `instance list --bookmarked --json`","category":"external_commands","line_end":330,"severity":"medium","line_start":329},{"id":"external_commands:SKILL.md:330:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"shows each bookmark's `caFile`, issuer, and default identity.","category":"external_commands","line_end":338,"severity":"medium","line_start":330},{"id":"external_commands:SKILL.md:338:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale auth login` stores an IdP-backed identity. `astrale identity create`","category":"external_commands","line_end":338,"severity":"medium","line_start":338},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":348,"severity":"medium","line_start":343},{"id":"external_commands:SKILL.md:348:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":351,"severity":"medium","line_start":348},{"id":"external_commands:SKILL.md:351:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"and can be reused through the `@node-id` Path form; do not derive application","category":"external_commands","line_end":354,"severity":"medium","line_start":351},{"id":"external_commands:SKILL.md:354:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"When a Domain callable supplies that authority, optionally name it with `--via`;","category":"external_commands","line_end":358,"severity":"medium","line_start":354},{"id":"external_commands:SKILL.md:358:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":363,"severity":"medium","line_start":358},{"id":"external_commands:SKILL.md:363:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":365,"severity":"medium","line_start":363},{"id":"external_commands:SKILL.md:365:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale token` issues an audience-bound credential for the selected authenticated identity. When","category":"external_commands","line_end":367,"severity":"medium","line_start":365},{"id":"external_commands:SKILL.md:367:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"for the selected identity that can be reused with `--creds`. A different `--audience` creates a dele","category":"external_commands","line_end":367,"severity":"medium","line_start":367},{"id":"external_commands:SKILL.md:370:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--raw` for shell assignment.","category":"external_commands","line_end":372,"severity":"medium","line_start":370},{"id":"external_commands:SKILL.md:372:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":375,"severity":"medium","line_start":372},{"id":"external_commands:SKILL.md:375:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":379,"severity":"medium","line_start":375},{"id":"external_commands:SKILL.md:379:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"only through a Policy. Without `--creds`, the CLI exchanges the selected identity's credential","category":"external_commands","line_end":385,"severity":"medium","line_start":379},{"id":"external_commands:SKILL.md:385:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `call` with `--as <identity>` or the default identity | the callable's declaring Domain | the prin","category":"external_commands","line_end":385,"severity":"medium","line_start":385},{"id":"external_commands:SKILL.md:386:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `get`, `query`, `mutate` on an Astrale-managed instance | Shell | bounded by Shell's authority and","category":"external_commands","line_end":386,"severity":"medium","line_start":386},{"id":"external_commands:SKILL.md:387:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--creds \"$(astrale token --raw)\"` | the identity | a Domain callable reached only through a Polic","category":"external_commands","line_end":387,"severity":"medium","line_start":387},{"id":"external_commands:SKILL.md:390:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"callables with `--as`.","category":"external_commands","line_end":392,"severity":"medium","line_start":390},{"id":"external_commands:SKILL.md:392:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale auth token` is different: it prints the cached upstream IdP token.","category":"external_commands","line_end":396,"severity":"medium","line_start":392},{"id":"external_commands:SKILL.md:396:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `get`","category":"external_commands","line_end":398,"severity":"medium","line_start":396},{"id":"external_commands:SKILL.md:398:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`get` reads one exact canonical Node:","category":"external_commands","line_end":400,"severity":"medium","line_start":398},{"id":"external_commands:SKILL.md:400:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":402,"severity":"medium","line_start":400},{"id":"external_commands:SKILL.md:402:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":404,"severity":"medium","line_start":402},{"id":"external_commands:SKILL.md:404:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The structured Node result is exactly `{ id, class, props }`.","category":"external_commands","line_end":406,"severity":"medium","line_start":404},{"id":"external_commands:SKILL.md:406:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":410,"severity":"medium","line_start":406},{"id":"external_commands:SKILL.md:410:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":412,"severity":"medium","line_start":410},{"id":"external_commands:SKILL.md:412:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Method Paths identify callables rather than Nodes; use `call` to invoke them or","category":"external_commands","line_end":413,"severity":"medium","line_start":412},{"id":"external_commands:SKILL.md:413:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`introspect` to inspect their Schema. Schema-valued properties are omitted","category":"external_commands","line_end":414,"severity":"medium","line_start":413},{"id":"external_commands:SKILL.md:414:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"unless `--schema` is passed.","category":"external_commands","line_end":416,"severity":"medium","line_start":414},{"id":"external_commands:SKILL.md:416:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `introspect`","category":"external_commands","line_end":418,"severity":"medium","line_start":416},{"id":"external_commands:SKILL.md:418:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`introspect` reads the Kernel Schema syscall for one installed Domain.","category":"external_commands","line_end":420,"severity":"medium","line_start":418},{"id":"external_commands:SKILL.md:420:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":425,"severity":"medium","line_start":420},{"id":"external_commands:SKILL.md:425:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":428,"severity":"medium","line_start":425},{"id":"external_commands:SKILL.md:428:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"An instance Method's qualified key selects the schema even with an `@id` receiver;","category":"external_commands","line_end":429,"severity":"medium","line_start":428},{"id":"external_commands:SKILL.md:429:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"introspection neither reads nor invokes that receiver. A bare `@id` has no schema origin.","category":"external_commands","line_end":431,"severity":"medium","line_start":429},{"id":"external_commands:SKILL.md:431:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `query`","category":"external_commands","line_end":433,"severity":"medium","line_start":431},{"id":"external_commands:SKILL.md:433:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`query` executes canonical `astrale.graph.query/v6`. Its structured result is","category":"external_commands","line_end":433,"severity":"medium","line_start":433},{"id":"external_commands:SKILL.md:434:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`{ kind: \"graph\", graph: { nodes, edges }, page?: { next } }`; pass the opaque","category":"external_commands","line_end":435,"severity":"medium","line_start":434},{"id":"external_commands:SKILL.md:435:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`page.next` value to `--cursor` until it is absent.","category":"external_commands","line_end":435,"severity":"medium","line_start":435},{"id":"external_commands:SKILL.md:438:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `--class <path>` selects Nodes implementing one exact Class.","category":"external_commands","line_end":439,"severity":"medium","line_start":438},{"id":"external_commands:SKILL.md:439:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `--edge <class>` adds one exact expansion; direction is `outgoing`,","category":"external_commands","line_end":439,"severity":"medium","line_start":439},{"id":"external_commands:SKILL.md:440:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`incoming`, or `incident`.","category":"external_commands","line_end":440,"severity":"medium","line_start":440},{"id":"external_commands:SKILL.md:441:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `--limit` is finite and defaults to 100.","category":"external_commands","line_end":442,"severity":"medium","line_start":441},{"id":"external_commands:SKILL.md:442:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `--cursor` resumes the same caller-bound query scope.","category":"external_commands","line_end":443,"severity":"medium","line_start":442},{"id":"external_commands:SKILL.md:443:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `--ast` and `--file` admit a complete canonical Query V6 document.","category":"external_commands","line_end":443,"severity":"medium","line_start":443},{"id":"external_commands:SKILL.md:445:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":452,"severity":"medium","line_start":445},{"id":"external_commands:SKILL.md:452:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":454,"severity":"medium","line_start":452},{"id":"external_commands:SKILL.md:454:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `query` with `--edge` for an exact neighborhood.","category":"external_commands","line_end":454,"severity":"medium","line_start":454},{"id":"external_commands:SKILL.md:458:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale mutate` accepts canonical `astrale.graph.mutation/v3` or its exact","category":"external_commands","line_end":458,"severity":"medium","line_start":458},{"id":"external_commands:SKILL.md:459:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`{ preconditions, operations }` authoring input from `--data`, `--file`, or","category":"external_commands","line_end":459,"severity":"medium","line_start":459},{"id":"external_commands:SKILL.md:460:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"stdin. The transition is atomic. `--dry` admits and prints the canonical","category":"external_commands","line_end":461,"severity":"medium","line_start":460},{"id":"external_commands:SKILL.md:461:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"document without opening a Kernel connection. The result is `{ createdNodes }`.","category":"external_commands","line_end":463,"severity":"medium","line_start":461},{"id":"external_commands:SKILL.md:463:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":466,"severity":"medium","line_start":463},{"id":"external_commands:SKILL.md:466:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":470,"severity":"medium","line_start":466},{"id":"external_commands:SKILL.md:470:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale call` creates one Path-targeted Call. Input priority is `--data`,","category":"external_commands","line_end":470,"severity":"medium","line_start":470},{"id":"external_commands:SKILL.md:471:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`key=value`, piped stdin, then `{}`. `--dry-run` admits the Path and prints","category":"external_commands","line_end":471,"severity":"medium","line_start":471},{"id":"external_commands:SKILL.md:473:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--output` writes binary data. A streaming binary is drained with backpressure","category":"external_commands","line_end":477,"severity":"medium","line_start":473},{"id":"external_commands:SKILL.md:477:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale introspect <path>`.","category":"external_commands","line_end":479,"severity":"medium","line_start":477},{"id":"external_commands:SKILL.md:479:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":487,"severity":"medium","line_start":479},{"id":"external_commands:SKILL.md:487:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":489,"severity":"medium","line_start":487},{"id":"external_commands:SKILL.md:489:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Top-level `key=value` values coerce booleans, null, numbers, arrays, and","category":"external_commands","line_end":490,"severity":"medium","line_start":489},{"id":"external_commands:SKILL.md:490:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"objects. Use `--data` for nested or digits-only string values. `--data` also","category":"external_commands","line_end":490,"severity":"medium","line_start":490},{"id":"external_commands:SKILL.md:491:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"takes `-` (read the JSON from stdin) or `@<file>`, parsed like inline JSON; pass","category":"external_commands","line_end":491,"severity":"medium","line_start":491},{"id":"external_commands:SKILL.md:494:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--data -` reads piped stdin only; on a terminal it is refused.","category":"external_commands","line_end":496,"severity":"medium","line_start":494},{"id":"external_commands:SKILL.md:496:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--admin [<bookmark>]` or `--admin-url <url>` (with `--domain-issuer <url>`) runs","category":"external_commands","line_end":496,"severity":"medium","line_start":496},{"id":"external_commands:SKILL.md:497:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"the call on the Admin kernel, selected exactly like `domain` commands select it.","category":"external_commands","line_end":498,"severity":"medium","line_start":497},{"id":"external_commands:SKILL.md:498:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`-i` and `--url` are refused with them (usage error, exit 2), as are `--admin`","category":"external_commands","line_end":498,"severity":"medium","line_start":498},{"id":"external_commands:SKILL.md:499:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"with `--admin-url` and `--domain-issuer` without `--admin-url`. The call itself","category":"external_commands","line_end":499,"severity":"medium","line_start":499},{"id":"external_commands:SKILL.md:502:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"target. Put `key=value` params before `--admin`, or write `--admin=<bookmark>`.","category":"external_commands","line_end":502,"severity":"medium","line_start":502},{"id":"external_commands:SKILL.md:505:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"such a call: the deployment's `setSecret`, with the input in a private file or","category":"external_commands","line_end":506,"severity":"medium","line_start":505},{"id":"external_commands:SKILL.md:506:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"piped, never in argv (`astrale-domain list --json` gives each deployment's","category":"external_commands","line_end":507,"severity":"medium","line_start":506},{"id":"external_commands:SKILL.md:507:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`callTarget.path`). The deployment keeps its URL, issuer and key, so nothing is","category":"external_commands","line_end":510,"severity":"medium","line_start":507},{"id":"external_commands:SKILL.md:510:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":513,"severity":"medium","line_start":510},{"id":"external_commands:SKILL.md:513:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":517,"severity":"medium","line_start":513},{"id":"external_commands:SKILL.md:517:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale logs` reads the public Kernel journal syscall and returns","category":"external_commands","line_end":518,"severity":"medium","line_start":517},{"id":"external_commands:SKILL.md:518:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`{ records, cursor? }`. Filters match exact values; use `--topic-prefix` for","category":"external_commands","line_end":518,"severity":"medium","line_start":518},{"id":"external_commands:SKILL.md:521:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":525,"severity":"medium","line_start":521},{"id":"external_commands:SKILL.md:525:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":527,"severity":"medium","line_start":525},{"id":"external_commands:SKILL.md:527:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `--principal`, `--caller`, `--since`, `--until`, or an opaque `--cursor` as needed.","category":"external_commands","line_end":527,"severity":"medium","line_start":527},{"id":"external_commands:SKILL.md:528:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--principal` filters in the Kernel by the executing principal; a Domain acting for a user","category":"external_commands","line_end":529,"severity":"medium","line_start":528},{"id":"external_commands:SKILL.md:529:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(managed CLI, Console, `astrale call` through a Domain token exchange) is the principal of its","category":"external_commands","line_end":530,"severity":"medium","line_start":529},{"id":"external_commands:SKILL.md:530:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"records. `--caller` keeps the records whose caller (the identity whose authority the operation","category":"external_commands","line_end":531,"severity":"medium","line_start":530},{"id":"external_commands:SKILL.md:531:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"exercised) matches; it filters each returned page, so `--limit` bounds the page first. The Kernel","category":"external_commands","line_end":532,"severity":"medium","line_start":531},{"id":"external_commands:SKILL.md:532:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"records `caller` only when it differs from the principal, so the effective caller is `caller`,","category":"external_commands","line_end":532,"severity":"medium","line_start":532},{"id":"external_commands:SKILL.md:533:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"else `principal`: exact for records written by a Kernel with astrale-os/kernel#959, while records","category":"external_commands","line_end":535,"severity":"medium","line_start":533},{"id":"external_commands:SKILL.md:535:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Both accept `@self`; the human table shows PRINCIPAL and the effective CALLER, and JSON keeps","category":"external_commands","line_end":536,"severity":"medium","line_start":535},{"id":"external_commands:SKILL.md:536:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`caller` only where the Kernel recorded it.","category":"external_commands","line_end":537,"severity":"medium","line_start":536},{"id":"external_commands:SKILL.md:537:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--follow` retains one Client session and advances only with returned cursors.","category":"external_commands","line_end":538,"severity":"medium","line_start":537},{"id":"external_commands:SKILL.md:538:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Structured output retains the admitted `correlation` object, including invocation root and","category":"external_commands","line_end":539,"severity":"medium","line_start":538},{"id":"external_commands:SKILL.md:539:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"parent identifiers, and includes `correlationId` as a projection of `invocationId`.","category":"external_commands","line_end":539,"severity":"medium","line_start":539},{"id":"external_commands:SKILL.md:540:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"With `--json`, `--follow` emits NDJSON with one complete admitted record per line; combining","category":"external_commands","line_end":540,"severity":"medium","line_start":540},{"id":"external_commands:SKILL.md:541:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--format yaml` with `--follow` is rejected.","category":"external_commands","line_end":541,"severity":"medium","line_start":541},{"id":"external_commands:SKILL.md:545:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale view` opens one resolved View through a local browser shell. Every View belongs to its","category":"external_commands","line_end":546,"severity":"medium","line_start":545},{"id":"external_commands:SKILL.md:546:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Domain: pass a Domain origin (opens its entrypoint, or `--view <slug>`) or an explicit ViewPath. A","category":"external_commands","line_end":549,"severity":"medium","line_start":546},{"id":"external_commands:SKILL.md:549:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":556,"severity":"medium","line_start":549},{"id":"external_commands:SKILL.md:556:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":558,"severity":"medium","line_start":556},{"id":"external_commands:SKILL.md:558:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`astrale browser` prepares a persistent authenticated GUI browser profile.","category":"external_commands","line_end":559,"severity":"medium","line_start":558},{"id":"external_commands:SKILL.md:559:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `astrale browser --check` to verify it, then drive the printed profile with","category":"external_commands","line_end":560,"severity":"medium","line_start":559},{"id":"external_commands:SKILL.md:560:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`agent-browser`.","category":"external_commands","line_end":565,"severity":"medium","line_start":560},{"id":"external_commands:SKILL.md:565:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `--json` emits one JSON document for finite commands; `logs --follow` emits an NDJSON stream.","category":"external_commands","line_end":565,"severity":"medium","line_start":565},{"id":"external_commands:SKILL.md:566:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `--raw` unwraps scalars and writes raw binary bytes.","category":"external_commands","line_end":567,"severity":"medium","line_start":566},{"id":"external_commands:SKILL.md:567:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `--format yaml|json` selects finite structured rendering; `logs --follow` supports JSON/NDJSON onl","category":"external_commands","line_end":567,"severity":"medium","line_start":567},{"id":"external_commands:SKILL.md:568:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `--ci --no-prompt` for automation.","category":"external_commands","line_end":569,"severity":"medium","line_start":568},{"id":"external_commands:SKILL.md:569:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use explicit `-i`, `--as`, and `--timeout` rather than ambient state.","category":"external_commands","line_end":569,"severity":"medium","line_start":569},{"id":"external_commands:SKILL.md:577:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":582,"severity":"medium","line_start":577},{"id":"external_commands:SKILL.md:582:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":584,"severity":"medium","line_start":582},{"id":"external_commands:SKILL.md:584:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Add `--debug` for full Kernel error diagnostics. Missing and authorization-masked","category":"external_commands","line_end":586,"severity":"medium","line_start":584},{"id":"external_commands:SKILL.md:586:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"intermediate nodes and edges: an observed Node may be readable by `@id` or a","category":"external_commands","line_end":587,"severity":"medium","line_start":586},{"id":"external_commands:SKILL.md:587:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Class query while its Domain-rooted Path is unavailable. Check `-i` and `--as`;","category":"external_commands","line_end":587,"severity":"medium","line_start":587},{"id":"external_commands:SKILL.md:588:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"this alone does not prove corrupt data. Use `introspect` for callable schemas.","category":"external_commands","line_end":592,"severity":"medium","line_start":588},{"id":"external_commands:SKILL.md:592:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"State lives under `ASTRALE_HOME`, or `~/.astrale` by default:","category":"external_commands","line_end":592,"severity":"medium","line_start":592},{"id":"external_commands:SKILL.md:594:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```text","category":"external_commands","line_end":606,"severity":"medium","line_start":594},{"id":"external_commands:SKILL.md:606:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":608,"severity":"medium","line_start":606},{"id":"external_commands:SKILL.md:608:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`exchange/credentials.json` holds Domain-exchanged credentials until they expire;","category":"external_commands","line_end":609,"severity":"medium","line_start":608},{"id":"external_commands:SKILL.md:609:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`session/routes.json` holds learned Domain routes and their short-lived carriers;","category":"external_commands","line_end":610,"severity":"medium","line_start":609},{"id":"external_commands:SKILL.md:610:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`session/installations.json` remembers each Domain's installed issuer per Kernel.","category":"external_commands","line_end":618,"severity":"medium","line_start":610},{"id":"external_commands:SKILL.md:618:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Optional roots are `ASTRALE_HOME`, `ASTRALE_KEYS_DIR`, and","category":"external_commands","line_end":618,"severity":"medium","line_start":618},{"id":"external_commands:SKILL.md:619:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`ASTRALE_DATA_DIR`.","category":"external_commands","line_end":623,"severity":"medium","line_start":619},{"id":"external_commands:SKILL.md:623:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Entry: `cli/bin/astrale.ts`","category":"external_commands","line_end":624,"severity":"medium","line_start":623},{"id":"external_commands:SKILL.md:624:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Program and shared options: `cli/src/program/`","category":"external_commands","line_end":625,"severity":"medium","line_start":624},{"id":"external_commands:SKILL.md:625:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Public Kernel connection boundary: `cli/src/connection/`","category":"external_commands","line_end":626,"severity":"medium","line_start":625},{"id":"external_commands:SKILL.md:626:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Query/Mutation document preparation: `cli/src/graph/`","category":"external_commands","line_end":627,"severity":"medium","line_start":626},{"id":"external_commands:SKILL.md:627:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Commands: `cli/src/commands/`","category":"external_commands","line_end":628,"severity":"medium","line_start":627},{"id":"external_commands:SKILL.md:628:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Shared presentation and local stores: `cli/src/lib/`","category":"external_commands","line_end":629,"severity":"medium","line_start":628},{"id":"external_commands:SKILL.md:629:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Studio bridge: `cli/studio/server/`","category":"external_commands","line_end":630,"severity":"medium","line_start":629},{"id":"external_commands:SKILL.md:373:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"TOKEN=$(astrale token --raw -i staging)","category":"external_commands","line_end":373,"severity":"medium","line_start":373},{"id":"external_commands:SKILL.md:387:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"| `--creds \"$(astrale token --raw)\"` | the identity | a Domain callable reached only through a Polic","category":"external_commands","line_end":387,"severity":"medium","line_start":387},{"id":"external_commands:SKILL.md:372:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"```bash","category":"external_commands","line_end":375,"severity":"medium","line_start":372},{"id":"external_commands:SKILL.md:387:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"| `--creds \"$(astrale token --raw)\"` | the identity | a Domain callable reached only through a Polic","category":"external_commands","line_end":387,"severity":"medium","line_start":387},{"id":"network:SKILL.md:60:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"It cannot be combined with `--as` or `--creds`; required callables reject anonymous requests.","category":"network","line_end":60,"severity":"low","line_start":60},{"id":"network:SKILL.md:158:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"astrale instance bookmark staging --url https://kernel.example.com","category":"network","line_end":158,"severity":"low","line_start":158},{"id":"network:SKILL.md:228:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Deployment URLs (`https://`, or `http://` for a local Host) go to the","category":"network","line_end":228,"severity":"low","line_start":228},{"id":"network:SKILL.md:274:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"astrale domain install https://crm.example -i staging","category":"network","line_end":274,"severity":"low","line_start":274},{"id":"network:SKILL.md:275:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"astrale domain install https://agencies.example https://employees.example -i staging","category":"network","line_end":275,"severity":"low","line_start":275},{"id":"network:SKILL.md:277:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"astrale domain install agencies.example@1.5.0 https://employees.example --allow-issuer-change -i sta","category":"network","line_end":277,"severity":"low","line_start":277},{"id":"filesystem:SKILL.md:592:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"State lives under `ASTRALE_HOME`, or `~/.astrale` by default:","category":"filesystem","line_end":592,"severity":"high","line_start":592},{"id":"filesystem:SKILL.md:592:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"State lives under `ASTRALE_HOME`, or `~/.astrale` by default:","category":"filesystem","line_end":592,"severity":"medium","line_start":592},{"id":"sensitive:SKILL.md:603:credential-json-file","file":"SKILL.md","pattern":"Credential JSON file","snippet":"exchange/credentials.json","category":"sensitive","line_end":603,"severity":"high","line_start":603},{"id":"sensitive:SKILL.md:608:credential-json-file","file":"SKILL.md","pattern":"Credential JSON file","snippet":"`exchange/credentials.json` holds Domain-exchanged credentials until they expire;","category":"sensitive","line_end":608,"severity":"high","line_start":608},{"id":"blocker:SKILL.md:30:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"astrale whoami","category":"blocker","line_end":30,"severity":"low","line_start":30},{"id":"blocker:SKILL.md:153:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"astrale instance invitation status @invitation-id","category":"blocker","line_end":154,"severity":"low","line_start":153},{"id":"blocker:SKILL.md:180:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"The command requires the exact Invitation id and does not change its state.","category":"blocker","line_end":180,"severity":"low","line_start":180},{"id":"blocker:SKILL.md:346:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--node @existing-user-id \\","category":"blocker","line_end":346,"severity":"low","line_start":346},{"id":"blocker:SKILL.md:360:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--node @existing-operator-id \\","category":"blocker","line_end":360,"severity":"low","line_start":360},{"id":"blocker:SKILL.md:581:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"astrale whoami","category":"blocker","line_end":581,"severity":"low","line_start":581}],"finding_verdicts":[{"id":"external_commands:SKILL.md:3:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the CLI name, runtime, and help commands. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the CLI name, runtime, and help commands. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the CLI name, runtime, and help commands. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the CLI name, runtime, and help commands. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the CLI name, runtime, and help commands. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the CLI name, runtime, and help commands. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the CLI name, runtime, and help commands. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the command surface and authentication options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the command surface and authentication options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the command surface and authentication options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the command surface and authentication options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the command surface and authentication options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the command surface and authentication options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the command surface and authentication options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the command surface and authentication options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the command surface and authentication options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for user-directed issue reporting and its context options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for user-directed issue reporting and its context options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for user-directed issue reporting and its context options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for user-directed issue reporting and its context options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for user-directed issue reporting and its context options. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for UI setup, pinned source installation, and explicit overwrite safeguards. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for canonical paths and schema discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for canonical paths and schema discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for canonical paths and schema discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for canonical paths and schema discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for canonical paths and schema discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for canonical paths and schema discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for canonical paths and schema discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for canonical paths and schema discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for canonical paths and schema discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for canonical paths and schema discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for canonical paths and schema discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for canonical paths and schema discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for instance administration, bookmarks, and authorized invitation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for authorized root recovery with explicit identity selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for authorized root recovery with explicit identity selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:206:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for authorized root recovery with explicit identity selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for authorized root recovery with explicit identity selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for authorized root recovery with explicit identity selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for authorized root recovery with explicit identity selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for authorized root recovery with explicit identity selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the separation of deployment and installation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:222:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the separation of deployment and installation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the separation of deployment and installation workflows. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:226:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for release-pinned domain installation and registry authorization. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for release-pinned domain installation and registry authorization. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for release-pinned domain installation and registry authorization. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for release-pinned domain installation and registry authorization. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for release-pinned domain installation and registry authorization. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for release-pinned domain installation and registry authorization. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for release-pinned domain installation and registry authorization. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:244:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for release-pinned domain installation and registry authorization. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for explicit issuer-change consent and installation diagnostics. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for explicit issuer-change consent and installation diagnostics. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:250:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for explicit issuer-change consent and installation diagnostics. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:253:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for explicit issuer-change consent and installation diagnostics. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for explicit issuer-change consent and installation diagnostics. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:257:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for explicit issuer-change consent and installation diagnostics. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:258:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for explicit issuer-change consent and installation diagnostics. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for explicit issuer-change consent and installation diagnostics. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:268:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for compatibility checks and example domain operations. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:269:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for compatibility checks and example domain operations. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:270:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for compatibility checks and example domain operations. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:273:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for compatibility checks and example domain operations. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:282:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for compatibility checks and example domain operations. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:284:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only domain version discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:285:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only domain version discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:287:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only domain version discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:288:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only domain version discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:289:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only domain version discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:290:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only domain version discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only domain version discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only domain version discovery. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:297:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for permission-scoped installed-domain inventory. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:300:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for permission-scoped installed-domain inventory. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:302:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for permission-scoped installed-domain inventory. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:305:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for permission-scoped installed-domain inventory. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for permission-scoped installed-domain inventory. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:307:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for permission-scoped installed-domain inventory. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:309:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for permission-scoped installed-domain inventory. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for permission-scoped installed-domain inventory. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:314:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for internal registry plumbing that users should not invoke manually. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for internal registry plumbing that users should not invoke manually. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:322:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for documented uninstall safeguards and bookmark TLS trust. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:325:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for documented uninstall safeguards and bookmark TLS trust. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:327:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for documented uninstall safeguards and bookmark TLS trust. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:329:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for documented uninstall safeguards and bookmark TLS trust. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:330:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for documented uninstall safeguards and bookmark TLS trust. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:338:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for identity registration against authorized existing nodes. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for identity registration against authorized existing nodes. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:348:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for identity registration against authorized existing nodes. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:351:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for identity registration against authorized existing nodes. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:354:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for identity registration against authorized existing nodes. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:358:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for identity registration against authorized existing nodes. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:363:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for identity registration against authorized existing nodes. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:365:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for audience-bound token issuance and principal selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:367:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for audience-bound token issuance and principal selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:370:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for audience-bound token issuance and principal selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:372:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for audience-bound token issuance and principal selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:375:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for audience-bound token issuance and principal selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:379:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for audience-bound token issuance and principal selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:385:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for audience-bound token issuance and principal selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:386:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for audience-bound token issuance and principal selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:387:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for audience-bound token issuance and principal selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:390:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for audience-bound token issuance and principal selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:392:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for the distinction between Kernel and upstream identity tokens. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:396:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for exact node reads and optional schema properties. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:398:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for exact node reads and optional schema properties. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:400:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for exact node reads and optional schema properties. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:402:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for exact node reads and optional schema properties. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:404:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for exact node reads and optional schema properties. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:406:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for exact node reads and optional schema properties. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:410:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for exact node reads and optional schema properties. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:412:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for exact node reads and optional schema properties. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:413:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for exact node reads and optional schema properties. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:414:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for exact node reads and optional schema properties. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:416:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only schema introspection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:418:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only schema introspection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:420:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only schema introspection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:425:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only schema introspection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:428:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only schema introspection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:429:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for read-only schema introspection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:431:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:433:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:434:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:435:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:438:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:439:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:440:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:441:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:442:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:443:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:445:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:452:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:454:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for bounded graph queries and caller-bound pagination. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:458:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for atomic mutation input and offline dry mode. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:459:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for atomic mutation input and offline dry mode. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:460:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for atomic mutation input and offline dry mode. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:461:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for atomic mutation input and offline dry mode. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:463:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for atomic mutation input and offline dry mode. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:466:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for atomic mutation input and offline dry mode. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:470:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for call inputs, previews, and explicit binary output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:471:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for call inputs, previews, and explicit binary output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:473:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for call inputs, previews, and explicit binary output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:477:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for call inputs, previews, and explicit binary output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:479:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for call inputs, previews, and explicit binary output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:487:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for call inputs, previews, and explicit binary output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:489:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for typed call inputs, protected secret input, and Admin target selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:490:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for typed call inputs, protected secret input, and Admin target selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:491:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for typed call inputs, protected secret input, and Admin target selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:494:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for typed call inputs, protected secret input, and Admin target selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:496:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for typed call inputs, protected secret input, and Admin target selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:497:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for typed call inputs, protected secret input, and Admin target selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:498:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for typed call inputs, protected secret input, and Admin target selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:499:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for typed call inputs, protected secret input, and Admin target selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:502:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for typed call inputs, protected secret input, and Admin target selection. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:505:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for secret rotation using protected file or piped input. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:506:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for secret rotation using protected file or piped input. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:507:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for secret rotation using protected file or piped input. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:510:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for secret rotation using protected file or piped input. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:513:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for secret rotation using protected file or piped input. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:517:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:518:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:521:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:525:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:527:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:528:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:529:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:530:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:531:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:532:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:533:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:535:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:536:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:537:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:538:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:539:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:540:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:541:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for journal reads, caller filters, and structured streaming output. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:545:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for user-directed views and authenticated browser profiles. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:546:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for user-directed views and authenticated browser profiles. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:549:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for user-directed views and authenticated browser profiles. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:556:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for user-directed views and authenticated browser profiles. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:558:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for user-directed views and authenticated browser profiles. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:559:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for user-directed views and authenticated browser profiles. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:560:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for user-directed views and authenticated browser profiles. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:565:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for structured output and explicit automation settings. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:566:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for structured output and explicit automation settings. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:567:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for structured output and explicit automation settings. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:568:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for structured output and explicit automation settings. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:569:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for structured output and explicit automation settings. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:577:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for connection diagnostics and authorization-aware troubleshooting. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:582:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for connection diagnostics and authorization-aware troubleshooting. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:584:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for connection diagnostics and authorization-aware troubleshooting. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:586:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for connection diagnostics and authorization-aware troubleshooting. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:587:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for connection diagnostics and authorization-aware troubleshooting. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:588:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for connection diagnostics and authorization-aware troubleshooting. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:592:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for local state and owner-private, expiring credential caches. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:594:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for local state and owner-private, expiring credential caches. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:606:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for local state and owner-private, expiring credential caches. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:608:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for local state and owner-private, expiring credential caches. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:609:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for local state and owner-private, expiring credential caches. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:610:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for local state and owner-private, expiring credential caches. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:618:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for optional local storage roots. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:619:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for optional local storage roots. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:623:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for a documentary source map, not bundled executable files. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:624:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for a documentary source map, not bundled executable files. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:625:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for a documentary source map, not bundled executable files. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:626:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for a documentary source map, not bundled executable files. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:627:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for a documentary source map, not bundled executable files. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:628:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for a documentary source map, not bundled executable files. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:629:ruby-shell-backtick-execution","reason":"Backticks here format Markdown documentation for a documentary source map, not bundled executable files. They are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:373:shell-command-substitution","reason":"The substitution runs the fixed astrale token command and captures its output without evaluating it as code. Subsequent argv exposure is assessed separately.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:387:shell-command-substitution","reason":"The quoted substitution runs a fixed token command, not user-controlled shell source. Its credential argument exposure is assessed as a separate semantic finding.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:372:template-literal-with-command-substitution","reason":"This is a Markdown Bash fence, not a JavaScript template literal. The fixed token substitution does not execute its returned credential as code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:387:template-literal-with-command-substitution","reason":"This table cell uses Markdown inline code, not a JavaScript template literal. Credential argument exposure is assessed separately from this syntax mismatch.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:60:python-http-libraries","reason":"The word requests describes authentication behavior in prose. There is no Python HTTP import or network library call at this location.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:158:hardcoded-url","reason":"The reserved example.com URL illustrates an explicitly named staging bookmark. No secret transmission or attacker endpoint is specified.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:228:hardcoded-url","reason":"These are protocol prefixes describing HTTPS deployments and local HTTP hosts, not a hardcoded destination. Release digest verification is documented immediately afterwards.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:274:hardcoded-url","reason":"The reserved .example URL illustrates a user-directed staging domain install. No credential exfiltration destination or automatic execution is present.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:275:hardcoded-url","reason":"Both reserved .example URLs demonstrate grouped staging installation. The documentation describes atomic installation and release pin verification, not covert data transmission.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:277:hardcoded-url","reason":"The reserved .example URL illustrates mixed version and deployment installation with explicit issuer consent. It is not an attacker endpoint or an exfiltration instruction.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:592:hidden-file-in-home-directory","reason":"The hidden home directory is documented application state under an optional configurable root. No command accesses unrelated hidden files or establishes covert persistence.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:592:hidden-file-access","reason":"This prose names the default local state directory; it does not perform a filesystem access. No unrelated secret collection is requested.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:603:credential-json-file","reason":"The filename appears in a local storage inventory, not a read or upload command. Lines 608-616 describe expiring, owner-private caches and issuer verification.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:608:credential-json-file","reason":"The reference explains an expiring Domain credential cache that subsequent prose identifies as owner-private. No instruction copies, exposes, or uploads its contents.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:30:system-reconnaissance","reason":"Astrale whoami reports the selected application identity in the command reference. It is not operating-system user discovery or host reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:153:system-reconnaissance","reason":"This queries one exact Astrale Invitation and instance status for an authorized administration workflow. It does not enumerate host processes or operating-system identities.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:180:system-reconnaissance","reason":"This sentence explicitly describes a read-only observation requiring the exact Invitation identifier. No reconnaissance command or state change occurs here.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:346:system-reconnaissance","reason":"The placeholder names an existing application Identity Node for registration. The surrounding text requires caller authority and does not query operating-system users.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:360:system-reconnaissance","reason":"The placeholder identifies an application operator Node in an authorized registration example. It is not a host-account discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:581:system-reconnaissance","reason":"Astrale whoami checks the selected application identity during connection diagnostics. No host reconnaissance or unrelated account enumeration is instructed.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Bearer Credentials Exposed Through Command Arguments","severity":"medium","locations":[{"file":"SKILL.md","line_end":374,"line_start":373},{"file":"SKILL.md","line_end":387,"line_start":387}],"confidence":0.94,"description":"The examples pass minted bearer credentials using --creds \"$TOKEN\" and --creds \"$(astrale token --raw)\". Shell expansion places credentials in process arguments, potentially exposing them to process inspection or execution logging while tokens remain valid.","confidence_reasoning":"The examples directly expand bearer credentials into argv. Exposure depends on local process visibility and logging; short token lifetimes reduce the exploitation window."}],"subject_marketplace_commit_sha":"e406bf64b5db6e514879399e87b346fa7ff7c2fb","subject_content_hash":"af303f25166fedac3221dad6c6b98a6b2b83eef3537bb334c23902acd6292b63","subject_tree_hash":"c121e99c7df0049e1e87e401c854c0289e29803305385ce27bb5d563916d0eb0","subject_plugin_path":"skills/astrale-os/astrale-cli","audit_payload_hash":"03f89c4bd02ebe95912320d387ef8e86","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"e406bf64b5db6e514879399e87b346fa7ff7c2fb","contentHash":"af303f25166fedac3221dad6c6b98a6b2b83eef3537bb334c23902acd6292b63","treeHash":"c121e99c7df0049e1e87e401c854c0289e29803305385ce27bb5d563916d0eb0","pluginPath":"skills/astrale-os/astrale-cli","auditPayloadHash":"03f89c4bd02ebe95912320d387ef8e86"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/astrale-os-astrale-cli/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}