{"data":{"skill":{"slug":"atxp-dev-atxp","name":"atxp","icon":"📦","repo":"https://github.com/atxp-dev/cli/tree/main/skills/atxp/","status":"approved","author":"atxp-dev","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"83c9255c-2cab-4143-a4d6-8108d6dd424f","skill_id":"12af3276-49a1-4498-a1c8-a2a988418632","version":3,"content_hash":"ca2cad3978839010750276472ae97677","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"The skill is a thin reference for ATXP CLI and MCP services, and most markdown backtick detections are not Ruby execution. Several findings remain valid because the instructions call external npx commands, source a hidden config file, read an ATXP connection token, and contact ATXP network services.","remediation":[{"issue":"External commands run through npx.","severity":"medium","suggestion":"Require explicit user confirmation before running ATXP commands, and pin or verify the package source when possible."},{"issue":"Hidden config is sourced from the user home directory.","severity":"high","suggestion":"Avoid sourcing shell files directly; document a safer token-loading method that reads only the required ATXP connection value."},{"issue":"ATXP connection credentials are read from the environment.","severity":"high","suggestion":"Warn users not to paste ATXP_CONNECTION into prompts, logs, issues, or generated files."},{"issue":"Paid and deployment-capable tools may create costs or resources.","severity":"medium","suggestion":"Add a confirmation requirement before paid generation, X search, or PaaS deployment actions."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":19,"line_start":12},{"file":"SKILL.md","line_end":25,"line_start":19},{"file":"SKILL.md","line_end":26,"line_start":25},{"file":"SKILL.md","line_end":27,"line_start":26},{"file":"SKILL.md","line_end":28,"line_start":27},{"file":"SKILL.md","line_end":29,"line_start":28},{"file":"SKILL.md","line_end":33,"line_start":29},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":43,"line_start":37},{"file":"SKILL.md","line_end":55,"line_start":43},{"file":"SKILL.md","line_end":61,"line_start":55},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":66,"line_start":66}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":47,"line_start":47}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":18,"line_start":18}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":48,"line_start":48}]}],"critical_findings":[],"high_findings":[{"title":"Hidden file in home directory","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.94,"description":"source ~/.atxp/config","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"Line 18 instructs `source ~/.atxp/config`, which reads and executes shell content from a hidden home-directory file. That can load secrets and run arbitrary shell statements."},{"title":"Environment file access","locations":[{"file":"SKILL.md","line_end":48,"line_start":48}],"confidence":0.8,"description":"account: new ATXPAccount(process.env.ATXP_CONNECTION),","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The exact code reads an environment variable rather than an environment file, but `ATXP_CONNECTION` is used as account credential material. Keeping the sensitive finding is appropriate because the secret is passed into the ATXP client."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":3,"line_start":3}],"confidence":0.84,"description":"description: Access ATXP paid API tools for web search, AI image generation, music creation, video g","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The cited description explicitly requires `npx atxp login`, which executes an external npm package during authentication. The markdown backticks are not Ruby execution, but the command instruction is real."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":19,"line_start":12}],"confidence":0.9,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The bash block includes `npx atxp login` and `source ~/.atxp/config`. Running an npm package and sourcing a shell config are real external command actions."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":25,"line_start":19}],"confidence":0.72,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The finding starts at a code-fence close, but its cited range reaches the command table that begins with `npx atxp search <query>`. This is an external CLI command instruction, so it is kept."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":26,"line_start":25}],"confidence":0.88,"description":"| `npx atxp search <query>` | Real-time web search |","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Line 25 documents `npx atxp search <query>`, which executes the ATXP CLI and sends a query to an external service. This is intentional but security-relevant command execution."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":27,"line_start":26}],"confidence":0.88,"description":"| `npx atxp image <prompt>` | AI image generation |","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Line 26 documents `npx atxp image <prompt>`, which runs an external CLI and transmits prompt content for image generation. This is intentional but still an external command risk."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":28,"line_start":27}],"confidence":0.88,"description":"| `npx atxp music <prompt>` | AI music generation |","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Line 27 documents `npx atxp music <prompt>`, which runs an external CLI and sends user prompt data to a paid service. This is a real external command pathway."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":29,"line_start":28}],"confidence":0.88,"description":"| `npx atxp video <prompt>` | AI video generation |","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Line 28 documents `npx atxp video <prompt>`, which runs an external CLI and sends prompt content to a video generation service. This is expected but security-relevant."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":33,"line_start":29}],"confidence":0.88,"description":"| `npx atxp x <query>` | X/Twitter search |","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Line 29 documents `npx atxp x <query>`, which runs the ATXP CLI and sends search terms to an external X search service. This is real external command use."},{"title":"Hidden file access","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.94,"description":"source ~/.atxp/config","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"Line 18 accesses `~/.atxp/config`, a hidden user configuration path likely to contain authentication material. The access is intentional but security-sensitive."},{"title":"Cost-Incurring API and Deployment Actions","locations":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":33,"line_start":25}],"confidence":0.88,"description":"The skill describes paid API tools and includes commands for generation services plus a PaaS deployment reference. Automated use could spend credits or create cloud resources without clear user confirmation.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The file explicitly says the tools are paid and lists media generation commands plus serverless deployment capabilities. This is a business-logic risk separate from the raw command and network patterns."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":47,"line_start":47}],"confidence":0.92,"description":"mcpServer: 'https://search.mcp.atxp.ai',","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The TypeScript sample hardcodes `https://search.mcp.atxp.ai` as the MCP server. This is intentional, but it creates outbound network communication to a third-party service."},{"title":"Environment variable access (dot notation)","locations":[{"file":"SKILL.md","line_end":48,"line_start":48}],"confidence":0.88,"description":"account: new ATXPAccount(process.env.ATXP_CONNECTION),","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"Line 48 reads `process.env.ATXP_CONNECTION` for account authentication. This is expected for the client, but it uses an environment value that may contain a secret token."},{"title":"Environment variable object","locations":[{"file":"SKILL.md","line_end":48,"line_start":48}],"confidence":0.88,"description":"account: new ATXPAccount(process.env.ATXP_CONNECTION),","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"Line 48 accesses the environment object to retrieve `ATXP_CONNECTION`. The value appears to be an authentication connection string and should be treated as sensitive."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":67,"audit_model":"codex","audited_at":"2026-07-05T02:58:59.619+00:00","created_at":"2026-07-05T03:33:38.774894+00:00","static_findings":[{"id":"external_commands:SKILL.md:3:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"description: Access ATXP paid API tools for web search, AI image generation, music creation, video g","category":"external_commands","line_end":3,"severity":"medium","line_start":3},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":19,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":25,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `npx atxp search <query>` | Real-time web search |","category":"external_commands","line_end":26,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `npx atxp image <prompt>` | AI image generation |","category":"external_commands","line_end":27,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `npx atxp music <prompt>` | AI music generation |","category":"external_commands","line_end":28,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `npx atxp video <prompt>` | AI video generation |","category":"external_commands","line_end":29,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `npx atxp x <query>` | X/Twitter search |","category":"external_commands","line_end":33,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Deploy serverless applications with functions, databases, object storage, custom domains, and analyt","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Verify `$ATXP_CONNECTION` is set","category":"external_commands","line_end":43,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":55,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":61,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `search.mcp.atxp.ai` | `search_search` |","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `image.mcp.atxp.ai` | `image_create_image` |","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `music.mcp.atxp.ai` | `music_create` |","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `video.mcp.atxp.ai` | `create_video` |","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `x-live-search.mcp.atxp.ai` | `x_live_search` |","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `paas.mcp.atxp.ai` | PaaS tools (see `atxp-paas` skill) |","category":"external_commands","line_end":66,"severity":"medium","line_start":66},{"id":"network:SKILL.md:47:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"mcpServer: 'https://search.mcp.atxp.ai',","category":"network","line_end":47,"severity":"low","line_start":47},{"id":"filesystem:SKILL.md:18:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"source ~/.atxp/config","category":"filesystem","line_end":18,"severity":"high","line_start":18},{"id":"filesystem:SKILL.md:18:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"source ~/.atxp/config","category":"filesystem","line_end":18,"severity":"medium","line_start":18},{"id":"env_access:SKILL.md:48:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"account: new ATXPAccount(process.env.ATXP_CONNECTION),","category":"env_access","line_end":48,"severity":"low","line_start":48},{"id":"env_access:SKILL.md:48:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"account: new ATXPAccount(process.env.ATXP_CONNECTION),","category":"env_access","line_end":48,"severity":"low","line_start":48},{"id":"sensitive:SKILL.md:48:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"account: new ATXPAccount(process.env.ATXP_CONNECTION),","category":"sensitive","line_end":48,"severity":"high","line_start":48},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: Access ATXP paid API tools for web search, AI image generation, music creation, video g","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:SKILL.md:8:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Access ATXP's paid API tools via CLI.","category":"blocker","line_end":8,"severity":"low","line_start":8}],"finding_verdicts":[{"id":"external_commands:SKILL.md:3:ruby-shell-backtick-execution","reason":"The cited description explicitly requires `npx atxp login`, which executes an external npm package during authentication. The markdown backticks are not Ruby execution, but the command instruction is real.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"The bash block includes `npx atxp login` and `source ~/.atxp/config`. Running an npm package and sourcing a shell config are real external command actions.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The finding starts at a code-fence close, but its cited range reaches the command table that begins with `npx atxp search <query>`. This is an external CLI command instruction, so it is kept.","verdict":"confirmed","severity":"medium","confidence":0.72},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"Line 25 documents `npx atxp search <query>`, which executes the ATXP CLI and sends a query to an external service. This is intentional but security-relevant command execution.","verdict":"confirmed","severity":"medium","confidence":0.88},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Line 26 documents `npx atxp image <prompt>`, which runs an external CLI and transmits prompt content for image generation. This is intentional but still an external command risk.","verdict":"confirmed","severity":"medium","confidence":0.88},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Line 27 documents `npx atxp music <prompt>`, which runs an external CLI and sends user prompt data to a paid service. This is a real external command pathway.","verdict":"confirmed","severity":"medium","confidence":0.88},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"Line 28 documents `npx atxp video <prompt>`, which runs an external CLI and sends prompt content to a video generation service. This is expected but security-relevant.","verdict":"confirmed","severity":"medium","confidence":0.88},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"Line 29 documents `npx atxp x <query>`, which runs the ATXP CLI and sends search terms to an external X search service. This is real external command use.","verdict":"confirmed","severity":"medium","confidence":0.88},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Line 33 contains markdown-formatted service and skill names, not a shell command or Ruby backtick execution. The PaaS capability is better handled as a semantic business-risk finding.","verdict":"false_positive","confidence":0.86},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The cited line uses markdown backticks around an environment variable name. It does not itself execute a command, although nearby sections describe command use separately.","verdict":"false_positive","confidence":0.78},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The cited block is TypeScript client sample code, not shell execution. Its network and environment-token behavior are covered by separate static findings.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The cited line closes a markdown code fence and then introduces an MCP server table. It does not contain a shell command or executable backtick expression.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"Line 61 lists an MCP server host and tool name inside markdown backticks. These are identifiers, not external command execution syntax.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"Line 62 lists an MCP server host and tool name inside markdown backticks. It does not instruct the agent to run a command.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"Line 63 lists an MCP server host and tool name. The markdown backticks are formatting and not executable code.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"Line 64 lists an MCP server host and tool name. It does not contain a shell command, Ruby backtick execution, or command substitution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"Line 65 lists an MCP server host and tool name in a markdown table. The backticks are only inline code formatting.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"Line 66 references a PaaS MCP host and another skill name, not a shell command. No backtick execution is present.","verdict":"false_positive","confidence":0.9},{"id":"network:SKILL.md:47:hardcoded-url","reason":"The TypeScript sample hardcodes `https://search.mcp.atxp.ai` as the MCP server. This is intentional, but it creates outbound network communication to a third-party service.","verdict":"confirmed","severity":"low","confidence":0.92},{"id":"filesystem:SKILL.md:18:hidden-file-in-home-directory","reason":"Line 18 instructs `source ~/.atxp/config`, which reads and executes shell content from a hidden home-directory file. That can load secrets and run arbitrary shell statements.","verdict":"confirmed","severity":"high","confidence":0.94},{"id":"filesystem:SKILL.md:18:hidden-file-access","reason":"Line 18 accesses `~/.atxp/config`, a hidden user configuration path likely to contain authentication material. The access is intentional but security-sensitive.","verdict":"confirmed","severity":"medium","confidence":0.94},{"id":"env_access:SKILL.md:48:environment-variable-access-dot-notation","reason":"Line 48 reads `process.env.ATXP_CONNECTION` for account authentication. This is expected for the client, but it uses an environment value that may contain a secret token.","verdict":"confirmed","severity":"low","confidence":0.88},{"id":"env_access:SKILL.md:48:environment-variable-object","reason":"Line 48 accesses the environment object to retrieve `ATXP_CONNECTION`. The value appears to be an authentication connection string and should be treated as sensitive.","verdict":"confirmed","severity":"low","confidence":0.88},{"id":"sensitive:SKILL.md:48:environment-file-access","reason":"The exact code reads an environment variable rather than an environment file, but `ATXP_CONNECTION` is used as account credential material. Keeping the sensitive finding is appropriate because the secret is passed into the ATXP client.","verdict":"confirmed","severity":"high","confidence":0.8},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"Line 3 describes ATXP paid API tools and authentication. It does not request local system discovery, host enumeration, or reconnaissance.","verdict":"false_positive","confidence":0.93},{"id":"blocker:SKILL.md:8:system-reconnaissance","reason":"Line 8 states that the skill accesses ATXP paid API tools through a CLI. No local system reconnaissance behavior is described.","verdict":"false_positive","confidence":0.93}],"semantic_findings":[{"title":"Cost-Incurring API and Deployment Actions","severity":"medium","locations":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":33,"line_start":25}],"confidence":0.88,"description":"The skill describes paid API tools and includes commands for generation services plus a PaaS deployment reference. Automated use could spend credits or create cloud resources without clear user confirmation.","confidence_reasoning":"The file explicitly says the tools are paid and lists media generation commands plus serverless deployment capabilities. This is a business-logic risk separate from the raw command and network patterns."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":2,"capabilityReviewCount":13,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}