{"data":{"skill":{"slug":"bellybook-genesis","name":"genesis","icon":"📦","repo":"https://github.com/BellyBook/genesis/tree/main/","status":"approved","author":"BellyBook","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"c4c0a6c9-4a5c-4c2c-83b0-7bf817fa88bc","skill_id":"b333fcba-cd88-4439-a05c-dc497e4e69b8","version":7,"content_hash":"911444561763a9bfc12967d27ce2957d","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported many high-risk patterns, but manual review found most were false positives from markdown examples, CSS color tokens, Go checksum data, fixed build paths, and SQLModel session.exec calls. The skill is still medium risk because it guides agents to copy files, run package managers and dev servers, read environment configuration, and generate networked backend templates. Publish with a warning to review commands and dependencies before execution.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":62,"line_start":59},{"file":"SKILL.md","line_end":90,"line_start":87},{"file":"SKILL.md","line_end":118,"line_start":113},{"file":"SKILL.md","line_end":154,"line_start":148},{"file":"templates/backend-python/local-run.sh","line_end":7,"line_start":1},{"file":"templates/backend-go/magefile.go","line_end":29,"line_start":26},{"file":"templates/backend-go/magefile.go","line_end":62,"line_start":56}]},{"factor":"network","evidence":[{"file":"templates/backend-go/cmd/api/main.go","line_end":70,"line_start":68},{"file":"templates/backend-python/app/main.py","line_end":66,"line_start":60},{"file":"references/taro-miniapp.md","line_end":113,"line_start":113}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":60,"line_start":59},{"file":"SKILL.md","line_end":88,"line_start":87},{"file":"SKILL.md","line_end":114,"line_start":113},{"file":"SKILL.md","line_end":149,"line_start":148},{"file":"templates/miniapp/config/index.js","line_end":56,"line_start":53}]},{"factor":"scripts","evidence":[{"file":"templates/backend-go/magefile.go","line_end":29,"line_start":26},{"file":"templates/backend-go/magefile.go","line_end":50,"line_start":35},{"file":"templates/backend-python/local-run.sh","line_end":7,"line_start":1},{"file":"templates/miniapp/config/index.js","line_end":18,"line_start":17}]},{"factor":"env_access","evidence":[{"file":"templates/backend-python/app/config.py","line_end":35,"line_start":34},{"file":"templates/backend-python/local-run.sh","line_end":7,"line_start":3},{"file":"templates/backend-go/internal/config/config.go","line_end":34,"line_start":30},{"file":"templates/backend-go/internal/config/config.go","line_end":118,"line_start":112},{"file":"templates/miniapp/config/index.js","line_end":115,"line_start":110}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Project Initialization Runs Shell Commands","verdict":"TRUE_POSITIVE","locations":[{"file":"SKILL.md","line_end":62,"line_start":59},{"file":"SKILL.md","line_end":90,"line_start":87},{"file":"SKILL.md","line_end":118,"line_start":113},{"file":"SKILL.md","line_end":154,"line_start":148}],"confidence":0.82,"description":"The skill instructs agents to copy template directories, edit files with sed, install dependencies, and start development servers. These are legitimate scaffolding actions, but user-supplied project names and target directories should be validated before command execution.","confidence_reasoning":"The command sequences are explicitly present in the skill instructions and include placeholders for user-controlled paths and names. The intent is project scaffolding, so the risk is operational rather than clearly malicious."},{"title":"Template Reads Environment and Database Secrets","verdict":"TRUE_POSITIVE","locations":[{"file":"templates/backend-python/app/config.py","line_end":35,"line_start":24},{"file":"templates/backend-python/local-run.sh","line_end":7,"line_start":3},{"file":"templates/backend-go/internal/config/config.go","line_end":118,"line_start":112}],"confidence":0.78,"description":"The Python and Go backend templates load database settings from environment files or environment variables, including database passwords. This is normal backend configuration, but generated projects must avoid logging or committing these secrets.","confidence_reasoning":"The files directly read .env.dev, .env, DB_HOST, and DB_PASSWORD. This supports the advertised backend templates, but it is real secret-handling behavior that users should review."},{"title":"Permissive CORS in FastAPI Template","verdict":"TRUE_POSITIVE","locations":[{"file":"templates/backend-python/app/main.py","line_end":66,"line_start":60}],"confidence":0.93,"description":"The FastAPI template allows all origins, methods, and headers while also allowing credentials. This can be unsafe if copied into production without narrowing allowed origins.","confidence_reasoning":"The CORS settings are explicit and combine allow_origins=[\"*\"] with allow_credentials=True. This is a concrete web security concern in generated backend projects."}],"low_findings":[{"title":"Most Static Findings Are Benign Template or Documentation Patterns","verdict":"FALSE_POSITIVE","locations":[{"file":"references/backend-python.md","line_end":149,"line_start":143},{"file":"templates/backend-python/app/db/session.py","line_end":54,"line_start":48},{"file":"references/taro-miniapp.md","line_end":92,"line_start":89},{"file":"templates/miniapp/src/app.css","line_end":6,"line_start":3},{"file":"templates/backend-go/go.sum","line_end":8,"line_start":1}],"confidence":0.88,"description":"Several flagged patterns are false positives: SQLModel session.exec is not Python exec, Taro path.resolve uses a fixed source path, CSS hexadecimal color values are not cryptographic algorithms, and Go checksum entries are expected dependency metadata.","confidence_reasoning":"Manual review of representative locations confirms these patterns are framework methods, fixed build configuration, styling tokens, or package checksums. They do not show malicious behavior by themselves."},{"title":"Hardcoded Local Development URLs","verdict":"FALSE_POSITIVE","locations":[{"file":"templates/backend-go/cmd/api/main.go","line_end":70,"line_start":68}],"confidence":0.91,"description":"The Go template logs localhost service and health-check URLs. These are local development endpoints, not evidence of data exfiltration.","confidence_reasoning":"The URLs are derived from the configured local server port and are only printed to logs for developer convenience. No external network destination is contacted at these lines."}],"dangerous_patterns":[{"title":"External Command Workflow","verdict":"TRUE_POSITIVE","locations":[{"file":"SKILL.md","line_end":62,"line_start":59},{"file":"SKILL.md","line_end":90,"line_start":87},{"file":"SKILL.md","line_end":118,"line_start":113},{"file":"SKILL.md","line_end":154,"line_start":148}],"confidence":0.86,"description":"The skill contains command blocks that run cp, sed, npm, uv, go, and find during project setup. These commands are expected for a scaffolding skill but require user-visible review.","confidence_reasoning":"The command blocks are explicit and central to the skill behavior. Risk depends on how the assistant substitutes target paths and project names."},{"title":"Environment File Loading","verdict":"TRUE_POSITIVE","locations":[{"file":"templates/backend-python/local-run.sh","line_end":7,"line_start":3},{"file":"templates/backend-python/app/config.py","line_end":35,"line_start":34}],"confidence":0.8,"description":"The Python backend runner sources .env.dev and the application config reads .env values for database connection settings. This can expose secrets if logs or generated files are mishandled.","confidence_reasoning":"The evidence directly shows environment-file loading. This is a legitimate backend pattern but still a sensitive-data handling pattern."}],"files_scanned":75,"total_lines":6346,"audit_model":"codex","audited_at":"2026-06-28T15:41:47.185+00:00","created_at":"2026-06-28T16:54:55.621117+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":3,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":2,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}