{"data":{"skill":{"slug":"blackforge-so-blackforge","name":"blackforge","icon":"📦","repo":"https://github.com/blackforge-so/skill/tree/b87e294feb12e6582cf98eb9782ff297f38fb028/","status":"approved","author":"blackforge-so","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"18c46746-8ec3-48cd-bb96-f87b2ce5d551","skill_id":"da486132-b098-4fce-a294-1ee7f2c66557","version":1,"content_hash":"v3:ebcb2eb7ad397e055696549961e5b4f8cfeb7ea5:ead6047d1625478b5e92101a7150d0accb1f149b5d6fb1b094ad81e429839979:27ca902c2a9126c524cb0fb89026d31a5dc01dad81e91bbe07ec8e9852bbd952:736b696c6c732f626c61636b666f7267652d736f2f626c61636b666f726765:dccb7746076946986e038520ef13d1f9","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The static alerts reflect documentation syntax, market vocabulary, public catalog access, and intended authentication rather than demonstrated malicious behavior. Two semantic risks remain: automatic execution of unpinned npm clients and credential exposure through documented command arguments. No evidence found of prompt injection, deliberate credential theft, or unrelated sensitive-file access in the reviewed sources.","remediation":[{"issue":"The fallback and MCP configuration execute unpinned npm packages without an explicit installation approval step.","severity":"medium","suggestion":"Pin reviewed client versions, verify package integrity, and require user approval before downloading or executing a missing client. Prefer an existing reviewed installation."},{"issue":"Setup examples encourage placing API credentials directly in command arguments.","severity":"medium","suggestion":"Use an interactive hidden-input credential prompt or a supported secret manager instead of literal keys in commands. Keep credential files private and outside version control."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":".claude-plugin/plugin.json","line_end":8,"line_start":8},{"file":".claude-plugin/plugin.json","line_end":10,"line_start":10},{"file":".claude-plugin/plugin.json","line_end":11,"line_start":11},{"file":"scripts/check-catalog-sync.mjs","line_end":57,"line_start":57},{"file":"scripts/check-catalog-sync.mjs","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":57,"line_start":57}]},{"factor":"filesystem","evidence":[{"file":"references/setup.md","line_end":99,"line_start":99},{"file":"references/setup.md","line_end":99,"line_start":99},{"file":"scripts/check-catalog-sync.mjs","line_end":39,"line_start":39},{"file":"scripts/check-catalog-sync.mjs","line_end":44,"line_start":44},{"file":"scripts/latest-json.sh","line_end":16,"line_start":16},{"file":"scripts/latest-json.sh","line_end":16,"line_start":16},{"file":"scripts/latest-json.sh","line_end":24,"line_start":24}]},{"factor":"env_access","evidence":[{"file":"references/setup.md","line_end":46,"line_start":46},{"file":"references/setup.md","line_end":57,"line_start":57},{"file":"references/setup.md","line_end":66,"line_start":66},{"file":"references/setup.md","line_end":102,"line_start":102},{"file":"scripts/check-catalog-sync.mjs","line_end":37,"line_start":37},{"file":"scripts/check-catalog-sync.mjs","line_end":37,"line_start":37},{"file":"scripts/latest-json.sh","line_end":15,"line_start":15},{"file":"scripts/latest-json.sh","line_end":16,"line_start":16}]},{"factor":"external_commands","evidence":[{"file":"scripts/check-catalog-sync.mjs","line_end":10,"line_start":10},{"file":"scripts/check-catalog-sync.mjs","line_end":11,"line_start":11},{"file":"scripts/check-catalog-sync.mjs","line_end":28,"line_start":28},{"file":"scripts/check-catalog-sync.mjs","line_end":29,"line_start":29},{"file":"scripts/check-catalog-sync.mjs","line_end":30,"line_start":30},{"file":"scripts/check-catalog-sync.mjs","line_end":33,"line_start":33},{"file":"scripts/check-catalog-sync.mjs","line_end":46,"line_start":46},{"file":"scripts/check-catalog-sync.mjs","line_end":50,"line_start":50},{"file":"scripts/check-catalog-sync.mjs","line_end":58,"line_start":58},{"file":"scripts/check-catalog-sync.mjs","line_end":62,"line_start":62},{"file":"scripts/check-catalog-sync.mjs","line_end":78,"line_start":78},{"file":"scripts/check-catalog-sync.mjs","line_end":91,"line_start":91},{"file":"scripts/check-catalog-sync.mjs","line_end":99,"line_start":99},{"file":"scripts/check-catalog-sync.mjs","line_end":103,"line_start":103},{"file":"scripts/check-catalog-sync.mjs","line_end":108,"line_start":108},{"file":"scripts/check-catalog-sync.mjs","line_end":117,"line_start":117},{"file":"scripts/check-catalog-sync.mjs","line_end":118,"line_start":118},{"file":"scripts/check-catalog-sync.mjs","line_end":129,"line_start":129},{"file":"scripts/check-catalog-sync.mjs","line_end":130,"line_start":130},{"file":"scripts/check-catalog-sync.mjs","line_end":133,"line_start":133},{"file":"scripts/check-catalog-sync.mjs","line_end":137,"line_start":137},{"file":"scripts/check-catalog-sync.mjs","line_end":138,"line_start":138},{"file":"scripts/check-catalog-sync.mjs","line_end":140,"line_start":140},{"file":"scripts/check-catalog-sync.mjs","line_end":149,"line_start":149},{"file":"scripts/check-catalog-sync.mjs","line_end":157,"line_start":157},{"file":"scripts/check-catalog-sync.mjs","line_end":162,"line_start":162},{"file":"scripts/check-catalog-sync.mjs","line_end":164,"line_start":164},{"file":"scripts/check-catalog-sync.mjs","line_end":165,"line_start":165},{"file":"scripts/check-catalog-sync.mjs","line_end":170,"line_start":170},{"file":"scripts/check-catalog-sync.mjs","line_end":171,"line_start":171},{"file":"scripts/check-catalog-sync.mjs","line_end":191,"line_start":191},{"file":"scripts/check-catalog-sync.mjs","line_end":197,"line_start":197},{"file":"scripts/check-catalog-sync.mjs","line_end":198,"line_start":198},{"file":"scripts/check-catalog-sync.mjs","line_end":204,"line_start":204},{"file":"scripts/check-catalog-sync.mjs","line_end":205,"line_start":205},{"file":"scripts/check-catalog-sync.mjs","line_end":206,"line_start":206},{"file":"scripts/latest-json.sh","line_end":4,"line_start":4},{"file":"scripts/latest-json.sh","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":71,"line_start":71}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Automatic Execution of Unpinned External Clients","locations":[{"file":"scripts/latest-json.sh","line_end":33,"line_start":23},{"file":".claude-plugin/plugin.json","line_end":25,"line_start":21},{"file":"SKILL.md","line_end":186,"line_start":184},{"file":"references/setup.md","line_end":57,"line_start":44}],"confidence":0.98,"description":"The wrapper falls back to \"npx -y @blackforge-so/cli\", and the plugin launches an unpinned MCP package. A compromised release could execute with user privileges and access available credentials. No evidence found that these packages are malicious; their implementations are outside this source review.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The fallback directly executes an unversioned package with automatic confirmation. The plugin uses the same mechanism, establishing supply-chain exposure without proving malicious intent."},{"title":"Credential Exposure Through Setup Command Arguments","locations":[{"file":"references/setup.md","line_end":67,"line_start":63},{"file":"references/setup.md","line_end":102,"line_start":95}],"confidence":0.95,"description":"The setup commands place \"BLACKFORGE_API_KEY=bf_your_key_here\" and \"blackforge auth set-key bf_your_key_here\" directly in arguments. Replacing these placeholders with real keys can expose credentials through shell history and process inspection.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The documented workflow requires substituting real credentials into command arguments. Exposure depends on local history and process visibility; the repository itself contains only placeholders."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":10,"total_lines":1078,"audit_model":"codex","audited_at":"2026-10-12T17:15:26.244+00:00","created_at":"2026-10-13T18:03:08.607844+00:00","static_findings":[{"id":"network:.claude-plugin/plugin.json:8:hardcoded-url","file":".claude-plugin/plugin.json","pattern":"Hardcoded URL","snippet":"\"url\": \"https://blackforge.so\"","category":"network","line_end":8,"severity":"low","line_start":8},{"id":"network:.claude-plugin/plugin.json:10:hardcoded-url","file":".claude-plugin/plugin.json","pattern":"Hardcoded URL","snippet":"\"homepage\": \"https://blackforge.so\",","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:.claude-plugin/plugin.json:11:hardcoded-url","file":".claude-plugin/plugin.json","pattern":"Hardcoded URL","snippet":"\"repository\": \"https://github.com/blackforge-so/skill\",","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"blocker:evals/trigger-eval.json:2:system-reconnaissance","file":"evals/trigger-eval.json","pattern":"System reconnaissance","snippet":"{\"query\": \"what's the resting bid depth for ETH on binance right now, like within 5% of the top of b","category":"blocker","line_end":2,"severity":"low","line_start":2},{"id":"blocker:evals/trigger-eval.json:9:system-reconnaissance","file":"evals/trigger-eval.json","pattern":"System reconnaissance","snippet":"{\"query\": \"how many rows do i have left this month on my blackforge key and what did i use recently\"","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:evals/trigger-eval.json:10:system-reconnaissance","file":"evals/trigger-eval.json","pattern":"System reconnaissance","snippet":"{\"query\": \"grab the order ladder rungs (0-3%, 3-6% etc) for the LINKUSDT bid side on gate right now\"","category":"blocker","line_end":10,"severity":"low","line_start":10},{"id":"blocker:references/metrics-glossary.md:47:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"> that bucket is flagged; solid means final.","category":"blocker","line_end":47,"severity":"low","line_start":47},{"id":"blocker:references/metrics-glossary.md:114:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `downDepth5` | Bid depth to -5% | quote | free | Resting buy liquidity from the best bid down to 5","category":"blocker","line_end":114,"severity":"low","line_start":114},{"id":"blocker:references/metrics-glossary.md:115:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `downDepth10` | Bid depth to -10% | quote | pro | Resting buy liquidity from the best bid down to ","category":"blocker","line_end":115,"severity":"low","line_start":115},{"id":"blocker:references/metrics-glossary.md:116:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `downDepth15` | Bid depth to -15% | quote | pro | Resting buy liquidity from the best bid down to ","category":"blocker","line_end":116,"severity":"low","line_start":116},{"id":"blocker:references/metrics-glossary.md:117:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `downDepth20` | Bid depth to -20% | quote | pro | Resting buy liquidity from the best bid down to ","category":"blocker","line_end":117,"severity":"low","line_start":117},{"id":"blocker:references/metrics-glossary.md:118:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `downDepthFull` | Total bid depth | quote | max | All resting buy liquidity across the entire orde","category":"blocker","line_end":118,"severity":"low","line_start":118},{"id":"blocker:references/metrics-glossary.md:119:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `askDepthReachPct` | Ask book reach | percent | pro | How far above the best ask, **in percent**, ","category":"blocker","line_end":119,"severity":"low","line_start":119},{"id":"blocker:references/metrics-glossary.md:120:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `bidDepthReachPct` | Bid book reach | percent | pro | How far below the best bid, **in percent**, ","category":"blocker","line_end":120,"severity":"low","line_start":120},{"id":"blocker:references/metrics-glossary.md:131:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `buyOrderVol3` | Bid volume 0 to 3% | quote | free | Resting buy liquidity in the slice from 0 to ","category":"blocker","line_end":131,"severity":"low","line_start":131},{"id":"blocker:references/metrics-glossary.md:132:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `buyOrderVol6` | Bid volume 3 to 6% | quote | free | Resting buy liquidity in the slice from 3 to ","category":"blocker","line_end":132,"severity":"low","line_start":132},{"id":"blocker:references/metrics-glossary.md:133:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `buyOrderVol9` | Bid volume 6 to 9% | quote | pro | Resting buy liquidity in the slice from 6 to 9","category":"blocker","line_end":133,"severity":"low","line_start":133},{"id":"blocker:references/metrics-glossary.md:134:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `buyOrderVol12` | Bid volume 9 to 12% | quote | pro | Resting buy liquidity in the slice from 9 to","category":"blocker","line_end":134,"severity":"low","line_start":134},{"id":"blocker:references/metrics-glossary.md:135:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `buyOrderVol15` | Bid volume 12 to 15% | quote | pro | Resting buy liquidity in the slice from 12 ","category":"blocker","line_end":135,"severity":"low","line_start":135},{"id":"blocker:references/metrics-glossary.md:136:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `buyOrderVol18` | Bid volume 15 to 18% | quote | max | Resting buy liquidity in the slice from 15 ","category":"blocker","line_end":136,"severity":"low","line_start":136},{"id":"blocker:references/metrics-glossary.md:137:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `buyOrderVol21` | Bid volume 18 to 21% | quote | max | Resting buy liquidity in the slice from 18 ","category":"blocker","line_end":137,"severity":"low","line_start":137},{"id":"blocker:references/metrics-glossary.md:151:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `bestBid` | Best bid | price | free | The highest bid price at the moment the window closed. |","category":"blocker","line_end":151,"severity":"low","line_start":151},{"id":"blocker:references/metrics-glossary.md:154:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `bidLevelCount` | Bid level count | count | pro | Number of price levels on the bid side at window","category":"blocker","line_end":154,"severity":"low","line_start":154},{"id":"blocker:references/metrics-glossary.md:156:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `bidLiqAdded` | Bid liquidity added | quote | max | Buy-side resting liquidity placed into the boo","category":"blocker","line_end":156,"severity":"low","line_start":156},{"id":"blocker:references/metrics-glossary.md:157:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `bidLiqRemoved` | Bid liquidity removed | quote | max | **Gross** decrease in buy-side resting siz","category":"blocker","line_end":157,"severity":"low","line_start":157},{"id":"blocker:references/metrics-glossary.md:168:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `bidLiqAddedNear` | Bid liquidity added near the mid | quote | max | The part of bid liquidity add","category":"blocker","line_end":168,"severity":"low","line_start":168},{"id":"blocker:references/metrics-glossary.md:169:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `askLiqAddedNear` | Ask liquidity added near the mid | quote | max | The part of ask liquidity add","category":"blocker","line_end":169,"severity":"low","line_start":169},{"id":"blocker:references/metrics-glossary.md:170:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `bidLiqRemovedNear` | Bid liquidity removed near the mid | quote | max | The part of bid liquidity","category":"blocker","line_end":170,"severity":"low","line_start":170},{"id":"blocker:references/metrics-glossary.md:171:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `askLiqRemovedNear` | Ask liquidity removed near the mid | quote | max | The part of ask liquidity","category":"blocker","line_end":171,"severity":"low","line_start":171},{"id":"blocker:references/metrics-glossary.md:223:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"in **USD**, cumulative. Empty when the book had no mid or the quote has no USD rate. The quality bit","category":"blocker","line_end":223,"severity":"low","line_start":223},{"id":"blocker:references/metrics-glossary.md:229:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `bidDepth50bp` | Bid depth within 0.5% of mid | usd | max | USD value of resting buy orders from t","category":"blocker","line_end":229,"severity":"low","line_start":229},{"id":"blocker:references/metrics-glossary.md:230:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `bidDepth100bp` | Bid depth within 1% of mid | usd | max | USD value of resting buy orders from th","category":"blocker","line_end":230,"severity":"low","line_start":230},{"id":"blocker:references/metrics-glossary.md:231:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `bidDepth200bp` | Bid depth within 2% of mid | usd | free | USD value of resting buy orders from t","category":"blocker","line_end":231,"severity":"low","line_start":231},{"id":"blocker:references/metrics-glossary.md:232:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `askDepth50bp` | Ask depth within 0.5% of mid | usd | max | USD value of resting sell orders from ","category":"blocker","line_end":232,"severity":"low","line_start":232},{"id":"blocker:references/metrics-glossary.md:233:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `askDepth100bp` | Ask depth within 1% of mid | usd | max | USD value of resting sell orders from t","category":"blocker","line_end":233,"severity":"low","line_start":233},{"id":"blocker:references/metrics-glossary.md:234:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `askDepth200bp` | Ask depth within 2% of mid | usd | free | USD value of resting sell orders from ","category":"blocker","line_end":234,"severity":"low","line_start":234},{"id":"blocker:references/metrics-glossary.md:244:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `buyCost1kBps` | Cost of a $1,000 market buy | bps | max | What a $1,000 market buy would have cos","category":"blocker","line_end":244,"severity":"low","line_start":244},{"id":"blocker:references/metrics-glossary.md:245:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `buyCost10kBps` | Cost of a $10,000 market buy | bps | max | What a $10,000 market buy would have ","category":"blocker","line_end":245,"severity":"low","line_start":245},{"id":"blocker:references/metrics-glossary.md:246:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `buyCost100kBps` | Cost of a $100,000 market buy | bps | max | What a $100,000 market buy would ha","category":"blocker","line_end":246,"severity":"low","line_start":246},{"id":"blocker:references/metrics-glossary.md:247:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `sellCost1kBps` | Cost of a $1,000 market sell | bps | max | What a $1,000 market sell would have ","category":"blocker","line_end":247,"severity":"low","line_start":247},{"id":"blocker:references/metrics-glossary.md:248:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `sellCost10kBps` | Cost of a $10,000 market sell | bps | max | What a $10,000 market sell would ha","category":"blocker","line_end":248,"severity":"low","line_start":248},{"id":"blocker:references/metrics-glossary.md:249:system-reconnaissance","file":"references/metrics-glossary.md","pattern":"System reconnaissance","snippet":"| `sellCost100kBps` | Cost of a $100,000 market sell | bps | max | What a $100,000 market sell would","category":"blocker","line_end":249,"severity":"low","line_start":249},{"id":"filesystem:references/setup.md:99:hidden-file-in-home-directory","file":"references/setup.md","pattern":"Hidden file in home directory","snippet":"blackforge auth set-key bf_your_key_here   # stored at ~/.blackforge/config.json (mode 0600)","category":"filesystem","line_end":99,"severity":"high","line_start":99},{"id":"filesystem:references/setup.md:99:hidden-file-access","file":"references/setup.md","pattern":"Hidden file access","snippet":"blackforge auth set-key bf_your_key_here   # stored at ~/.blackforge/config.json (mode 0600)","category":"filesystem","line_end":99,"severity":"medium","line_start":99},{"id":"env_access:references/setup.md:46:generic-api-secret-keys","file":"references/setup.md","pattern":"Generic API/secret keys","snippet":"`npx -y @blackforge-so/mcp` with `BLACKFORGE_API_KEY` in its environment. The config lives wherever","category":"env_access","line_end":46,"severity":"high","line_start":46},{"id":"env_access:references/setup.md:57:generic-api-secret-keys","file":"references/setup.md","pattern":"Generic API/secret keys","snippet":"\"env\": { \"BLACKFORGE_API_KEY\": \"bf_your_key_here\" }","category":"env_access","line_end":57,"severity":"high","line_start":57},{"id":"env_access:references/setup.md:66:generic-api-secret-keys","file":"references/setup.md","pattern":"Generic API/secret keys","snippet":"<your-agent> mcp add blackforge --env BLACKFORGE_API_KEY=bf_your_key_here -- npx -y @blackforge-so/m","category":"env_access","line_end":66,"severity":"high","line_start":66},{"id":"env_access:references/setup.md:102:generic-api-secret-keys","file":"references/setup.md","pattern":"Generic API/secret keys","snippet":"The key is read from (in order) `--api-key`, `$BLACKFORGE_API_KEY`, then the stored config.","category":"env_access","line_end":102,"severity":"high","line_start":102},{"id":"external_commands:scripts/check-catalog-sync.mjs:10:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"* Worse, `references/metrics-glossary.md` claims to document every catalog metric and had","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:scripts/check-catalog-sync.mjs:11:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"* silently lost `baseAsset` when migration 007 added it: a reader could not tell, because a","category":"external_commands","line_end":11,"severity":"medium","line_start":11},{"id":"external_commands:scripts/check-catalog-sync.mjs:28:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"* missingTrades — 400 the entire `/v1/latest` request if named in `columns=`, and the catalog","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:scripts/check-catalog-sync.mjs:29:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"* does not say so: it exposes `plottable`, which is a different idea (bookObservedAt is","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:scripts/check-catalog-sync.mjs:30:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"* queryable but not plottable). That set lives only in `api/src/metrics/metrics.service.ts`","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:scripts/check-catalog-sync.mjs:33:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"* hand on 2026-07-28 and will silently rot if it changes. Exposing `queryable` on the catalog","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:scripts/check-catalog-sync.mjs:46:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"/** `ultra` shares `max`'s set — nothing gates above `max`. */","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:scripts/check-catalog-sync.mjs:50:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"const fail = (file, msg) => problems.push(`${file}: ${msg}`);","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:scripts/check-catalog-sync.mjs:58:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (!res.ok) throw new Error(`HTTP ${res.status}`);","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:scripts/check-catalog-sync.mjs:62:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"console.error(`catalog-sync: could not read ${CATALOG_URL} — ${error.message}`);","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:scripts/check-catalog-sync.mjs:78:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"// public response. They both live in `quality`, which is why quality's physical count is two","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"external_commands:scripts/check-catalog-sync.mjs:91:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"const m = line.match(/^\\|\\s*`([A-Za-z0-9_]+)`\\s*\\|([^|]*)\\|([^|]*)\\|([^|]*)\\|/);","category":"external_commands","line_end":91,"severity":"medium","line_start":91},{"id":"external_commands:scripts/check-catalog-sync.mjs:99:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"fail(glossaryFile, `\\`${key}\\` is documented more than once`);","category":"external_commands","line_end":99,"severity":"medium","line_start":99},{"id":"external_commands:scripts/check-catalog-sync.mjs:103:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"fail(glossaryFile, `MISSING \\`${m.key}\\` (${m.family}/${m.unit}/${m.minPlan}) — the catalog serves i","category":"external_commands","line_end":103,"severity":"medium","line_start":103},{"id":"external_commands:scripts/check-catalog-sync.mjs:108:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"fail(glossaryFile, `documents \\`${r.key}\\`, which the catalog does not serve`);","category":"external_commands","line_end":108,"severity":"medium","line_start":108},{"id":"external_commands:scripts/check-catalog-sync.mjs:117:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (bare(r.unit) !== c.unit) fail(glossaryFile, `\\`${r.key}\\` unit is \"${r.unit}\", live says \"${c.un","category":"external_commands","line_end":117,"severity":"medium","line_start":117},{"id":"external_commands:scripts/check-catalog-sync.mjs:118:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (r.minPlan !== (c.minPlan ?? 'free')) fail(glossaryFile, `\\`${r.key}\\` min plan is \"${r.minPlan}\"","category":"external_commands","line_end":118,"severity":"medium","line_start":118},{"id":"external_commands:scripts/check-catalog-sync.mjs:129:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"? new RegExp(`${family}\\\\s*\\\\((\\\\d+)\\\\s+physical[^)]*?\\\\*\\\\*(\\\\d+)\\\\s+sold\\\\*\\\\*`, 'i')","category":"external_commands","line_end":129,"severity":"medium","line_start":129},{"id":"external_commands:scripts/check-catalog-sync.mjs:130:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":": new RegExp(`\\\\b${family}\\\\s*\\\\((\\\\d+)`, 'i');","category":"external_commands","line_end":130,"severity":"medium","line_start":130},{"id":"external_commands:scripts/check-catalog-sync.mjs:133:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"fail(glossaryFile, `\"Families at a glance\" does not state a count for \\`${family}\\` in the expected ","category":"external_commands","line_end":133,"severity":"medium","line_start":133},{"id":"external_commands:scripts/check-catalog-sync.mjs:137:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (Number(m[1]) !== count + INTERNAL.length) fail(glossaryFile, `quality physical count is ${m[1]},","category":"external_commands","line_end":137,"severity":"medium","line_start":137},{"id":"external_commands:scripts/check-catalog-sync.mjs:138:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (Number(m[2]) !== count) fail(glossaryFile, `quality sold count is ${m[2]}, should be ${count}`);","category":"external_commands","line_end":138,"severity":"medium","line_start":138},{"id":"external_commands:scripts/check-catalog-sync.mjs:140:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"fail(glossaryFile, `family \\`${family}\\` is written as ${m[1]}, live has ${count}`);","category":"external_commands","line_end":140,"severity":"medium","line_start":140},{"id":"external_commands:scripts/check-catalog-sync.mjs:149:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"const SUBTITLE_RE = /^_family key: `([A-Za-z]+)`[^\\n]*$/gm;","category":"external_commands","line_end":149,"severity":"medium","line_start":149},{"id":"external_commands:scripts/check-catalog-sync.mjs:157:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"fail(`${glossaryFile}:${line}`, `section claims family \\`${family}\\`, which the catalog does not hav","category":"external_commands","line_end":157,"severity":"medium","line_start":157},{"id":"external_commands:scripts/check-catalog-sync.mjs:162:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (!q) fail(`${glossaryFile}:${line}`, 'quality subtitle no longer states \"N physical columns, **M ","category":"external_commands","line_end":162,"severity":"medium","line_start":162},{"id":"external_commands:scripts/check-catalog-sync.mjs:164:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (Number(q[1]) !== count + INTERNAL.length) fail(`${glossaryFile}:${line}`, `quality subtitle says","category":"external_commands","line_end":164,"severity":"medium","line_start":164},{"id":"external_commands:scripts/check-catalog-sync.mjs:165:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (Number(q[2]) !== count) fail(`${glossaryFile}:${line}`, `quality subtitle says ${q[2]} sold, sho","category":"external_commands","line_end":165,"severity":"medium","line_start":165},{"id":"external_commands:scripts/check-catalog-sync.mjs:170:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (!n) fail(`${glossaryFile}:${line}`, `\\`${family}\\` subtitle no longer states \"· N metrics\"`);","category":"external_commands","line_end":170,"severity":"medium","line_start":170},{"id":"external_commands:scripts/check-catalog-sync.mjs:171:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"else if (Number(n[1]) !== count) fail(`${glossaryFile}:${line}`, `\\`${family}\\` subtitle says ${n[1]","category":"external_commands","line_end":171,"severity":"medium","line_start":171},{"id":"external_commands:scripts/check-catalog-sync.mjs:191:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"fail(`${file}:${line}`, `\"${m[0].replace(/\\s+/g, ' ')}\" — not a real count. Live: ${TOTAL} sold, ${P","category":"external_commands","line_end":191,"severity":"medium","line_start":191},{"id":"external_commands:scripts/check-catalog-sync.mjs:197:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"console.error(`catalog-sync: ${problems.length} problem(s) — the skill's docs disagree with ${CATALO","category":"external_commands","line_end":197,"severity":"medium","line_start":197},{"id":"external_commands:scripts/check-catalog-sync.mjs:198:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"for (const p of problems) console.error(`  ${p}`);","category":"external_commands","line_end":198,"severity":"medium","line_start":198},{"id":"external_commands:scripts/check-catalog-sync.mjs:204:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"`catalog-sync: docs match the live catalog — ${TOTAL} sold metrics ` +","category":"external_commands","line_end":204,"severity":"medium","line_start":204},{"id":"external_commands:scripts/check-catalog-sync.mjs:205:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"`(${PHYSICAL} physical), ladder ${LADDER_COUNTS.free} / ${LADDER_COUNTS.pro} / ${LADDER_COUNTS.max},","category":"external_commands","line_end":205,"severity":"medium","line_start":205},{"id":"external_commands:scripts/check-catalog-sync.mjs:206:ruby-shell-backtick-execution","file":"scripts/check-catalog-sync.mjs","pattern":"Ruby/shell backtick execution","snippet":"`${documented.size} glossary rows, ${liveFamilies.size} families.`,","category":"external_commands","line_end":206,"severity":"medium","line_start":206},{"id":"network:scripts/check-catalog-sync.mjs:57:fetch-api-call","file":"scripts/check-catalog-sync.mjs","pattern":"Fetch API call","snippet":"const res = await fetch(CATALOG_URL);","category":"network","line_end":57,"severity":"low","line_start":57},{"id":"network:scripts/check-catalog-sync.mjs:37:hardcoded-url","file":"scripts/check-catalog-sync.mjs","pattern":"Hardcoded URL","snippet":"const CATALOG_URL = process.env.BF_CATALOG_URL ?? 'https://api.blackforge.so/v1/catalog';","category":"network","line_end":37,"severity":"low","line_start":37},{"id":"filesystem:scripts/check-catalog-sync.mjs:39:synchronous-file-operations","file":"scripts/check-catalog-sync.mjs","pattern":"Synchronous file operations","snippet":"import { readFileSync } from 'node:fs';","category":"filesystem","line_end":39,"severity":"medium","line_start":39},{"id":"filesystem:scripts/check-catalog-sync.mjs:44:synchronous-file-operations","file":"scripts/check-catalog-sync.mjs","pattern":"Synchronous file operations","snippet":"const read = (rel) => readFileSync(resolve(root, rel), 'utf8');","category":"filesystem","line_end":44,"severity":"medium","line_start":44},{"id":"env_access:scripts/check-catalog-sync.mjs:37:environment-variable-access-dot-notation","file":"scripts/check-catalog-sync.mjs","pattern":"Environment variable access (dot notation)","snippet":"const CATALOG_URL = process.env.BF_CATALOG_URL ?? 'https://api.blackforge.so/v1/catalog';","category":"env_access","line_end":37,"severity":"low","line_start":37},{"id":"env_access:scripts/check-catalog-sync.mjs:37:environment-variable-object","file":"scripts/check-catalog-sync.mjs","pattern":"Environment variable object","snippet":"const CATALOG_URL = process.env.BF_CATALOG_URL ?? 'https://api.blackforge.so/v1/catalog';","category":"env_access","line_end":37,"severity":"low","line_start":37},{"id":"sensitive:scripts/check-catalog-sync.mjs:37:environment-file-access","file":"scripts/check-catalog-sync.mjs","pattern":"Environment file access","snippet":"const CATALOG_URL = process.env.BF_CATALOG_URL ?? 'https://api.blackforge.so/v1/catalog';","category":"sensitive","line_end":37,"severity":"high","line_start":37},{"id":"sensitive:scripts/check-catalog-sync.mjs:95:certificate-key-files","file":"scripts/check-catalog-sync.mjs","pattern":"Certificate/key files","snippet":"const documented = new Map(rows.map((r) => [r.key, r]));","category":"sensitive","line_end":95,"severity":"high","line_start":95},{"id":"sensitive:scripts/check-catalog-sync.mjs:96:certificate-key-files","file":"scripts/check-catalog-sync.mjs","pattern":"Certificate/key files","snippet":"const live = new Map(metrics.map((m) => [m.key, m]));","category":"sensitive","line_end":96,"severity":"high","line_start":96},{"id":"sensitive:scripts/check-catalog-sync.mjs:98:certificate-key-files","file":"scripts/check-catalog-sync.mjs","pattern":"Certificate/key files","snippet":"for (const key of [...documented.keys()].filter((k, i, a) => a.indexOf(k) !== i)) {","category":"sensitive","line_end":98,"severity":"high","line_start":98},{"id":"sensitive:scripts/check-catalog-sync.mjs:102:certificate-key-files","file":"scripts/check-catalog-sync.mjs","pattern":"Certificate/key files","snippet":"if (!documented.has(m.key)) {","category":"sensitive","line_end":102,"severity":"high","line_start":102},{"id":"sensitive:scripts/check-catalog-sync.mjs:103:certificate-key-files","file":"scripts/check-catalog-sync.mjs","pattern":"Certificate/key files","snippet":"fail(glossaryFile, `MISSING \\`${m.key}\\` (${m.family}/${m.unit}/${m.minPlan}) — the catalog serves i","category":"sensitive","line_end":103,"severity":"high","line_start":103},{"id":"sensitive:scripts/check-catalog-sync.mjs:107:certificate-key-files","file":"scripts/check-catalog-sync.mjs","pattern":"Certificate/key files","snippet":"if (!live.has(r.key) && !INTERNAL.includes(r.key)) {","category":"sensitive","line_end":107,"severity":"high","line_start":107},{"id":"sensitive:scripts/check-catalog-sync.mjs:108:certificate-key-files","file":"scripts/check-catalog-sync.mjs","pattern":"Certificate/key files","snippet":"fail(glossaryFile, `documents \\`${r.key}\\`, which the catalog does not serve`);","category":"sensitive","line_end":108,"severity":"high","line_start":108},{"id":"sensitive:scripts/check-catalog-sync.mjs:115:certificate-key-files","file":"scripts/check-catalog-sync.mjs","pattern":"Certificate/key files","snippet":"const c = live.get(r.key);","category":"sensitive","line_end":115,"severity":"high","line_start":115},{"id":"sensitive:scripts/check-catalog-sync.mjs:117:certificate-key-files","file":"scripts/check-catalog-sync.mjs","pattern":"Certificate/key files","snippet":"if (bare(r.unit) !== c.unit) fail(glossaryFile, `\\`${r.key}\\` unit is \"${r.unit}\", live says \"${c.un","category":"sensitive","line_end":117,"severity":"high","line_start":117},{"id":"sensitive:scripts/check-catalog-sync.mjs:118:certificate-key-files","file":"scripts/check-catalog-sync.mjs","pattern":"Certificate/key files","snippet":"if (r.minPlan !== (c.minPlan ?? 'free')) fail(glossaryFile, `\\`${r.key}\\` min plan is \"${r.minPlan}\"","category":"sensitive","line_end":118,"severity":"high","line_start":118},{"id":"blocker:scripts/check-catalog-sync.mjs:8:system-reconnaissance","file":"scripts/check-catalog-sync.mjs","pattern":"System reconnaissance","snippet":"* products said 69/117, the landing site said 38/72/119, and this skill said 119 — every time","category":"blocker","line_end":8,"severity":"low","line_start":8},{"id":"external_commands:scripts/latest-json.sh:4:ruby-shell-backtick-execution","file":"scripts/latest-json.sh","pattern":"Ruby/shell backtick execution","snippet":"# This is an OPTIONAL convenience wrapper around the `blackforge` CLI for the common","category":"external_commands","line_end":4,"severity":"medium","line_start":4},{"id":"external_commands:scripts/latest-json.sh:16:ruby-shell-backtick-execution","file":"scripts/latest-json.sh","pattern":"Ruby/shell backtick execution","snippet":"# ~/.blackforge/config.json). Set BLACKFORGE_API_KEY or run `blackforge auth set-key` first.","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"filesystem:scripts/latest-json.sh:16:hidden-file-in-home-directory","file":"scripts/latest-json.sh","pattern":"Hidden file in home directory","snippet":"# ~/.blackforge/config.json). Set BLACKFORGE_API_KEY or run `blackforge auth set-key` first.","category":"filesystem","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:scripts/latest-json.sh:16:hidden-file-access","file":"scripts/latest-json.sh","pattern":"Hidden file access","snippet":"# ~/.blackforge/config.json). Set BLACKFORGE_API_KEY or run `blackforge auth set-key` first.","category":"filesystem","line_end":16,"severity":"medium","line_start":16},{"id":"filesystem:scripts/latest-json.sh:24:standard-device-file-access","file":"scripts/latest-json.sh","pattern":"Standard device file access","snippet":"if command -v blackforge >/dev/null 2>&1; then","category":"filesystem","line_end":24,"severity":"low","line_start":24},{"id":"env_access:scripts/latest-json.sh:15:generic-api-secret-keys","file":"scripts/latest-json.sh","pattern":"Generic API/secret keys","snippet":"# Auth comes from the CLI's own resolution (--api-key option > $BLACKFORGE_API_KEY >","category":"env_access","line_end":15,"severity":"high","line_start":15},{"id":"env_access:scripts/latest-json.sh:16:generic-api-secret-keys","file":"scripts/latest-json.sh","pattern":"Generic API/secret keys","snippet":"# ~/.blackforge/config.json). Set BLACKFORGE_API_KEY or run `blackforge auth set-key` first.","category":"env_access","line_end":16,"severity":"high","line_start":16},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"blackforge_symbols / blackforge_latest / blackforge_series / blackforge_usage) or the `blackforge`","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"BlackForge is a **raw market-data** product: for every `(exchange, symbol)` it stores one wide row","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"or hardcode an endpoint URL. Always go through the MCP tools or the `blackforge` CLI. Your job is to","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(\"Flag\" is the one exception, and only in its literal sense: `qualityFlags` is a real column and a","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Live formulas** (a user's own measure computed every second from the live book and tape, across ve","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Before any keyed query, call **`blackforge_catalog`** (CLI: `blackforge catalog`). It is keyless and","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"returns the 9 venues (each with its `minPlan`) and all 169 metrics with `key`, `label`, `unit`,","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`family`, `description`, `howToRead` and `minPlan`. Use it to resolve:","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- the exact **`exchange`** identifier (lowercase: `binance`, `okx`, ...), and","category":"external_commands","line_end":67,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- the exact **`metric`** key the user's words map to (e.g. \"resting depth\"/\"sell wall\"/\"pulled","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"liquidity\" → the right `downDepth*` / `upDepth*` / `bidLiqRemoved` ... key).","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Some words have no key.** There is no spread column — the catalog has `bestBid` and `bestAsk`,","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"and a spread is something YOU derive from two `blackforge_series` calls. When the catalog has no","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"[`references/metrics-glossary.md`](references/metrics-glossary.md); the live catalog wording is","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"To list the pairs a venue trades, call **`blackforge_symbols({exchange})`**","category":"external_commands","line_end":82,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(CLI: `blackforge symbols --exchange <v>`). Symbol format is the venue's own","category":"external_commands","line_end":83,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(`BTCUSDT` on binance, `BTC-USDT` on okx/coinbase) — confirm via symbols rather than assuming.","category":"external_commands","line_end":84,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| a coin's **latest** stats on a venue (one snapshot) | `blackforge_latest({exchange, symbol, column","category":"external_commands","line_end":90,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| how a metric **moved over a time range** | `blackforge_series({exchange, symbol, metric, from, to,","category":"external_commands","line_end":91,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **which pairs** a venue lists | `blackforge_symbols({exchange})` | |","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **usage / quota** left | `blackforge_usage()` | recent daily usage + rows remaining this month. |","category":"external_commands","line_end":93,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"CLI fallback maps 1:1: `blackforge latest ...`, `blackforge series ...`, `blackforge symbols ...`,","category":"external_commands","line_end":95,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`blackforge usage`. Prefer `--output json` when you will parse the result.","category":"external_commands","line_end":96,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Choosing `interval` for a series.** The only valid values are **`5m`, `1h`, `1d`** — anything","category":"external_commands","line_end":98,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"returns a **403**, not fewer points. **`5m` is max/ultra only; `pro` floors at `1h`; `free` floors a","category":"external_commands","line_end":100,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`1d`.** Pick the coarsest interval that answers the question, and on a 403 step one rung coarser","category":"external_commands","line_end":101,"severity":"medium","line_start":101},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(`5m` → `1h` → `1d`) rather than reporting no data. Guard the 50k-point cap — points ≈ span ÷ interv","category":"external_commands","line_end":102,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- hours to a few days → `5m` on max/ultra · `1h` on pro · `1d` on free","category":"external_commands","line_end":104,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- about a week to a month → `1h` on max/ultra and pro · `1d` on free","category":"external_commands","line_end":105,"severity":"medium","line_start":105},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- multiple months → `1d` (every plan)","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`from`/`to` are ISO-8601 UTC. If the user says \"last week\", compute the range from today and state","category":"external_commands","line_end":108,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"When you present numbers, define each column with its catalog `description` / `howToRead` wording","category":"external_commands","line_end":113,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`quoteUsdRate` (units are documented per metric). Anchor `ts` on the timeline. Compare windows in","category":"external_commands","line_end":115,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Always read `qualityFlags`.** It is the one column that qualifies every other column on the row,","category":"external_commands","line_end":120,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"ask for. It is a **bitmask**: `0` means no known problem, and each set bit names one condition. The","category":"external_commands","line_end":122,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"full bit table ships on the catalog entry for `qualityFlags` as `bits`, and each bit carries a","category":"external_commands","line_end":123,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`contaminates` list of the metric families it calls into question — so a broken order book leaves","category":"external_commands","line_end":124,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`lastTradeAgeTime`** — how long before the window closed the pair last traded, `0` when the","category":"external_commands","line_end":131,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`bookObservedAt`** — the instant the book was actually read, which is later than the window","category":"external_commands","line_end":135,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"close by a different amount on each venue. Use it, not `ts`, to line two venues up.","category":"external_commands","line_end":136,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**The `QUALITY_UNKNOWN` flag (mask 32768) is not a defect.** It means the row predates the quality","category":"external_commands","line_end":138,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Five columns that 400 the WHOLE request if you name them in `columns=`.** `quoteAsset`,","category":"external_commands","line_end":145,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`baseAsset`, `enrichmentTs`, `bookSynced` and `missingTrades` are identity/state fields, not data","category":"external_commands","line_end":146,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"with `Unknown metric(s): ...`. They arrive on their own in a full response; just never ask for them","category":"external_commands","line_end":148,"severity":"medium","line_start":148},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"by name. Use `qualityFlags` for the `bookSynced` / `missingTrades` concerns.","category":"external_commands","line_end":149,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`bookAgeTime` and `seedDepth` are the opposite case: `internal: true`, they measure our collector","category":"external_commands","line_end":151,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`ts`, `exchange`, `symbol` and `ingestedAt`. Requesting those six is harmless.","category":"external_commands","line_end":153,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- A response header **`X-BlackForge-Columns-Omitted`** (or simply missing expected columns) means","category":"external_commands","line_end":160,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- A **`403`** on a venue or interval means the same at the request level (e.g. a `pro`-only venue on","category":"external_commands","line_end":164,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"a free key, or a `5m` interval on a pro key, whose floor is `1h`). Explain the plan gap and the","category":"external_commands","line_end":165,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"upgrade path. There is **no `1m` interval** — do not go looking for a plan that unlocks one.","category":"external_commands","line_end":166,"severity":"medium","line_start":166},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **History depth is clamped SILENTLY — there is no header and no error.** If you ask for a `from`","category":"external_commands","line_end":167,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"a shorter `points` array. Nothing in the response says it happened, so a short series is","category":"external_commands","line_end":169,"severity":"medium","line_start":169},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"got against the `from` you asked for, and when it moved, say so — \"your plan reads back 2 weeks,","category":"external_commands","line_end":175,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`blackforge_usage` / `X-BlackForge-Rows-Remaining` tell you the monthly quota left; if a call fails","category":"external_commands","line_end":179,"severity":"medium","line_start":179},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. If the **`blackforge_*` MCP tools** are available, use them — this is the primary path.","category":"external_commands","line_end":184,"severity":"medium","line_start":184},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Otherwise, if the **`blackforge` CLI** is installed (or `npx -y @blackforge-so/cli` is usable), s","category":"external_commands","line_end":185,"severity":"medium","line_start":185},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"out to it and parse `--output json`.","category":"external_commands","line_end":186,"severity":"medium","line_start":186},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"[`references/setup.md`](references/setup.md) (MCP config block, CLI install, and where to get a","category":"external_commands","line_end":188,"severity":"medium","line_start":188},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"→ `blackforge_catalog` to confirm `binance` and the depth metric keys → `blackforge_symbols` if","category":"external_commands","line_end":194,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:195:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"unsure of the symbol (`ETHUSDT`) → `blackforge_latest({exchange:'binance', symbol:'ETHUSDT',","category":"external_commands","line_end":195,"severity":"medium","line_start":195},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(5 min on max/ultra, 1 h on pro, 1 d on free), and reading `qualityFlags` before trusting them.","category":"external_commands","line_end":199,"severity":"medium","line_start":199},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"→ catalog — **there is no spread key.** Say so, then derive it: two `blackforge_series` calls","category":"external_commands","line_end":202,"severity":"medium","line_start":202},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(`bestAsk` and `bestBid`) over the same range and subtract point by point. Use `interval:'1h'` for a","category":"external_commands","line_end":203,"severity":"medium","line_start":203},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"week (it is inside every paid plan's floor and stays well under the point cap; `5m` needs max/ultra","category":"external_commands","line_end":204,"severity":"medium","line_start":204},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"and 7 days of it approaches the cap anyway; a free key gets `1d`). State the window and the interval","category":"external_commands","line_end":205,"severity":"medium","line_start":205},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"→ two `blackforge_series` calls (`buyTradeVol`, `sellTradeVol`) or one `blackforge_latest` with both","category":"external_commands","line_end":209,"severity":"medium","line_start":209},{"id":"external_commands:SKILL.md:214:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [`references/metrics-glossary.md`](references/metrics-glossary.md) — all 169 metrics grouped by","category":"external_commands","line_end":214,"severity":"medium","line_start":214},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"family, each with its one-line measurement definition and `min plan`. Read it to map the user's","category":"external_commands","line_end":215,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"words to the right `metric` key and to explain a column.","category":"external_commands","line_end":216,"severity":"medium","line_start":216},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [`references/setup.md`](references/setup.md) — how to configure the MCP server or install the CLI,","category":"external_commands","line_end":217,"severity":"medium","line_start":217},{"id":"network:SKILL.md:57:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"**Live formulas** (a user's own measure computed every second from the live book and tape, across ve","category":"network","line_end":57,"severity":"low","line_start":57},{"id":"blocker:SKILL.md:34:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"the best ask up to +100%\"*, *\"quote notional that left the bid side of the book\"*, *\"median","category":"blocker","line_end":34,"severity":"low","line_start":34},{"id":"blocker:SKILL.md:41:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"the data forecasts or recommends anything. Say what was *measured* (\"bid depth within 5% fell from X","category":"blocker","line_end":41,"severity":"low","line_start":41},{"id":"blocker:SKILL.md:98:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"**Choosing `interval` for a series.** The only valid values are **`5m`, `1h`, `1d`** — anything","category":"blocker","line_end":98,"severity":"low","line_start":98},{"id":"blocker:SKILL.md:143:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"is flagged; solid means final.**","category":"blocker","line_end":143,"severity":"low","line_start":143},{"id":"blocker:SKILL.md:197:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"measurement: \"bid depth within −5% of top-of-book: \\$X; ask depth to +30%: \\$Y\", noting they are","category":"blocker","line_end":197,"severity":"low","line_start":197},{"id":"blocker:SKILL.md:204:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"week (it is inside every paid plan's floor and stays well under the point cap; `5m` needs max/ultra","category":"blocker","line_end":204,"severity":"low","line_start":204}],"finding_verdicts":[{"id":"network:.claude-plugin/plugin.json:8:hardcoded-url","reason":"This URL is author, homepage, or repository metadata in the plugin manifest. It is not an executable request or an exfiltration destination.","verdict":"false_positive","confidence":1},{"id":"network:.claude-plugin/plugin.json:10:hardcoded-url","reason":"This URL is author, homepage, or repository metadata in the plugin manifest. It is not an executable request or an exfiltration destination.","verdict":"false_positive","confidence":1},{"id":"network:.claude-plugin/plugin.json:11:hardcoded-url","reason":"This URL is author, homepage, or repository metadata in the plugin manifest. It is not an executable request or an exfiltration destination.","verdict":"false_positive","confidence":1},{"id":"blocker:evals/trigger-eval.json:2:system-reconnaissance","reason":"The test query asks for ETH resting bid depth, not host inventory or operating-system details. This is inert trigger-evaluation data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:evals/trigger-eval.json:9:system-reconnaissance","reason":"The test query asks for the user account quota and recent BlackForge usage, not host reconnaissance. This is inert trigger-evaluation data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:evals/trigger-eval.json:10:system-reconnaissance","reason":"The test query asks for LINKUSDT order-ladder measurements, not system discovery. This is inert trigger-evaluation data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:47:system-reconnaissance","reason":"This sentence describes flagged chart buckets and visual data-quality conventions. It contains no command or system-discovery instruction.","verdict":"false_positive","confidence":1},{"id":"blocker:references/metrics-glossary.md:114:system-reconnaissance","reason":"The glossary defines the market measurement downDepth5 and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:115:system-reconnaissance","reason":"The glossary defines the market measurement downDepth10 and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:116:system-reconnaissance","reason":"The glossary defines the market measurement downDepth15 and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:117:system-reconnaissance","reason":"The glossary defines the market measurement downDepth20 and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:118:system-reconnaissance","reason":"The glossary defines the market measurement downDepthFull and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:119:system-reconnaissance","reason":"The glossary defines the market measurement askDepthReachPct and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:120:system-reconnaissance","reason":"The glossary defines the market measurement bidDepthReachPct and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:131:system-reconnaissance","reason":"The glossary defines the market measurement buyOrderVol3 and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:132:system-reconnaissance","reason":"The glossary defines the market measurement buyOrderVol6 and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:133:system-reconnaissance","reason":"The glossary defines the market measurement buyOrderVol9 and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:134:system-reconnaissance","reason":"The glossary defines the market measurement buyOrderVol12 and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:135:system-reconnaissance","reason":"The glossary defines the market measurement buyOrderVol15 and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:136:system-reconnaissance","reason":"The glossary defines the market measurement buyOrderVol18 and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:137:system-reconnaissance","reason":"The glossary defines the market measurement buyOrderVol21 and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:151:system-reconnaissance","reason":"The glossary defines the market measurement bestBid and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:154:system-reconnaissance","reason":"The glossary defines the market measurement bidLevelCount and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:156:system-reconnaissance","reason":"The glossary defines the market measurement bidLiqAdded and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:157:system-reconnaissance","reason":"The glossary defines the market measurement bidLiqRemoved and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:168:system-reconnaissance","reason":"The glossary defines the market measurement bidLiqAddedNear and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:169:system-reconnaissance","reason":"The glossary defines the market measurement askLiqAddedNear and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:170:system-reconnaissance","reason":"The glossary defines the market measurement bidLiqRemovedNear and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:171:system-reconnaissance","reason":"The glossary defines the market measurement askLiqRemovedNear and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:223:system-reconnaissance","reason":"This paragraph defines USD near-touch liquidity and partial-depth quality flags. It does not inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:229:system-reconnaissance","reason":"The glossary defines the market measurement bidDepth50bp and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:230:system-reconnaissance","reason":"The glossary defines the market measurement bidDepth100bp and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:231:system-reconnaissance","reason":"The glossary defines the market measurement bidDepth200bp and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:232:system-reconnaissance","reason":"The glossary defines the market measurement askDepth50bp and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:233:system-reconnaissance","reason":"The glossary defines the market measurement askDepth100bp and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:234:system-reconnaissance","reason":"The glossary defines the market measurement askDepth200bp and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:244:system-reconnaissance","reason":"The glossary defines the market measurement buyCost1kBps and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:245:system-reconnaissance","reason":"The glossary defines the market measurement buyCost10kBps and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:246:system-reconnaissance","reason":"The glossary defines the market measurement buyCost100kBps and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:247:system-reconnaissance","reason":"The glossary defines the market measurement sellCost1kBps and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:248:system-reconnaissance","reason":"The glossary defines the market measurement sellCost10kBps and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/metrics-glossary.md:249:system-reconnaissance","reason":"The glossary defines the market measurement sellCost100kBps and its units. This is order-book documentation, not a host-discovery command.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/setup.md:99:hidden-file-in-home-directory","reason":"The documented hidden path is the CLI credential configuration, with mode 0600 stated. It is ordinary user-directed setup, not unrelated hidden-file collection.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/setup.md:99:hidden-file-access","reason":"The documented hidden path is the CLI credential configuration, with mode 0600 stated. It is ordinary user-directed setup, not unrelated hidden-file collection.","verdict":"false_positive","confidence":0.97},{"id":"env_access:references/setup.md:46:generic-api-secret-keys","reason":"This setup documentation names the expected BlackForge credential source or uses a placeholder key. It does not contain a real secret or direct unrelated credential collection.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/setup.md:57:generic-api-secret-keys","reason":"This setup documentation names the expected BlackForge credential source or uses a placeholder key. It does not contain a real secret or direct unrelated credential collection.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/setup.md:66:generic-api-secret-keys","reason":"The placeholder identifies required BlackForge authentication, not an embedded secret or credential-harvesting instruction. Argument-based credential exposure is assessed separately.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/setup.md:102:generic-api-secret-keys","reason":"This setup documentation names the expected BlackForge credential source or uses a placeholder key. It does not contain a real secret or direct unrelated credential collection.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:scripts/check-catalog-sync.mjs:10:ruby-shell-backtick-execution","reason":"These backticks occur inside JavaScript comments and mark documentation identifiers. They cannot execute a Ruby or shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/check-catalog-sync.mjs:11:ruby-shell-backtick-execution","reason":"These backticks occur inside JavaScript comments and mark documentation identifiers. They cannot execute a Ruby or shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/check-catalog-sync.mjs:28:ruby-shell-backtick-execution","reason":"These backticks occur inside JavaScript comments and mark documentation identifiers. They cannot execute a Ruby or shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/check-catalog-sync.mjs:29:ruby-shell-backtick-execution","reason":"These backticks occur inside JavaScript comments and mark documentation identifiers. They cannot execute a Ruby or shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/check-catalog-sync.mjs:30:ruby-shell-backtick-execution","reason":"These backticks occur inside JavaScript comments and mark documentation identifiers. They cannot execute a Ruby or shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/check-catalog-sync.mjs:33:ruby-shell-backtick-execution","reason":"These backticks occur inside JavaScript comments and mark documentation identifiers. They cannot execute a Ruby or shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/check-catalog-sync.mjs:46:ruby-shell-backtick-execution","reason":"These backticks occur inside JavaScript comments and mark documentation identifiers. They cannot execute a Ruby or shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/check-catalog-sync.mjs:50:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:58:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:62:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:78:ruby-shell-backtick-execution","reason":"These backticks occur inside JavaScript comments and mark documentation identifiers. They cannot execute a Ruby or shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/check-catalog-sync.mjs:91:ruby-shell-backtick-execution","reason":"The backtick is a literal character matched by a JavaScript regular expression while parsing Markdown. No shell interpreter or command execution is involved.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/check-catalog-sync.mjs:99:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:103:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:108:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:117:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:118:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:129:ruby-shell-backtick-execution","reason":"This JavaScript template literal builds a regular expression for catalog-documentation comparison. It is not passed to a shell or evaluated as code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:130:ruby-shell-backtick-execution","reason":"This JavaScript template literal builds a regular expression for catalog-documentation comparison. It is not passed to a shell or evaluated as code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:133:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:137:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:138:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:140:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:149:ruby-shell-backtick-execution","reason":"The backtick is a literal character matched by a JavaScript regular expression while parsing Markdown. No shell interpreter or command execution is involved.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/check-catalog-sync.mjs:157:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:162:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:164:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:165:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:170:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:171:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:191:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:197:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:198:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:204:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:205:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/check-catalog-sync.mjs:206:ruby-shell-backtick-execution","reason":"These JavaScript template literals produce diagnostic strings or comparison messages. The script contains no child-process call or shell evaluation of these strings.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/check-catalog-sync.mjs:57:fetch-api-call","reason":"The script retrieves a public catalog to compare metric documentation. The request includes no authentication header, request body, or local file contents.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/check-catalog-sync.mjs:37:hardcoded-url","reason":"The script retrieves a public catalog to compare metric documentation. The request includes no authentication header, request body, or local file contents.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/check-catalog-sync.mjs:39:synchronous-file-operations","reason":"readFileSync is used only for fixed documentation paths resolved relative to the skill directory. It does not traverse home directories or send file contents over the network.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/check-catalog-sync.mjs:44:synchronous-file-operations","reason":"readFileSync is used only for fixed documentation paths resolved relative to the skill directory. It does not traverse home directories or send file contents over the network.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/check-catalog-sync.mjs:37:environment-variable-access-dot-notation","reason":"Only BF_CATALOG_URL is read to select the public catalog endpoint. This does not enumerate environment variables or read an API credential.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/check-catalog-sync.mjs:37:environment-variable-object","reason":"Only BF_CATALOG_URL is read to select the public catalog endpoint. This does not enumerate environment variables or read an API credential.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/check-catalog-sync.mjs:37:environment-file-access","reason":"process.env.BF_CATALOG_URL reads one environment variable, not a .env file. No environment file is opened anywhere in this script.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/check-catalog-sync.mjs:95:certificate-key-files","reason":"The key and keys references identify public catalog metric names or Map entries. They do not refer to certificate files or cryptographic private keys.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/check-catalog-sync.mjs:96:certificate-key-files","reason":"The key and keys references identify public catalog metric names or Map entries. They do not refer to certificate files or cryptographic private keys.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/check-catalog-sync.mjs:98:certificate-key-files","reason":"The key and keys references identify public catalog metric names or Map entries. They do not refer to certificate files or cryptographic private keys.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/check-catalog-sync.mjs:102:certificate-key-files","reason":"The key and keys references identify public catalog metric names or Map entries. They do not refer to certificate files or cryptographic private keys.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/check-catalog-sync.mjs:103:certificate-key-files","reason":"The key and keys references identify public catalog metric names or Map entries. They do not refer to certificate files or cryptographic private keys.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/check-catalog-sync.mjs:107:certificate-key-files","reason":"The key and keys references identify public catalog metric names or Map entries. They do not refer to certificate files or cryptographic private keys.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/check-catalog-sync.mjs:108:certificate-key-files","reason":"The key and keys references identify public catalog metric names or Map entries. They do not refer to certificate files or cryptographic private keys.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/check-catalog-sync.mjs:115:certificate-key-files","reason":"The key and keys references identify public catalog metric names or Map entries. They do not refer to certificate files or cryptographic private keys.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/check-catalog-sync.mjs:117:certificate-key-files","reason":"The key and keys references identify public catalog metric names or Map entries. They do not refer to certificate files or cryptographic private keys.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/check-catalog-sync.mjs:118:certificate-key-files","reason":"The key and keys references identify public catalog metric names or Map entries. They do not refer to certificate files or cryptographic private keys.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/check-catalog-sync.mjs:8:system-reconnaissance","reason":"This block-comment line recounts inconsistent historical product column counts. Comments do not execute or enumerate system information.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/latest-json.sh:4:ruby-shell-backtick-execution","reason":"The backticks are inside a Bash comment describing the CLI or authentication setup. Bash does not perform command substitution in comments.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/latest-json.sh:16:ruby-shell-backtick-execution","reason":"The backticks are inside a Bash comment describing the CLI or authentication setup. Bash does not perform command substitution in comments.","verdict":"false_positive","confidence":1},{"id":"filesystem:scripts/latest-json.sh:16:hidden-file-in-home-directory","reason":"This comment describes the CLI configuration path and authentication precedence. The wrapper itself does not open or read that hidden file.","verdict":"false_positive","confidence":1},{"id":"filesystem:scripts/latest-json.sh:16:hidden-file-access","reason":"This comment describes the CLI configuration path and authentication precedence. The wrapper itself does not open or read that hidden file.","verdict":"false_positive","confidence":1},{"id":"filesystem:scripts/latest-json.sh:24:standard-device-file-access","reason":"The /dev/null redirection discards output while checking whether the CLI is installed. It neither reads sensitive device data nor exposes file contents.","verdict":"false_positive","confidence":1},{"id":"env_access:scripts/latest-json.sh:15:generic-api-secret-keys","reason":"The environment variable appears only in comments describing CLI authentication precedence. The wrapper does not enumerate environment variables or extract credentials.","verdict":"false_positive","confidence":1},{"id":"env_access:scripts/latest-json.sh:16:generic-api-secret-keys","reason":"The environment variable appears only in comments describing CLI authentication precedence. The wrapper does not enumerate environment variables or extract credentials.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","reason":"This Markdown line describes the intended CLI fallback; its backticks are formatting, not shell substitution. Unpinned package execution is assessed separately.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:195:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:214:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown identifiers or intended market-data tool examples. They do not introduce Ruby execution, shell substitution, or arbitrary command evaluation.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:57:hardcoded-url","reason":"The URL refers users to BlackForge for live formulas that this skill does not operate. No credentials or local data are transmitted by this prose.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:34:system-reconnaissance","reason":"The passage gives measurement definitions for ask depth and bid liquidity, not system discovery. The matched words are domain prose.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:41:system-reconnaissance","reason":"The passage requires factual market measurements instead of trade forecasts, not host reconnaissance. The matched words are domain prose.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:98:system-reconnaissance","reason":"The passage lists supported time-series intervals, not operating-system inspection commands. The matched words are domain prose.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:143:system-reconnaissance","reason":"The passage explains chart styling for data-quality flags, not system reconnaissance. The matched words are domain prose.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:197:system-reconnaissance","reason":"The example describes bid and ask liquidity values in quote currency, not host inventory. The matched words are domain prose.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:204:system-reconnaissance","reason":"The example explains interval entitlements and a point-count limit, not system discovery. The matched words are domain prose.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Automatic Execution of Unpinned External Clients","severity":"medium","locations":[{"file":"scripts/latest-json.sh","line_end":33,"line_start":23},{"file":".claude-plugin/plugin.json","line_end":25,"line_start":21},{"file":"SKILL.md","line_end":186,"line_start":184},{"file":"references/setup.md","line_end":57,"line_start":44}],"confidence":0.98,"description":"The wrapper falls back to \"npx -y @blackforge-so/cli\", and the plugin launches an unpinned MCP package. A compromised release could execute with user privileges and access available credentials. No evidence found that these packages are malicious; their implementations are outside this source review.","confidence_reasoning":"The fallback directly executes an unversioned package with automatic confirmation. The plugin uses the same mechanism, establishing supply-chain exposure without proving malicious intent."},{"title":"Credential Exposure Through Setup Command Arguments","severity":"medium","locations":[{"file":"references/setup.md","line_end":67,"line_start":63},{"file":"references/setup.md","line_end":102,"line_start":95}],"confidence":0.95,"description":"The setup commands place \"BLACKFORGE_API_KEY=bf_your_key_here\" and \"blackforge auth set-key bf_your_key_here\" directly in arguments. Replacing these placeholders with real keys can expose credentials through shell history and process inspection.","confidence_reasoning":"The documented workflow requires substituting real credentials into command arguments. Exposure depends on local history and process visibility; the repository itself contains only placeholders."}],"subject_marketplace_commit_sha":"ebcb2eb7ad397e055696549961e5b4f8cfeb7ea5","subject_content_hash":"ead6047d1625478b5e92101a7150d0accb1f149b5d6fb1b094ad81e429839979","subject_tree_hash":"27ca902c2a9126c524cb0fb89026d31a5dc01dad81e91bbe07ec8e9852bbd952","subject_plugin_path":"skills/blackforge-so/blackforge","audit_payload_hash":"dccb7746076946986e038520ef13d1f9","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"ebcb2eb7ad397e055696549961e5b4f8cfeb7ea5","contentHash":"ead6047d1625478b5e92101a7150d0accb1f149b5d6fb1b094ad81e429839979","treeHash":"27ca902c2a9126c524cb0fb89026d31a5dc01dad81e91bbe07ec8e9852bbd952","pluginPath":"skills/blackforge-so/blackforge","auditPayloadHash":"dccb7746076946986e038520ef13d1f9"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/blackforge-so-blackforge/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}