{"data":{"skill":{"slug":"boulea7-chrome-extension-icons","name":"chrome-extension-icons","icon":"📦","repo":"https://github.com/Boulea7/ChromeExtensionIconsSkill/tree/main/skill/","status":"approved","author":"Boulea7","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"0469e920-9585-4f5e-8dc0-434fbd2e76ed","skill_id":"6dd0e0eb-bb56-4166-9b49-0bd03a3d61ee","version":10,"content_hash":"v2:3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88:a72cf3ada7827b59a1cf2d2f2c92fc76b00a3ad5239df33ccd78c14cf1884d37:b32469acf309afa3a0642dc812964d11d5f8f693dc22c10cb5336210397514bb:8d9913c1637e2133d5d84cdd4eafc01a","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static findings are false positives caused by Markdown examples and JavaScript template literals. Confirmed risks are expected outbound Iconify network access, user-path filesystem writes for icon generation and manifest updates, and one sudo package installation instruction in troubleshooting documentation.","remediation":[{"issue":"Outbound Iconify requests are required for search and download operations.","severity":"low","suggestion":"Document that search and generate commands contact api.iconify.design and icon-sets.iconify.design before any network operation runs."},{"issue":"The script writes PNG files and may create or modify manifest.json at user-provided paths.","severity":"medium","suggestion":"Warn users before overwriting existing icons or manifests, and prefer paths inside the current project directory."},{"issue":"Troubleshooting instructions include a sudo apt-get install command.","severity":"high","suggestion":"Ask for explicit user approval before running privileged install commands and offer manual installation steps instead."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"examples/usage.md","line_end":24,"line_start":24},{"file":"examples/usage.md","line_end":55,"line_start":55},{"file":"examples/usage.md","line_end":56,"line_start":56},{"file":"examples/usage.md","line_end":57,"line_start":57},{"file":"examples/usage.md","line_end":58,"line_start":58},{"file":"examples/usage.md","line_end":115,"line_start":115},{"file":"examples/usage.md","line_end":118,"line_start":118},{"file":"examples/usage.md","line_end":121,"line_start":121},{"file":"examples/usage.md","line_end":124,"line_start":124},{"file":"examples/usage.md","line_end":445,"line_start":445},{"file":"scripts/generate-icons.js","line_end":29,"line_start":29},{"file":"scripts/generate-icons.js","line_end":100,"line_start":100},{"file":"scripts/generate-icons.js","line_end":118,"line_start":118},{"file":"scripts/generate-icons.js","line_end":119,"line_start":119},{"file":"scripts/generate-icons.js","line_end":144,"line_start":144},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":120,"line_start":120},{"file":"SKILL.md","line_end":121,"line_start":121},{"file":"SKILL.md","line_end":122,"line_start":122},{"file":"SKILL.md","line_end":326,"line_start":326}]},{"factor":"filesystem","evidence":[{"file":"examples/usage.md","line_end":16,"line_start":16},{"file":"examples/usage.md","line_end":36,"line_start":36},{"file":"examples/usage.md","line_end":69,"line_start":69},{"file":"examples/usage.md","line_end":80,"line_start":80},{"file":"examples/usage.md","line_end":133,"line_start":133},{"file":"examples/usage.md","line_end":157,"line_start":157},{"file":"examples/usage.md","line_end":217,"line_start":217},{"file":"examples/usage.md","line_end":254,"line_start":254},{"file":"examples/usage.md","line_end":264,"line_start":264},{"file":"examples/usage.md","line_end":16,"line_start":16},{"file":"examples/usage.md","line_end":36,"line_start":36},{"file":"examples/usage.md","line_end":69,"line_start":69},{"file":"examples/usage.md","line_end":80,"line_start":80},{"file":"examples/usage.md","line_end":133,"line_start":133},{"file":"examples/usage.md","line_end":157,"line_start":157},{"file":"examples/usage.md","line_end":217,"line_start":217},{"file":"examples/usage.md","line_end":254,"line_start":254},{"file":"examples/usage.md","line_end":264,"line_start":264},{"file":"scripts/generate-icons.js","line_end":172,"line_start":172},{"file":"scripts/generate-icons.js","line_end":209,"line_start":209},{"file":"scripts/generate-icons.js","line_end":258,"line_start":258},{"file":"scripts/generate-icons.js","line_end":292,"line_start":292},{"file":"scripts/generate-icons.js","line_end":377,"line_start":377},{"file":"scripts/generate-icons.js","line_end":230,"line_start":230},{"file":"scripts/generate-icons.js","line_end":384,"line_start":384},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":134,"line_start":134},{"file":"SKILL.md","line_end":153,"line_start":153},{"file":"SKILL.md","line_end":161,"line_start":161},{"file":"SKILL.md","line_end":200,"line_start":200},{"file":"SKILL.md","line_end":263,"line_start":263},{"file":"SKILL.md","line_end":269,"line_start":269},{"file":"SKILL.md","line_end":275,"line_start":275},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":134,"line_start":134},{"file":"SKILL.md","line_end":153,"line_start":153},{"file":"SKILL.md","line_end":161,"line_start":161},{"file":"SKILL.md","line_end":200,"line_start":200},{"file":"SKILL.md","line_end":263,"line_start":263},{"file":"SKILL.md","line_end":269,"line_start":269},{"file":"SKILL.md","line_end":275,"line_start":275}]},{"factor":"scripts","evidence":[{"file":"scripts/generate-icons.js","line_end":26,"line_start":26}]},{"factor":"external_commands","evidence":[{"file":"scripts/generate-icons.js","line_end":55,"line_start":55},{"file":"scripts/generate-icons.js","line_end":60,"line_start":60},{"file":"scripts/generate-icons.js","line_end":78,"line_start":78},{"file":"scripts/generate-icons.js","line_end":88,"line_start":88},{"file":"scripts/generate-icons.js","line_end":98,"line_start":98},{"file":"scripts/generate-icons.js","line_end":100,"line_start":100},{"file":"scripts/generate-icons.js","line_end":118,"line_start":118},{"file":"scripts/generate-icons.js","line_end":119,"line_start":119},{"file":"scripts/generate-icons.js","line_end":129,"line_start":129},{"file":"scripts/generate-icons.js","line_end":144,"line_start":144},{"file":"scripts/generate-icons.js","line_end":149,"line_start":149},{"file":"scripts/generate-icons.js","line_end":150,"line_start":150},{"file":"scripts/generate-icons.js","line_end":153,"line_start":153},{"file":"scripts/generate-icons.js","line_end":157,"line_start":157},{"file":"scripts/generate-icons.js","line_end":160,"line_start":160},{"file":"scripts/generate-icons.js","line_end":169,"line_start":169},{"file":"scripts/generate-icons.js","line_end":173,"line_start":173},{"file":"scripts/generate-icons.js","line_end":176,"line_start":176},{"file":"scripts/generate-icons.js","line_end":191,"line_start":191},{"file":"scripts/generate-icons.js","line_end":192,"line_start":192},{"file":"scripts/generate-icons.js","line_end":206,"line_start":206},{"file":"scripts/generate-icons.js","line_end":219,"line_start":219},{"file":"scripts/generate-icons.js","line_end":232,"line_start":232},{"file":"scripts/generate-icons.js","line_end":240,"line_start":240},{"file":"scripts/generate-icons.js","line_end":252,"line_start":252},{"file":"scripts/generate-icons.js","line_end":271,"line_start":271},{"file":"scripts/generate-icons.js","line_end":279,"line_start":279},{"file":"scripts/generate-icons.js","line_end":298,"line_start":298},{"file":"scripts/generate-icons.js","line_end":331,"line_start":331},{"file":"scripts/generate-icons.js","line_end":332,"line_start":332},{"file":"scripts/generate-icons.js","line_end":365,"line_start":365},{"file":"scripts/generate-icons.js","line_end":366,"line_start":366},{"file":"scripts/generate-icons.js","line_end":375,"line_start":375},{"file":"scripts/generate-icons.js","line_end":384,"line_start":384},{"file":"scripts/generate-icons.js","line_end":390,"line_start":390},{"file":"scripts/generate-icons.js","line_end":392,"line_start":392},{"file":"scripts/generate-icons.js","line_end":422,"line_start":422},{"file":"scripts/generate-icons.js","line_end":435,"line_start":435},{"file":"scripts/generate-icons.js","line_end":436,"line_start":436},{"file":"scripts/generate-icons.js","line_end":441,"line_start":441},{"file":"scripts/generate-icons.js","line_end":526,"line_start":485},{"file":"scripts/generate-icons.js","line_end":552,"line_start":552},{"file":"scripts/generate-icons.js","line_end":556,"line_start":556},{"file":"scripts/generate-icons.js","line_end":557,"line_start":557},{"file":"scripts/generate-icons.js","line_end":560,"line_start":560},{"file":"scripts/generate-icons.js","line_end":561,"line_start":561},{"file":"scripts/generate-icons.js","line_end":564,"line_start":564},{"file":"scripts/generate-icons.js","line_end":567,"line_start":567},{"file":"scripts/generate-icons.js","line_end":579,"line_start":579},{"file":"scripts/generate-icons.js","line_end":601,"line_start":601}]},{"factor":"env_access","evidence":[{"file":"scripts/generate-icons.js","line_end":607,"line_start":607},{"file":"scripts/generate-icons.js","line_end":607,"line_start":607}]}],"critical_findings":[],"high_findings":[{"title":"sudo privilege escalation","locations":[{"file":"SKILL.md","line_end":268,"line_start":268}],"confidence":0.91,"description":"sudo apt-get install libvips-dev","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"The skill documentation instructs users to run sudo apt-get install libvips-dev for troubleshooting. Elevated package installation is a real privileged operation even if it is disclosed."}],"medium_findings":[{"title":"Node.js fs operations","locations":[{"file":"scripts/generate-icons.js","line_end":172,"line_start":172}],"confidence":0.82,"description":"const buffer = await fs.readFile(filePath);","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The script reads and writes user-supplied SVG, output, manifest, and batch configuration paths. This filesystem access is core functionality but can overwrite files when paths are wrong."},{"title":"Node.js fs operations","locations":[{"file":"scripts/generate-icons.js","line_end":209,"line_start":209}],"confidence":0.82,"description":"await fs.mkdir(outputDir, { recursive: true });","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The script reads and writes user-supplied SVG, output, manifest, and batch configuration paths. This filesystem access is core functionality but can overwrite files when paths are wrong."},{"title":"Node.js fs operations","locations":[{"file":"scripts/generate-icons.js","line_end":258,"line_start":258}],"confidence":0.82,"description":"const content = await fs.readFile(manifestPath, 'utf-8');","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The script reads and writes user-supplied SVG, output, manifest, and batch configuration paths. This filesystem access is core functionality but can overwrite files when paths are wrong."},{"title":"Node.js fs operations","locations":[{"file":"scripts/generate-icons.js","line_end":292,"line_start":292}],"confidence":0.82,"description":"await fs.writeFile(","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The script reads and writes user-supplied SVG, output, manifest, and batch configuration paths. This filesystem access is core functionality but can overwrite files when paths are wrong."},{"title":"Node.js fs operations","locations":[{"file":"scripts/generate-icons.js","line_end":377,"line_start":377}],"confidence":0.82,"description":"const configContent = await fs.readFile(configPath, 'utf-8');","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The script reads and writes user-supplied SVG, output, manifest, and batch configuration paths. This filesystem access is core functionality but can overwrite files when paths are wrong."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"scripts/generate-icons.js","line_end":100,"line_start":100}],"confidence":0.86,"description":"const url = `https://api.iconify.design/search?query=${encodeURIComponent(keyword)}&limit=${limit}`;","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The script makes deliberate outbound requests to Iconify endpoints to search and download SVG assets. This is expected for the skill, but it is real network activity users should understand."},{"title":"Hardcoded URL","locations":[{"file":"scripts/generate-icons.js","line_end":118,"line_start":118}],"confidence":0.86,"description":"downloadUrl: `https://api.iconify.design/${prefix}/${name}.svg`,","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The script makes deliberate outbound requests to Iconify endpoints to search and download SVG assets. This is expected for the skill, but it is real network activity users should understand."},{"title":"Hardcoded URL","locations":[{"file":"scripts/generate-icons.js","line_end":119,"line_start":119}],"confidence":0.86,"description":"previewUrl: `https://icon-sets.iconify.design/${prefix}/icons/${name}.html`","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The script makes deliberate outbound requests to Iconify endpoints to search and download SVG assets. This is expected for the skill, but it is real network activity users should understand."},{"title":"Hardcoded URL","locations":[{"file":"scripts/generate-icons.js","line_end":144,"line_start":144}],"confidence":0.86,"description":"let url = `https://api.iconify.design/${prefix}/${name}.svg`;","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The script makes deliberate outbound requests to Iconify endpoints to search and download SVG assets. This is expected for the skill, but it is real network activity users should understand."}],"dangerous_patterns":[],"files_scanned":4,"total_lines":1486,"audit_model":"claude","audited_at":"2026-07-09T04:36:41.963+00:00","created_at":"2026-07-09T06:43:54.319469+00:00","static_findings":[{"id":"network:examples/usage.md:24:hardcoded-url","file":"examples/usage.md","pattern":"Hardcoded URL","snippet":"Preview: https://icon-sets.iconify.design/mdi/icons/calendar.html","category":"network","line_end":24,"severity":"low","line_start":24},{"id":"network:examples/usage.md:55:hardcoded-url","file":"examples/usage.md","pattern":"Hardcoded URL","snippet":"1. mdi:calendar-month - https://icon-sets.iconify.design/mdi/icons/calendar-month.html","category":"network","line_end":55,"severity":"low","line_start":55},{"id":"network:examples/usage.md:56:hardcoded-url","file":"examples/usage.md","pattern":"Hardcoded URL","snippet":"2. fa:calendar - https://icon-sets.iconify.design/fa/icons/calendar.html","category":"network","line_end":56,"severity":"low","line_start":56},{"id":"network:examples/usage.md:57:hardcoded-url","file":"examples/usage.md","pattern":"Hardcoded URL","snippet":"3. heroicons:calendar - https://icon-sets.iconify.design/heroicons/icons/calendar.html","category":"network","line_end":57,"severity":"low","line_start":57},{"id":"network:examples/usage.md:58:hardcoded-url","file":"examples/usage.md","pattern":"Hardcoded URL","snippet":"4. carbon:calendar - https://icon-sets.iconify.design/carbon/icons/calendar.html","category":"network","line_end":58,"severity":"low","line_start":58},{"id":"network:examples/usage.md:115:hardcoded-url","file":"examples/usage.md","pattern":"Hardcoded URL","snippet":"Preview: https://icon-sets.iconify.design/mdi/icons/music-note.html","category":"network","line_end":115,"severity":"low","line_start":115},{"id":"network:examples/usage.md:118:hardcoded-url","file":"examples/usage.md","pattern":"Hardcoded URL","snippet":"Preview: https://icon-sets.iconify.design/fa/icons/music.html","category":"network","line_end":118,"severity":"low","line_start":118},{"id":"network:examples/usage.md:121:hardcoded-url","file":"examples/usage.md","pattern":"Hardcoded URL","snippet":"Preview: https://icon-sets.iconify.design/heroicons/icons/musical-note.html","category":"network","line_end":121,"severity":"low","line_start":121},{"id":"network:examples/usage.md:124:hardcoded-url","file":"examples/usage.md","pattern":"Hardcoded URL","snippet":"Preview: https://icon-sets.iconify.design/carbon/icons/music.html","category":"network","line_end":124,"severity":"low","line_start":124},{"id":"network:examples/usage.md:445:hardcoded-url","file":"examples/usage.md","pattern":"Hardcoded URL","snippet":"3. Browse icon sets directly: https://icon-sets.iconify.design/","category":"network","line_end":445,"severity":"low","line_start":445},{"id":"filesystem:examples/usage.md:16:hidden-file-in-home-directory","file":"examples/usage.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js search \"calendar\"","category":"filesystem","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:examples/usage.md:36:hidden-file-in-home-directory","file":"examples/usage.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js generate \\","category":"filesystem","line_end":36,"severity":"high","line_start":36},{"id":"filesystem:examples/usage.md:69:hidden-file-in-home-directory","file":"examples/usage.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js search \"home\"","category":"filesystem","line_end":69,"severity":"high","line_start":69},{"id":"filesystem:examples/usage.md:80:hidden-file-in-home-directory","file":"examples/usage.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js generate \\","category":"filesystem","line_end":80,"severity":"high","line_start":80},{"id":"filesystem:examples/usage.md:133:hidden-file-in-home-directory","file":"examples/usage.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js generate \\","category":"filesystem","line_end":133,"severity":"high","line_start":133},{"id":"filesystem:examples/usage.md:157:hidden-file-in-home-directory","file":"examples/usage.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js convert \\","category":"filesystem","line_end":157,"severity":"high","line_start":157},{"id":"filesystem:examples/usage.md:217:hidden-file-in-home-directory","file":"examples/usage.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js batch \\","category":"filesystem","line_end":217,"severity":"high","line_start":217},{"id":"filesystem:examples/usage.md:254:hidden-file-in-home-directory","file":"examples/usage.md","pattern":"Hidden file in home directory","snippet":"cd ~/.claude/skills/chrome-extension-icons && npm install","category":"filesystem","line_end":254,"severity":"high","line_start":254},{"id":"filesystem:examples/usage.md:264:hidden-file-in-home-directory","file":"examples/usage.md","pattern":"Hidden file in home directory","snippet":"cd ~/.claude/skills/chrome-extension-icons && npm install","category":"filesystem","line_end":264,"severity":"high","line_start":264},{"id":"filesystem:examples/usage.md:16:hidden-file-access","file":"examples/usage.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js search \"calendar\"","category":"filesystem","line_end":16,"severity":"medium","line_start":16},{"id":"filesystem:examples/usage.md:36:hidden-file-access","file":"examples/usage.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js generate \\","category":"filesystem","line_end":36,"severity":"medium","line_start":36},{"id":"filesystem:examples/usage.md:69:hidden-file-access","file":"examples/usage.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js search \"home\"","category":"filesystem","line_end":69,"severity":"medium","line_start":69},{"id":"filesystem:examples/usage.md:80:hidden-file-access","file":"examples/usage.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js generate \\","category":"filesystem","line_end":80,"severity":"medium","line_start":80},{"id":"filesystem:examples/usage.md:133:hidden-file-access","file":"examples/usage.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js generate \\","category":"filesystem","line_end":133,"severity":"medium","line_start":133},{"id":"filesystem:examples/usage.md:157:hidden-file-access","file":"examples/usage.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js convert \\","category":"filesystem","line_end":157,"severity":"medium","line_start":157},{"id":"filesystem:examples/usage.md:217:hidden-file-access","file":"examples/usage.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js batch \\","category":"filesystem","line_end":217,"severity":"medium","line_start":217},{"id":"filesystem:examples/usage.md:254:hidden-file-access","file":"examples/usage.md","pattern":"Hidden file access","snippet":"cd ~/.claude/skills/chrome-extension-icons && npm install","category":"filesystem","line_end":254,"severity":"medium","line_start":254},{"id":"filesystem:examples/usage.md:264:hidden-file-access","file":"examples/usage.md","pattern":"Hidden file access","snippet":"cd ~/.claude/skills/chrome-extension-icons && npm install","category":"filesystem","line_end":264,"severity":"medium","line_start":264},{"id":"blocker:examples/usage.md:371:system-reconnaissance","file":"examples/usage.md","pattern":"System reconnaissance","snippet":"Note: If the icon has multiple colors, only solid fills will be replaced. Gradients and complex effe","category":"blocker","line_end":371,"severity":"low","line_start":371},{"id":"scripts:scripts/generate-icons.js:26:dynamic-import-expression","file":"scripts/generate-icons.js","pattern":"Dynamic import() expression","snippet":"sharp = (await import('sharp')).default;","category":"scripts","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:scripts/generate-icons.js:55:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"reject(new Error(`RATE_LIMIT:${retryAfter}`));","category":"external_commands","line_end":55,"severity":"medium","line_start":55},{"id":"external_commands:scripts/generate-icons.js:60:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"reject(new Error(`HTTP ${res.statusCode}: ${res.statusMessage}`));","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:scripts/generate-icons.js:78:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`⏳ API rate limit reached. Waiting ${waitSeconds} seconds...`);","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"external_commands:scripts/generate-icons.js:88:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`⚠️  Attempt ${attempt} failed. Retrying in ${backoff/1000}s...`);","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:scripts/generate-icons.js:98:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`🔍 Searching for \"${keyword}\"...`);","category":"external_commands","line_end":98,"severity":"medium","line_start":98},{"id":"external_commands:scripts/generate-icons.js:100:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"const url = `https://api.iconify.design/search?query=${encodeURIComponent(keyword)}&limit=${limit}`;","category":"external_commands","line_end":100,"severity":"medium","line_start":100},{"id":"external_commands:scripts/generate-icons.js:118:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"downloadUrl: `https://api.iconify.design/${prefix}/${name}.svg`,","category":"external_commands","line_end":118,"severity":"medium","line_start":118},{"id":"external_commands:scripts/generate-icons.js:119:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"previewUrl: `https://icon-sets.iconify.design/${prefix}/icons/${name}.html`","category":"external_commands","line_end":119,"severity":"medium","line_start":119},{"id":"external_commands:scripts/generate-icons.js:129:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.error(`❌ Search failed: ${error.message}`);","category":"external_commands","line_end":129,"severity":"medium","line_start":129},{"id":"external_commands:scripts/generate-icons.js:144:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"let url = `https://api.iconify.design/${prefix}/${name}.svg`;","category":"external_commands","line_end":144,"severity":"medium","line_start":144},{"id":"external_commands:scripts/generate-icons.js:149:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"url += `?color=%23${colorHex}`;","category":"external_commands","line_end":149,"severity":"medium","line_start":149},{"id":"external_commands:scripts/generate-icons.js:150:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`🎨 Applying color: #${colorHex}`);","category":"external_commands","line_end":150,"severity":"medium","line_start":150},{"id":"external_commands:scripts/generate-icons.js:153:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`⬇️  Downloading: ${iconId}`);","category":"external_commands","line_end":153,"severity":"medium","line_start":153},{"id":"external_commands:scripts/generate-icons.js:157:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`✓ Downloaded ${buffer.length} bytes`);","category":"external_commands","line_end":157,"severity":"medium","line_start":157},{"id":"external_commands:scripts/generate-icons.js:160:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.error(`❌ Download failed: ${error.message}`);","category":"external_commands","line_end":160,"severity":"medium","line_start":160},{"id":"external_commands:scripts/generate-icons.js:169:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`📂 Reading local SVG: ${filePath}`);","category":"external_commands","line_end":169,"severity":"medium","line_start":169},{"id":"external_commands:scripts/generate-icons.js:173:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`✓ Read ${buffer.length} bytes`);","category":"external_commands","line_end":173,"severity":"medium","line_start":173},{"id":"external_commands:scripts/generate-icons.js:176:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.error(`❌ Failed to read file: ${error.message}`);","category":"external_commands","line_end":176,"severity":"medium","line_start":176},{"id":"external_commands:scripts/generate-icons.js:191:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"svgString = svgString.replace(/fill=\"[^\"]*\"/g, `fill=\"#${colorHex}\"`);","category":"external_commands","line_end":191,"severity":"medium","line_start":191},{"id":"external_commands:scripts/generate-icons.js:192:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"svgString = svgString.replace(/fill:[^;\"]*/g, `fill:#${colorHex}`);","category":"external_commands","line_end":192,"severity":"medium","line_start":192},{"id":"external_commands:scripts/generate-icons.js:206:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`🔄 Converting to PNG...`);","category":"external_commands","line_end":206,"severity":"medium","line_start":206},{"id":"external_commands:scripts/generate-icons.js:219:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"const outputPath = path.join(outputDir, `${baseName}${size}.png`);","category":"external_commands","line_end":219,"severity":"medium","line_start":219},{"id":"external_commands:scripts/generate-icons.js:232:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`✓ Generated ${size}x${size}: ${outputPath} (${sizeKB} KB)`);","category":"external_commands","line_end":232,"severity":"medium","line_start":232},{"id":"external_commands:scripts/generate-icons.js:240:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.error(`❌ Failed to generate ${size}x${size}: ${error.message}`);","category":"external_commands","line_end":240,"severity":"medium","line_start":240},{"id":"external_commands:scripts/generate-icons.js:252:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`📝 Updating manifest.json...`);","category":"external_commands","line_end":252,"severity":"medium","line_start":252},{"id":"external_commands:scripts/generate-icons.js:271:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.error(`❌ Failed to read manifest.json: ${error.message}`);","category":"external_commands","line_end":271,"severity":"medium","line_start":271},{"id":"external_commands:scripts/generate-icons.js:279:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"const relativePath = path.join(iconDir, `${baseName}${size}.png`).replace(/\\\\/g, '/');","category":"external_commands","line_end":279,"severity":"medium","line_start":279},{"id":"external_commands:scripts/generate-icons.js:298:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`✓ ${isNew ? 'Created' : 'Updated'}: ${manifestPath}`);","category":"external_commands","line_end":298,"severity":"medium","line_start":298},{"id":"external_commands:scripts/generate-icons.js:331:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`   Generated ${files.length} PNG files`);","category":"external_commands","line_end":331,"severity":"medium","line_start":331},{"id":"external_commands:scripts/generate-icons.js:332:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`   Total size: ${(files.reduce((sum, f) => sum + f.sizeBytes, 0) / 1024).toFixed(1)} KB","category":"external_commands","line_end":332,"severity":"medium","line_start":332},{"id":"external_commands:scripts/generate-icons.js:365:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`   Converted ${files.length} PNG files`);","category":"external_commands","line_end":365,"severity":"medium","line_start":365},{"id":"external_commands:scripts/generate-icons.js:366:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`   Total size: ${(files.reduce((sum, f) => sum + f.sizeBytes, 0) / 1024).toFixed(1)} KB","category":"external_commands","line_end":366,"severity":"medium","line_start":366},{"id":"external_commands:scripts/generate-icons.js:375:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`📋 Reading batch configuration: ${configPath}`);","category":"external_commands","line_end":375,"severity":"medium","line_start":375},{"id":"external_commands:scripts/generate-icons.js:384:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`\\n🚀 Starting batch generation for ${config.projects.length} projects...\\n`);","category":"external_commands","line_end":384,"severity":"medium","line_start":384},{"id":"external_commands:scripts/generate-icons.js:390:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"const projectName = project.name || `Project ${i + 1}`;","category":"external_commands","line_end":390,"severity":"medium","line_start":390},{"id":"external_commands:scripts/generate-icons.js:392:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`\\n[${ i + 1}/${config.projects.length}] ${projectName}`);","category":"external_commands","line_end":392,"severity":"medium","line_start":392},{"id":"external_commands:scripts/generate-icons.js:422:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.error(`❌ Failed: ${error.message}`);","category":"external_commands","line_end":422,"severity":"medium","line_start":422},{"id":"external_commands:scripts/generate-icons.js:435:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`✓ Successful: ${successful}`);","category":"external_commands","line_end":435,"severity":"medium","line_start":435},{"id":"external_commands:scripts/generate-icons.js:436:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`✗ Failed: ${failed}`);","category":"external_commands","line_end":436,"severity":"medium","line_start":436},{"id":"external_commands:scripts/generate-icons.js:441:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`  - ${r.project}: ${r.error}`);","category":"external_commands","line_end":441,"severity":"medium","line_start":441},{"id":"external_commands:scripts/generate-icons.js:485:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`","category":"external_commands","line_end":526,"severity":"medium","line_start":485},{"id":"external_commands:scripts/generate-icons.js:552:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`\\n✨ Found ${results.length} icons:\\n`);","category":"external_commands","line_end":552,"severity":"medium","line_start":552},{"id":"external_commands:scripts/generate-icons.js:556:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`${icon.rank}. ${icon.id}`);","category":"external_commands","line_end":556,"severity":"medium","line_start":556},{"id":"external_commands:scripts/generate-icons.js:557:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`   Preview: ${icon.previewUrl}\\n`);","category":"external_commands","line_end":557,"severity":"medium","line_start":557},{"id":"external_commands:scripts/generate-icons.js:560:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`💡 Best match: ${results[0].id}`);","category":"external_commands","line_end":560,"severity":"medium","line_start":560},{"id":"external_commands:scripts/generate-icons.js:561:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`   Use: generate-icons.js generate --icon \"${results[0].id}\"`);","category":"external_commands","line_end":561,"severity":"medium","line_start":561},{"id":"external_commands:scripts/generate-icons.js:564:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`\\n... and ${results.length - 5} more results`);","category":"external_commands","line_end":564,"severity":"medium","line_start":564},{"id":"external_commands:scripts/generate-icons.js:567:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`\\n📌 Top 5 alternatives saved for reference`);","category":"external_commands","line_end":567,"severity":"medium","line_start":567},{"id":"external_commands:scripts/generate-icons.js:579:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`   ${icon.rank}. ${icon.id} - ${icon.previewUrl}`);","category":"external_commands","line_end":579,"severity":"medium","line_start":579},{"id":"external_commands:scripts/generate-icons.js:601:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.error(`❌ Unknown command: ${command}`);","category":"external_commands","line_end":601,"severity":"medium","line_start":601},{"id":"external_commands:scripts/generate-icons.js:606:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.error(`\\n❌ Error: ${error.message}`);","category":"external_commands","line_end":606,"severity":"medium","line_start":606},{"id":"external_commands:scripts/generate-icons.js:617:ruby-shell-backtick-execution","file":"scripts/generate-icons.js","pattern":"Ruby/shell backtick execution","snippet":"console.error(`Fatal error: ${error.message}`);","category":"external_commands","line_end":617,"severity":"medium","line_start":617},{"id":"network:scripts/generate-icons.js:29:hardcoded-url","file":"scripts/generate-icons.js","pattern":"Hardcoded URL","snippet":"console.error('   For installation issues, see: https://sharp.pixelplumbing.com/install');","category":"network","line_end":29,"severity":"low","line_start":29},{"id":"network:scripts/generate-icons.js:100:hardcoded-url","file":"scripts/generate-icons.js","pattern":"Hardcoded URL","snippet":"const url = `https://api.iconify.design/search?query=${encodeURIComponent(keyword)}&limit=${limit}`;","category":"network","line_end":100,"severity":"low","line_start":100},{"id":"network:scripts/generate-icons.js:118:hardcoded-url","file":"scripts/generate-icons.js","pattern":"Hardcoded URL","snippet":"downloadUrl: `https://api.iconify.design/${prefix}/${name}.svg`,","category":"network","line_end":118,"severity":"low","line_start":118},{"id":"network:scripts/generate-icons.js:119:hardcoded-url","file":"scripts/generate-icons.js","pattern":"Hardcoded URL","snippet":"previewUrl: `https://icon-sets.iconify.design/${prefix}/icons/${name}.html`","category":"network","line_end":119,"severity":"low","line_start":119},{"id":"network:scripts/generate-icons.js:144:hardcoded-url","file":"scripts/generate-icons.js","pattern":"Hardcoded URL","snippet":"let url = `https://api.iconify.design/${prefix}/${name}.svg`;","category":"network","line_end":144,"severity":"low","line_start":144},{"id":"filesystem:scripts/generate-icons.js:172:node-js-fs-operations","file":"scripts/generate-icons.js","pattern":"Node.js fs operations","snippet":"const buffer = await fs.readFile(filePath);","category":"filesystem","line_end":172,"severity":"medium","line_start":172},{"id":"filesystem:scripts/generate-icons.js:209:node-js-fs-operations","file":"scripts/generate-icons.js","pattern":"Node.js fs operations","snippet":"await fs.mkdir(outputDir, { recursive: true });","category":"filesystem","line_end":209,"severity":"medium","line_start":209},{"id":"filesystem:scripts/generate-icons.js:258:node-js-fs-operations","file":"scripts/generate-icons.js","pattern":"Node.js fs operations","snippet":"const content = await fs.readFile(manifestPath, 'utf-8');","category":"filesystem","line_end":258,"severity":"medium","line_start":258},{"id":"filesystem:scripts/generate-icons.js:292:node-js-fs-operations","file":"scripts/generate-icons.js","pattern":"Node.js fs operations","snippet":"await fs.writeFile(","category":"filesystem","line_end":292,"severity":"medium","line_start":292},{"id":"filesystem:scripts/generate-icons.js:377:node-js-fs-operations","file":"scripts/generate-icons.js","pattern":"Node.js fs operations","snippet":"const configContent = await fs.readFile(configPath, 'utf-8');","category":"filesystem","line_end":377,"severity":"medium","line_start":377},{"id":"filesystem:scripts/generate-icons.js:230:node-js-fs-stat-operations","file":"scripts/generate-icons.js","pattern":"Node.js fs stat operations","snippet":"const stats = await fs.stat(outputPath);","category":"filesystem","line_end":230,"severity":"low","line_start":230},{"id":"filesystem:scripts/generate-icons.js:384:path-traversal-sequence","file":"scripts/generate-icons.js","pattern":"Path traversal sequence","snippet":"console.log(`\\n🚀 Starting batch generation for ${config.projects.length} projects...\\n`);","category":"filesystem","line_end":384,"severity":"high","line_start":384},{"id":"env_access:scripts/generate-icons.js:607:environment-variable-access-dot-notation","file":"scripts/generate-icons.js","pattern":"Environment variable access (dot notation)","snippet":"if (process.env.DEBUG) {","category":"env_access","line_end":607,"severity":"low","line_start":607},{"id":"env_access:scripts/generate-icons.js:607:environment-variable-object","file":"scripts/generate-icons.js","pattern":"Environment variable object","snippet":"if (process.env.DEBUG) {","category":"env_access","line_end":607,"severity":"low","line_start":607},{"id":"sensitive:scripts/generate-icons.js:607:environment-file-access","file":"scripts/generate-icons.js","pattern":"Environment file access","snippet":"if (process.env.DEBUG) {","category":"sensitive","line_end":607,"severity":"high","line_start":607},{"id":"blocker:scripts/generate-icons.js:141:system-reconnaissance","file":"scripts/generate-icons.js","pattern":"System reconnaissance","snippet":"throw new Error('Invalid icon ID format. Expected format: \"prefix:name\" (e.g., \"mdi:home\")');","category":"blocker","line_end":141,"severity":"low","line_start":141},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Target directory**: Where to save icons (default: `./icons`)","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Manifest location**: Path to manifest.json (default: `./manifest.json`)","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":31,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":44,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":54,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":60,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":65,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":68,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":74,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":82,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":85,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `icon16.png`","category":"external_commands","line_end":86,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `icon32.png`","category":"external_commands","line_end":87,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `icon48.png`","category":"external_commands","line_end":88,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `icon128.png`","category":"external_commands","line_end":91,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":93,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":99,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":125,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":133,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":138,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":147,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":149,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":152,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":157,"severity":"medium","line_start":152},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":160,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":165,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":171,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Create a configuration file `icons-config.json`:","category":"external_commands","line_end":172,"severity":"medium","line_start":171},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":196,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":199,"severity":"medium","line_start":196},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":202,"severity":"medium","line_start":199},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":223,"severity":"medium","line_start":202},{"id":"external_commands:SKILL.md:223:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The script automatically creates or updates the `icons` field:","category":"external_commands","line_end":225,"severity":"medium","line_start":223},{"id":"external_commands:SKILL.md:225:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":237,"severity":"medium","line_start":225},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":239,"severity":"medium","line_start":237},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If `action` or `browser_action` exists, `default_icon` is also updated:","category":"external_commands","line_end":239,"severity":"medium","line_start":239},{"id":"external_commands:SKILL.md:241:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":252,"severity":"medium","line_start":241},{"id":"external_commands:SKILL.md:252:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":261,"severity":"medium","line_start":252},{"id":"external_commands:SKILL.md:261:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":264,"severity":"medium","line_start":261},{"id":"external_commands:SKILL.md:264:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":267,"severity":"medium","line_start":264},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":270,"severity":"medium","line_start":267},{"id":"external_commands:SKILL.md:270:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":273,"severity":"medium","line_start":270},{"id":"external_commands:SKILL.md:273:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":276,"severity":"medium","line_start":273},{"id":"external_commands:SKILL.md:276:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":290,"severity":"medium","line_start":276},{"id":"external_commands:SKILL.md:290:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":292,"severity":"medium","line_start":290},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":306,"severity":"medium","line_start":292},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Verify output**: Always run `ls` to confirm files were created successfully","category":"external_commands","line_end":337,"severity":"medium","line_start":306},{"id":"external_commands:SKILL.md:337:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Sharp won't install | Install libvips: `brew install vips` (macOS) |","category":"external_commands","line_end":340,"severity":"medium","line_start":337},{"id":"external_commands:SKILL.md:268:sudo-privilege-escalation","file":"SKILL.md","pattern":"sudo privilege escalation","snippet":"sudo apt-get install libvips-dev","category":"external_commands","line_end":268,"severity":"high","line_start":268},{"id":"network:SKILL.md:48:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Preview: https://icon-sets.iconify.design/mdi/icons/calendar.html","category":"network","line_end":48,"severity":"low","line_start":48},{"id":"network:SKILL.md:119:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"1. mdi:calendar-month - https://icon-sets.iconify.design/mdi/icons/calendar-month.html","category":"network","line_end":119,"severity":"low","line_start":119},{"id":"network:SKILL.md:120:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"2. fa:calendar - https://icon-sets.iconify.design/fa/icons/calendar.html","category":"network","line_end":120,"severity":"low","line_start":120},{"id":"network:SKILL.md:121:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"3. heroicons:calendar - https://icon-sets.iconify.design/heroicons/icons/calendar.html","category":"network","line_end":121,"severity":"low","line_start":121},{"id":"network:SKILL.md:122:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"4. carbon:calendar - https://icon-sets.iconify.design/carbon/icons/calendar.html","category":"network","line_end":122,"severity":"low","line_start":122},{"id":"network:SKILL.md:326:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Icon source**: Iconify API (https://iconify.design/)","category":"network","line_end":326,"severity":"low","line_start":326},{"id":"filesystem:SKILL.md:30:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js search \"<keyword>\"","category":"filesystem","line_end":30,"severity":"high","line_start":30},{"id":"filesystem:SKILL.md:61:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js generate \\","category":"filesystem","line_end":61,"severity":"high","line_start":61},{"id":"filesystem:SKILL.md:69:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js generate \\","category":"filesystem","line_end":69,"severity":"high","line_start":69},{"id":"filesystem:SKILL.md:134:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js generate \\","category":"filesystem","line_end":134,"severity":"high","line_start":134},{"id":"filesystem:SKILL.md:153:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js convert \\","category":"filesystem","line_end":153,"severity":"high","line_start":153},{"id":"filesystem:SKILL.md:161:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js convert \\","category":"filesystem","line_end":161,"severity":"high","line_start":161},{"id":"filesystem:SKILL.md:200:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js batch \\","category":"filesystem","line_end":200,"severity":"high","line_start":200},{"id":"filesystem:SKILL.md:263:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"cd ~/.claude/skills/chrome-extension-icons && npm install","category":"filesystem","line_end":263,"severity":"high","line_start":263},{"id":"filesystem:SKILL.md:269:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"cd ~/.claude/skills/chrome-extension-icons && npm install","category":"filesystem","line_end":269,"severity":"high","line_start":269},{"id":"filesystem:SKILL.md:275:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"cd ~/.claude/skills/chrome-extension-icons && npm install","category":"filesystem","line_end":275,"severity":"high","line_start":275},{"id":"filesystem:SKILL.md:30:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js search \"<keyword>\"","category":"filesystem","line_end":30,"severity":"medium","line_start":30},{"id":"filesystem:SKILL.md:61:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js generate \\","category":"filesystem","line_end":61,"severity":"medium","line_start":61},{"id":"filesystem:SKILL.md:69:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js generate \\","category":"filesystem","line_end":69,"severity":"medium","line_start":69},{"id":"filesystem:SKILL.md:134:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js generate \\","category":"filesystem","line_end":134,"severity":"medium","line_start":134},{"id":"filesystem:SKILL.md:153:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js convert \\","category":"filesystem","line_end":153,"severity":"medium","line_start":153},{"id":"filesystem:SKILL.md:161:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js convert \\","category":"filesystem","line_end":161,"severity":"medium","line_start":161},{"id":"filesystem:SKILL.md:200:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"node ~/.claude/skills/chrome-extension-icons/scripts/generate-icons.js batch \\","category":"filesystem","line_end":200,"severity":"medium","line_start":200},{"id":"filesystem:SKILL.md:263:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"cd ~/.claude/skills/chrome-extension-icons && npm install","category":"filesystem","line_end":263,"severity":"medium","line_start":263},{"id":"filesystem:SKILL.md:269:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"cd ~/.claude/skills/chrome-extension-icons && npm install","category":"filesystem","line_end":269,"severity":"medium","line_start":269},{"id":"filesystem:SKILL.md:275:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"cd ~/.claude/skills/chrome-extension-icons && npm install","category":"filesystem","line_end":275,"severity":"medium","line_start":275},{"id":"blocker:SKILL.md:58:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Once confirmed (or auto-proceed if user said \"yes\" to any icon), run:","category":"blocker","line_end":58,"severity":"low","line_start":58},{"id":"blocker:SKILL.md:294:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"### Invalid Icon Selection","category":"blocker","line_end":294,"severity":"low","line_start":294}],"finding_verdicts":[{"id":"network:examples/usage.md:24:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:examples/usage.md:55:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:examples/usage.md:56:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:examples/usage.md:57:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:examples/usage.md:58:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:examples/usage.md:115:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:examples/usage.md:118:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:examples/usage.md:121:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:examples/usage.md:124:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:examples/usage.md:445:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"filesystem:examples/usage.md:16:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:36:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:69:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:80:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:133:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:157:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:217:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:254:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:264:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:16:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:36:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:69:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:80:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:133:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:157:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:217:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:254:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:examples/usage.md:264:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"blocker:examples/usage.md:371:system-reconnaissance","reason":"The matched text is ordinary user guidance or an error message, not system reconnaissance or blocking behavior.","verdict":"false_positive","confidence":0.94},{"id":"scripts:scripts/generate-icons.js:26:dynamic-import-expression","reason":"The dynamic import loads the declared sharp dependency so CommonJS code can use an ESM package. It does not import attacker-controlled module names.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:scripts/generate-icons.js:55:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:60:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:78:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:88:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:98:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:100:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:118:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:119:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:129:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:144:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:149:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:150:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:153:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:157:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:160:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:169:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:173:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:176:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:191:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:192:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:206:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:219:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:232:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:240:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:252:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:271:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:279:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:298:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:331:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:332:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:365:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:366:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:375:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:384:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:390:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:392:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:422:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:435:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:436:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:441:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:485:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:552:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:556:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:557:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:560:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:561:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:564:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:567:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:579:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:601:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:606:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/generate-icons.js:617:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"network:scripts/generate-icons.js:29:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:scripts/generate-icons.js:100:hardcoded-url","reason":"The script makes deliberate outbound requests to Iconify endpoints to search and download SVG assets. This is expected for the skill, but it is real network activity users should understand.","verdict":"confirmed","severity":"low","confidence":0.86},{"id":"network:scripts/generate-icons.js:118:hardcoded-url","reason":"The script makes deliberate outbound requests to Iconify endpoints to search and download SVG assets. This is expected for the skill, but it is real network activity users should understand.","verdict":"confirmed","severity":"low","confidence":0.86},{"id":"network:scripts/generate-icons.js:119:hardcoded-url","reason":"The script makes deliberate outbound requests to Iconify endpoints to search and download SVG assets. This is expected for the skill, but it is real network activity users should understand.","verdict":"confirmed","severity":"low","confidence":0.86},{"id":"network:scripts/generate-icons.js:144:hardcoded-url","reason":"The script makes deliberate outbound requests to Iconify endpoints to search and download SVG assets. This is expected for the skill, but it is real network activity users should understand.","verdict":"confirmed","severity":"low","confidence":0.86},{"id":"filesystem:scripts/generate-icons.js:172:node-js-fs-operations","reason":"The script reads and writes user-supplied SVG, output, manifest, and batch configuration paths. This filesystem access is core functionality but can overwrite files when paths are wrong.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"filesystem:scripts/generate-icons.js:209:node-js-fs-operations","reason":"The script reads and writes user-supplied SVG, output, manifest, and batch configuration paths. This filesystem access is core functionality but can overwrite files when paths are wrong.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"filesystem:scripts/generate-icons.js:258:node-js-fs-operations","reason":"The script reads and writes user-supplied SVG, output, manifest, and batch configuration paths. This filesystem access is core functionality but can overwrite files when paths are wrong.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"filesystem:scripts/generate-icons.js:292:node-js-fs-operations","reason":"The script reads and writes user-supplied SVG, output, manifest, and batch configuration paths. This filesystem access is core functionality but can overwrite files when paths are wrong.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"filesystem:scripts/generate-icons.js:377:node-js-fs-operations","reason":"The script reads and writes user-supplied SVG, output, manifest, and batch configuration paths. This filesystem access is core functionality but can overwrite files when paths are wrong.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"filesystem:scripts/generate-icons.js:230:node-js-fs-stat-operations","reason":"fs.stat is used only after PNG generation to report output file size. It does not expose sensitive file contents.","verdict":"false_positive","confidence":0.87},{"id":"filesystem:scripts/generate-icons.js:384:path-traversal-sequence","reason":"The matched line only logs the number of configured projects and contains no path traversal sequence or path concatenation.","verdict":"false_positive","confidence":0.95},{"id":"env_access:scripts/generate-icons.js:607:environment-variable-access-dot-notation","reason":"The only environment access checks process.env.DEBUG to decide whether to print a stack trace. It does not read credentials or transmit environment values.","verdict":"false_positive","confidence":0.92},{"id":"env_access:scripts/generate-icons.js:607:environment-variable-object","reason":"The only environment access checks process.env.DEBUG to decide whether to print a stack trace. It does not read credentials or transmit environment values.","verdict":"false_positive","confidence":0.92},{"id":"sensitive:scripts/generate-icons.js:607:environment-file-access","reason":"The flagged line checks DEBUG mode and does not access .env files or secret material. No environment file is read.","verdict":"false_positive","confidence":0.9},{"id":"blocker:scripts/generate-icons.js:141:system-reconnaissance","reason":"The matched text is ordinary user guidance or an error message, not system reconnaissance or blocking behavior.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:223:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:225:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:241:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:252:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:261:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:264:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:270:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:273:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:276:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:290:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:337:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence, inline code, or JavaScript template literal. No shell execution API or backtick command substitution is present.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:268:sudo-privilege-escalation","reason":"The skill documentation instructs users to run sudo apt-get install libvips-dev for troubleshooting. Elevated package installation is a real privileged operation even if it is disclosed.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"network:SKILL.md:48:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:SKILL.md:119:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:SKILL.md:120:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:SKILL.md:121:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:SKILL.md:122:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"network:SKILL.md:326:hardcoded-url","reason":"This is a documentation or preview URL for Iconify or Sharp, not code that sends data or performs a hidden network request.","verdict":"false_positive","confidence":0.93},{"id":"filesystem:SKILL.md:30:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:61:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:69:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:134:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:153:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:161:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:200:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:263:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:269:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:275:hidden-file-in-home-directory","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:30:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:61:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:69:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:134:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:153:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:161:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:200:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:263:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:269:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:275:hidden-file-access","reason":"The path points to the installed skill script under ~/.claude in documentation examples. It is not reading user secrets or hidden files.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:58:system-reconnaissance","reason":"The matched text is ordinary user guidance or an error message, not system reconnaissance or blocking behavior.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:294:system-reconnaissance","reason":"The matched text is ordinary user guidance or an error message, not system reconnaissance or blocking behavior.","verdict":"false_positive","confidence":0.94}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":10,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}