{"data":{"skill":{"slug":"boulea7-chrome-extension-icons","name":"chrome-extension-icons","icon":"📦","repo":"https://github.com/Boulea7/ChromeExtensionIconsSkill/tree/main/skill/","status":"approved","author":"Boulea7","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"db4e4103-44cc-4e98-b3a2-c176ff5c53b5","skill_id":"6dd0e0eb-bb56-4166-9b49-0bd03a3d61ee","version":2,"content_hash":"f13531242db1338ee967a1baa1864802","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"This skill is a legitimate icon generation tool for Chrome extensions. It makes documented HTTPS requests to the Iconify API to search and download icons, converts SVG to PNG using the Sharp library, and updates manifest.json. All operations are confined to user-specified directories with no exfiltration or persistence mechanisms.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"scripts/generate-icons.js","line_end":92,"line_start":46},{"file":"scripts/generate-icons.js","line_end":132,"line_start":97},{"file":"scripts/generate-icons.js","line_end":163,"line_start":137}]},{"factor":"filesystem","evidence":[{"file":"scripts/generate-icons.js","line_end":179,"line_start":168},{"file":"scripts/generate-icons.js","line_end":246,"line_start":200},{"file":"scripts/generate-icons.js","line_end":301,"line_start":251}]},{"factor":"scripts","evidence":[{"file":"scripts/generate-icons.js","line_end":631,"line_start":1}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Network requests to external API","locations":[{"file":"scripts/generate-icons.js","line_end":163,"line_start":97}],"description":"The script makes HTTPS requests to api.iconify.design to search for and download icons. This is documented and expected behavior for a legitimate icon generation tool. Endpoints accessed: search API at line 100 and download API at line 144."},{"title":"Filesystem write access in user directories","locations":[{"file":"scripts/generate-icons.js","line_end":246,"line_start":200}],"description":"The script writes PNG files to user-specified output directories and modifies manifest.json. This is necessary for icon generation but provides filesystem access beyond the skill's own directory."}],"dangerous_patterns":[],"files_scanned":4,"total_lines":1485,"audit_model":"claude","audited_at":"2026-01-10T11:29:10.915+00:00","created_at":"2026-01-11T05:02:16.156527+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}