{"data":{"skill":{"slug":"brianlovin-chrome-webstore-release-blueprint","name":"chrome-webstore-release-blueprint","icon":"📦","repo":"https://github.com/brianlovin/agent-config/tree/1a9819ebf3fee811150fc76cbe177ea4e5f747ff/skills/chrome-webstore-release-blueprint","status":"approved","author":"brianlovin","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"e0f1bc6a-fa3b-43be-9f21-80bee6c0779f","skill_id":"e4fb2218-6337-46ac-970e-a3ee924ebd9b","version":1,"content_hash":"v3:367c7bb3962eb92a1b87fc08b2947aeda00cd51d:2ab50e2c011404c02143ea158886ddbfb42e81adf3ff9b5166c7901e9ac774fb:97e24413fbfa572ce8918626fa63720338f542cead02e5b871a56a49cfd8434c:736b696c6c732f627269616e6c6f76696e2f6368726f6d652d77656273746f72652d72656c656173652d626c75657072696e74:f8545b0bc2e17afe308b56577eceeda6","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"The static matches are false positives because they identify Markdown examples, official documentation URLs, and a stated secret-file convention rather than executable behavior. The guide contains one confirmed high-severity credential-handling issue because it asks users to paste OAuth secrets into the agent conversation.","remediation":[{"issue":"The guide asks users to paste CWS_CLIENT_SECRET and CWS_REFRESH_TOKEN into the agent conversation.","severity":"high","suggestion":"Remove those prompts and instruct users to enter credentials directly into approved local or CI secret storage. Use placeholders and verify only variable presence or masked output."},{"issue":"The proposed GitHub secret upload helper could receive highly privileged publishing credentials.","severity":"high","suggestion":"Require explicit confirmation, least-privilege repository permissions, a dry run, masked logs, and an audit of the destination repository before uploading any secret."},{"issue":"The workflow blueprint can publish an extension after a version change.","severity":"medium","suggestion":"Add a protected environment or manual approval before production publish, and validate the package, manifest, target item, and workflow identity before submission."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":77,"line_start":77},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":96,"line_start":96},{"file":"SKILL.md","line_end":97,"line_start":97},{"file":"SKILL.md","line_end":99,"line_start":99},{"file":"SKILL.md","line_end":100,"line_start":100},{"file":"SKILL.md","line_end":102,"line_start":102},{"file":"SKILL.md","line_end":106,"line_start":106},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":114,"line_start":114},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":123,"line_start":123},{"file":"SKILL.md","line_end":124,"line_start":124},{"file":"SKILL.md","line_end":125,"line_start":125},{"file":"SKILL.md","line_end":126,"line_start":126},{"file":"SKILL.md","line_end":127,"line_start":127},{"file":"SKILL.md","line_end":139,"line_start":133},{"file":"SKILL.md","line_end":143,"line_start":139},{"file":"SKILL.md","line_end":147,"line_start":143},{"file":"SKILL.md","line_end":150,"line_start":147},{"file":"SKILL.md","line_end":152,"line_start":150},{"file":"SKILL.md","line_end":153,"line_start":152},{"file":"SKILL.md","line_end":158,"line_start":153},{"file":"SKILL.md","line_end":160,"line_start":158},{"file":"SKILL.md","line_end":163,"line_start":160},{"file":"SKILL.md","line_end":172,"line_start":163},{"file":"SKILL.md","line_end":174,"line_start":172},{"file":"SKILL.md","line_end":176,"line_start":174},{"file":"SKILL.md","line_end":181,"line_start":176},{"file":"SKILL.md","line_end":184,"line_start":181},{"file":"SKILL.md","line_end":187,"line_start":184},{"file":"SKILL.md","line_end":188,"line_start":187},{"file":"SKILL.md","line_end":189,"line_start":188},{"file":"SKILL.md","line_end":190,"line_start":189},{"file":"SKILL.md","line_end":197,"line_start":190}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":99,"line_start":99},{"file":"SKILL.md","line_end":172,"line_start":172},{"file":"SKILL.md","line_end":174,"line_start":174},{"file":"SKILL.md","line_end":181,"line_start":181},{"file":"SKILL.md","line_end":184,"line_start":184},{"file":"SKILL.md","line_end":247,"line_start":247},{"file":"SKILL.md","line_end":249,"line_start":249},{"file":"SKILL.md","line_end":251,"line_start":251},{"file":"SKILL.md","line_end":253,"line_start":253},{"file":"SKILL.md","line_end":255,"line_start":255}]}],"critical_findings":[],"high_findings":[{"title":"Credential Disclosure Through Agent Prompts","locations":[{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":109,"line_start":109}],"confidence":0.99,"description":"The guide asks users to paste the OAuth client secret and refresh token into the agent conversation. Chat transcripts or agent context may expose these credentials, enabling unauthorized token use or Chrome Web Store actions.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The source explicitly requests both sensitive OAuth values in agent prompts. This is direct evidence of a credential-handling risk, even though the surrounding text says to treat them as secrets."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":264,"audit_model":"codex","audited_at":"2026-09-09T12:38:51.647+00:00","created_at":"2026-09-09T14:28:50.156361+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Verifying submission state (`PUBLISHED`, `PENDING_REVIEW`, etc.).","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If `gh` is available, offer secret upload automation; if not, provide manual fallback.","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- release branch policy (`main`, tags, or manual dispatch)","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- local secret file convention (`.env`, `.env.local`, etc.)","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- \"Do you want me to wire GitHub secret upload via `gh`?\"","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `https://console.cloud.google.com/apis/library/chromewebstore.googleapis.com`","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Click `Enable` for Chrome Web Store API.","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `https://console.cloud.google.com/apis/credentials/consent`","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Choose `External` user type (for non-Workspace internal apps).","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `https://console.cloud.google.com/apis/credentials`","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Click `Create Credentials` -> `OAuth client ID`.","category":"external_commands","line_end":76,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Choose application type `Web application`.","category":"external_commands","line_end":77,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `https://developers.google.com/oauthplayground`","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `CWS_CLIENT_ID`","category":"external_commands","line_end":83,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `CWS_CLIENT_SECRET`","category":"external_commands","line_end":84,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- \"Paste `CWS_CLIENT_ID` and `CWS_CLIENT_SECRET` when ready (I will treat them as secrets).\"","category":"external_commands","line_end":87,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `https://developers.google.com/oauthplayground/`","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Enable `Use your own OAuth credentials`.","category":"external_commands","line_end":96,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Paste `CWS_CLIENT_ID` and `CWS_CLIENT_SECRET`.","category":"external_commands","line_end":97,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `https://www.googleapis.com/auth/chromewebstore`","category":"external_commands","line_end":99,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. Click `Authorize APIs`.","category":"external_commands","line_end":100,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"7. Click `Exchange authorization code for tokens`.","category":"external_commands","line_end":102,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `CWS_REFRESH_TOKEN`","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- \"Paste `CWS_REFRESH_TOKEN` now. I will only place it in local secret storage/CI secrets.\"","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `CWS_EXTENSION_ID` (the extension item ID from store/developer listing URL)","category":"external_commands","line_end":114,"severity":"medium","line_start":114},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `CWS_PUBLISHER_ID` (developer/publisher ID from Chrome Web Store developer account context)","category":"external_commands","line_end":115,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `CWS_CLIENT_ID`","category":"external_commands","line_end":123,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `CWS_CLIENT_SECRET`","category":"external_commands","line_end":124,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `CWS_REFRESH_TOKEN`","category":"external_commands","line_end":125,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `CWS_PUBLISHER_ID`","category":"external_commands","line_end":126,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `CWS_EXTENSION_ID`","category":"external_commands","line_end":127,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```env","category":"external_commands","line_end":139,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":143,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If using GitHub Actions, ask user if `gh` automation is desired.","category":"external_commands","line_end":147,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":150,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":152,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If `gh` auth is missing, tell user to run:","category":"external_commands","line_end":153,"severity":"medium","line_start":152},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `gh auth login`","category":"external_commands","line_end":158,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- supports `--dry-run`","category":"external_commands","line_end":160,"severity":"medium","line_start":158},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- uploads with `gh secret set ... --repo ...`","category":"external_commands","line_end":163,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If user declines `gh`, provide manual secret entry checklist for repository settings.","category":"external_commands","line_end":172,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `POST https://oauth2.googleapis.com/token`","category":"external_commands","line_end":174,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `GET https://chromewebstore.googleapis.com/v2/publishers/<publisherId>/items/<extensionId>:fetchSt","category":"external_commands","line_end":176,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `publishedItemRevisionStatus.distributionChannels[0].crxVersion`","category":"external_commands","line_end":181,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`POST https://chromewebstore.googleapis.com/upload/v2/publishers/<publisherId>/items/<extensionId>:u","category":"external_commands","line_end":184,"severity":"medium","line_start":181},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`POST https://chromewebstore.googleapis.com/v2/publishers/<publisherId>/items/<extensionId>:publish`","category":"external_commands","line_end":187,"severity":"medium","line_start":184},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `PENDING_REVIEW`","category":"external_commands","line_end":188,"severity":"medium","line_start":187},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `PUBLISHED`","category":"external_commands","line_end":189,"severity":"medium","line_start":188},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `PUBLISHED_TO_TESTERS`","category":"external_commands","line_end":190,"severity":"medium","line_start":189},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `STAGED`","category":"external_commands","line_end":197,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- accepts env values (and optional `--env-file`)","category":"external_commands","line_end":198,"severity":"medium","line_start":197},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- optionally accepts `--manifest` for local version comparison","category":"external_commands","line_end":199,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- supports `--json`","category":"external_commands","line_end":200,"severity":"medium","line_start":199},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- calls token endpoint + `fetchStatus`","category":"external_commands","line_end":202,"severity":"medium","line_start":200},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `itemId`","category":"external_commands","line_end":203,"severity":"medium","line_start":202},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `localVersion`","category":"external_commands","line_end":204,"severity":"medium","line_start":203},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `publishedVersion`","category":"external_commands","line_end":205,"severity":"medium","line_start":204},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `publishedState`","category":"external_commands","line_end":206,"severity":"medium","line_start":205},{"id":"external_commands:SKILL.md:206:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `submittedVersion`","category":"external_commands","line_end":207,"severity":"medium","line_start":206},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `submittedState`","category":"external_commands","line_end":208,"severity":"medium","line_start":207},{"id":"external_commands:SKILL.md:208:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `upToDate`","category":"external_commands","line_end":209,"severity":"medium","line_start":208},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `pendingReview`","category":"external_commands","line_end":215,"severity":"medium","line_start":209},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- print concise human summary when `--json` is not used","category":"external_commands","line_end":228,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- expect `PENDING_REVIEW` first in many cases","category":"external_commands","line_end":233,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `invalid_grant`:","category":"external_commands","line_end":235,"severity":"medium","line_start":233},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `403` from CWS endpoint:","category":"external_commands","line_end":247,"severity":"medium","line_start":235},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`https://developer.chrome.com/docs/webstore/using-api`","category":"external_commands","line_end":249,"severity":"medium","line_start":247},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`https://developer.chrome.com/docs/webstore/publish`","category":"external_commands","line_end":251,"severity":"medium","line_start":249},{"id":"external_commands:SKILL.md:251:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`https://developers.google.com/oauthplayground/`","category":"external_commands","line_end":253,"severity":"medium","line_start":251},{"id":"external_commands:SKILL.md:253:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`https://console.cloud.google.com/apis/library/chromewebstore.googleapis.com`","category":"external_commands","line_end":255,"severity":"medium","line_start":253},{"id":"network:SKILL.md:45:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- `https://console.cloud.google.com/apis/library/chromewebstore.googleapis.com`","category":"network","line_end":45,"severity":"low","line_start":45},{"id":"network:SKILL.md:57:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- `https://console.cloud.google.com/apis/credentials/consent`","category":"network","line_end":57,"severity":"low","line_start":57},{"id":"network:SKILL.md:73:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- `https://console.cloud.google.com/apis/credentials`","category":"network","line_end":73,"severity":"low","line_start":73},{"id":"network:SKILL.md:79:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- `https://developers.google.com/oauthplayground`","category":"network","line_end":79,"severity":"low","line_start":79},{"id":"network:SKILL.md:92:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- `https://developers.google.com/oauthplayground/`","category":"network","line_end":92,"severity":"low","line_start":92},{"id":"network:SKILL.md:99:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- `https://www.googleapis.com/auth/chromewebstore`","category":"network","line_end":99,"severity":"low","line_start":99},{"id":"network:SKILL.md:172:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- `POST https://oauth2.googleapis.com/token`","category":"network","line_end":172,"severity":"low","line_start":172},{"id":"network:SKILL.md:174:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- `GET https://chromewebstore.googleapis.com/v2/publishers/<publisherId>/items/<extensionId>:fetchSt","category":"network","line_end":174,"severity":"low","line_start":174},{"id":"network:SKILL.md:181:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`POST https://chromewebstore.googleapis.com/upload/v2/publishers/<publisherId>/items/<extensionId>:u","category":"network","line_end":181,"severity":"low","line_start":181},{"id":"network:SKILL.md:184:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`POST https://chromewebstore.googleapis.com/v2/publishers/<publisherId>/items/<extensionId>:publish`","category":"network","line_end":184,"severity":"low","line_start":184},{"id":"network:SKILL.md:247:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`https://developer.chrome.com/docs/webstore/using-api`","category":"network","line_end":247,"severity":"low","line_start":247},{"id":"network:SKILL.md:249:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`https://developer.chrome.com/docs/webstore/publish`","category":"network","line_end":249,"severity":"low","line_start":249},{"id":"network:SKILL.md:251:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`https://developers.google.com/oauthplayground/`","category":"network","line_end":251,"severity":"low","line_start":251},{"id":"network:SKILL.md:253:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`https://console.cloud.google.com/apis/library/chromewebstore.googleapis.com`","category":"network","line_end":253,"severity":"low","line_start":253},{"id":"network:SKILL.md:255:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`https://console.cloud.google.com/apis/credentials`","category":"network","line_end":255,"severity":"low","line_start":255},{"id":"sensitive:SKILL.md:34:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"- local secret file convention (`.env`, `.env.local`, etc.)","category":"sensitive","line_end":34,"severity":"high","line_start":34},{"id":"sensitive:SKILL.md:34:environment-variant-files","file":"SKILL.md","pattern":"Environment variant files","snippet":"- local secret file convention (`.env`, `.env.local`, etc.)","category":"sensitive","line_end":34,"severity":"high","line_start":34}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:206:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:208:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:251:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:253:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a fenced command example in SKILL.md, not executable Ruby or shell code. The skill describes commands for the user and does not execute them itself.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:45:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:57:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:73:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:79:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:92:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:99:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:172:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:174:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:181:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:184:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:247:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:249:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:251:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:253:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:255:hardcoded-url","reason":"The URL is an official Google, Chrome Web Store, or OAuth documentation endpoint used for the stated workflow. No evidence indicates a malicious destination or unauthorized network action.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:34:environment-file-access","reason":"The line asks the user to identify a local secret-file convention but does not read a file or expose its contents. It is guidance text, not file access by the skill.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:34:environment-variant-files","reason":"The line asks the user to identify a local secret-file convention but does not read a file or expose its contents. It is guidance text, not file access by the skill.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Credential Disclosure Through Agent Prompts","severity":"high","locations":[{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":109,"line_start":109}],"confidence":0.99,"description":"The guide asks users to paste the OAuth client secret and refresh token into the agent conversation. Chat transcripts or agent context may expose these credentials, enabling unauthorized token use or Chrome Web Store actions.","confidence_reasoning":"The source explicitly requests both sensitive OAuth values in agent prompts. This is direct evidence of a credential-handling risk, even though the surrounding text says to treat them as secrets."}],"subject_marketplace_commit_sha":"367c7bb3962eb92a1b87fc08b2947aeda00cd51d","subject_content_hash":"2ab50e2c011404c02143ea158886ddbfb42e81adf3ff9b5166c7901e9ac774fb","subject_tree_hash":"97e24413fbfa572ce8918626fa63720338f542cead02e5b871a56a49cfd8434c","subject_plugin_path":"skills/brianlovin/chrome-webstore-release-blueprint","audit_payload_hash":"f8545b0bc2e17afe308b56577eceeda6","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"367c7bb3962eb92a1b87fc08b2947aeda00cd51d","contentHash":"2ab50e2c011404c02143ea158886ddbfb42e81adf3ff9b5166c7901e9ac774fb","treeHash":"97e24413fbfa572ce8918626fa63720338f542cead02e5b871a56a49cfd8434c","pluginPath":"skills/brianlovin/chrome-webstore-release-blueprint","auditPayloadHash":"f8545b0bc2e17afe308b56577eceeda6"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/brianlovin-chrome-webstore-release-blueprint/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}