{"data":{"skill":{"slug":"brianlovin-tdd","name":"tdd","icon":"📦","repo":"https://github.com/brianlovin/agent-config/tree/1a9819ebf3fee811150fc76cbe177ea4e5f747ff/skills/tdd","status":"approved","author":"brianlovin","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"e13009ce-692d-41cc-a39d-f23a325b0969","skill_id":"1c129bd0-f0a3-45c1-ad3b-b133bca1a4f4","version":1,"content_hash":"v3:6b4c2c37d714f625bf5f1482f739feeb23554773:1d0a1439aefa3ebe6a8fe83b5bb4559610d75268edd0bd4ef7d391d841742fc5:fcd9cf64de7cf340a20b3cc65d96617a37f674560d7f189446b64e3f3c28a561:736b696c6c732f627269616e6c6f76696e2f746464:fb79b453cbf735e4cb3750a2984d168a","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 21 static alerts are false positives caused by inert Markdown examples, code fences, template literals, or unrelated prose. No executable scripts, malicious intent, credential exposure, prompt injection, or unauthorized network behavior were found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"mocking.md","line_end":45,"line_start":44},{"file":"mocking.md","line_end":53,"line_start":45},{"file":"SKILL.md","line_end":41,"line_start":31},{"file":"SKILL.md","line_end":64,"line_start":41},{"file":"SKILL.md","line_end":67,"line_start":64},{"file":"SKILL.md","line_end":75,"line_start":67},{"file":"SKILL.md","line_end":78,"line_start":75},{"file":"SKILL.md","line_end":101,"line_start":78},{"file":"SKILL.md","line_end":107,"line_start":101}]},{"factor":"network","evidence":[{"file":"mocking.md","line_end":44,"line_start":44},{"file":"mocking.md","line_end":45,"line_start":45},{"file":"mocking.md","line_end":46,"line_start":46},{"file":"mocking.md","line_end":51,"line_start":51}]},{"factor":"env_access","evidence":[{"file":"mocking.md","line_end":32,"line_start":32},{"file":"mocking.md","line_end":32,"line_start":32}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":6,"total_lines":307,"audit_model":"codex","audited_at":"2026-08-21T08:33:55.262+00:00","created_at":"2026-08-21T10:04:16.838625+00:00","static_findings":[{"id":"blocker:interface-design.md:24:system-reconnaissance","file":"interface-design.md","pattern":"System reconnaissance","snippet":"function applyDiscount(cart): void {","category":"blocker","line_end":24,"severity":"low","line_start":24},{"id":"external_commands:mocking.md:44:ruby-shell-backtick-execution","file":"mocking.md","pattern":"Ruby/shell backtick execution","snippet":"getUser: (id) => fetch(`/users/${id}`),","category":"external_commands","line_end":45,"severity":"medium","line_start":44},{"id":"external_commands:mocking.md:45:ruby-shell-backtick-execution","file":"mocking.md","pattern":"Ruby/shell backtick execution","snippet":"getOrders: (userId) => fetch(`/users/${userId}/orders`),","category":"external_commands","line_end":53,"severity":"medium","line_start":45},{"id":"network:mocking.md:44:fetch-api-call","file":"mocking.md","pattern":"Fetch API call","snippet":"getUser: (id) => fetch(`/users/${id}`),","category":"network","line_end":44,"severity":"low","line_start":44},{"id":"network:mocking.md:45:fetch-api-call","file":"mocking.md","pattern":"Fetch API call","snippet":"getOrders: (userId) => fetch(`/users/${userId}/orders`),","category":"network","line_end":45,"severity":"low","line_start":45},{"id":"network:mocking.md:46:fetch-api-call","file":"mocking.md","pattern":"Fetch API call","snippet":"createOrder: (data) => fetch('/orders', { method: 'POST', body: data }),","category":"network","line_end":46,"severity":"low","line_start":46},{"id":"network:mocking.md:51:fetch-api-call","file":"mocking.md","pattern":"Fetch API call","snippet":"fetch: (endpoint, options) => fetch(endpoint, options),","category":"network","line_end":51,"severity":"low","line_start":51},{"id":"env_access:mocking.md:32:environment-variable-access-dot-notation","file":"mocking.md","pattern":"Environment variable access (dot notation)","snippet":"const client = new StripeClient(process.env.STRIPE_KEY);","category":"env_access","line_end":32,"severity":"low","line_start":32},{"id":"env_access:mocking.md:32:environment-variable-object","file":"mocking.md","pattern":"Environment variable object","snippet":"const client = new StripeClient(process.env.STRIPE_KEY);","category":"env_access","line_end":32,"severity":"low","line_start":32},{"id":"sensitive:mocking.md:32:environment-file-access","file":"mocking.md","pattern":"Environment file access","snippet":"const client = new StripeClient(process.env.STRIPE_KEY);","category":"sensitive","line_end":32,"severity":"high","line_start":32},{"id":"blocker:mocking.md:7:network-reconnaissance","file":"mocking.md","pattern":"Network reconnaissance","snippet":"- Time/randomness","category":"blocker","line_end":8,"severity":"low","line_start":7},{"id":"blocker:refactoring.md:5:network-reconnaissance","file":"refactoring.md","pattern":"Network reconnaissance","snippet":"- **Duplication** → Extract function/class","category":"blocker","line_end":6,"severity":"low","line_start":5},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":41,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":64,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":67,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":75,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":78,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":101,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":107,"severity":"medium","line_start":101},{"id":"blocker:SKILL.md:12:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"**Good tests** are integration-style: they exercise real code paths through public APIs. They descri","category":"blocker","line_end":12,"severity":"low","line_start":12},{"id":"blocker:tests.md:9:system-reconnaissance","file":"tests.md","pattern":"System reconnaissance","snippet":"test(\"user can checkout with valid cart\", async () => {","category":"blocker","line_end":9,"severity":"low","line_start":9}],"finding_verdicts":[{"id":"blocker:interface-design.md:24:system-reconnaissance","reason":"The line is an inert TypeScript example showing a function that mutates a cart. It performs no system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:mocking.md:44:ruby-shell-backtick-execution","reason":"The backticks form a JavaScript template literal inside a Markdown example. They do not invoke a shell or execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:mocking.md:45:ruby-shell-backtick-execution","reason":"The backticks interpolate a user identifier into a relative URL in sample TypeScript. This is not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"network:mocking.md:44:fetch-api-call","reason":"This fetch call appears only in a fenced documentation example about mockable API interfaces. The skill does not execute it or specify an external host.","verdict":"false_positive","confidence":0.98},{"id":"network:mocking.md:45:fetch-api-call","reason":"This relative fetch call is inert sample code used to explain dependency boundaries. It does not cause the skill to contact a network service.","verdict":"false_positive","confidence":0.98},{"id":"network:mocking.md:46:fetch-api-call","reason":"The POST request is a fenced TypeScript example of a specific API method. It is not executed and contains no destination host or sensitive data.","verdict":"false_positive","confidence":0.98},{"id":"network:mocking.md:51:fetch-api-call","reason":"The generic fetch wrapper is explicitly presented as a bad interface design example. It is inert documentation rather than operational network behavior.","verdict":"false_positive","confidence":0.98},{"id":"env_access:mocking.md:32:environment-variable-access-dot-notation","reason":"The environment access is inert sample code illustrating a hard-to-mock dependency. The skill does not read the host environment.","verdict":"false_positive","confidence":0.99},{"id":"env_access:mocking.md:32:environment-variable-object","reason":"The process.env reference appears only in a fenced TypeScript example marked as hard to mock. No environment object is accessed during skill use.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:mocking.md:32:environment-file-access","reason":"The line references one environment variable in illustrative code and does not access an environment file. No credential value is included or transmitted.","verdict":"false_positive","confidence":0.99},{"id":"blocker:mocking.md:7:network-reconnaissance","reason":"The phrase lists time and randomness as test boundaries. It contains no network discovery command, target, or reconnaissance instruction.","verdict":"false_positive","confidence":0.99},{"id":"blocker:refactoring.md:5:network-reconnaissance","reason":"The line recommends extracting duplicated code during refactoring. It has no connection to network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The detected characters open and close a Markdown code fence containing a conceptual workflow diagram. No shell command is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The line closes a Markdown code fence and the following prose provides planning guidance. It does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"This is a Markdown fence around a plain-text red-green workflow example. The fenced content contains no executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"This line closes a Markdown fence after conceptual test and implementation steps. It is formatting, not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The Markdown fence contains only red-green process labels. It neither names nor invokes an external program.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The line closes a Markdown example and is followed by testing rules. There is no command execution mechanism.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"The fenced block is a human-readable checklist with no commands or code. Markdown backticks alone do not create external execution.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:12:system-reconnaissance","reason":"The prose recommends testing public APIs through real code paths. It does not instruct the agent to inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:tests.md:9:system-reconnaissance","reason":"The line starts an inert checkout test example. It contains no system discovery, host inspection, or reconnaissance behavior.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"6b4c2c37d714f625bf5f1482f739feeb23554773","subject_content_hash":"1d0a1439aefa3ebe6a8fe83b5bb4559610d75268edd0bd4ef7d391d841742fc5","subject_tree_hash":"fcd9cf64de7cf340a20b3cc65d96617a37f674560d7f189446b64e3f3c28a561","subject_plugin_path":"skills/brianlovin/tdd","audit_payload_hash":"fb79b453cbf735e4cb3750a2984d168a","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"6b4c2c37d714f625bf5f1482f739feeb23554773","contentHash":"1d0a1439aefa3ebe6a8fe83b5bb4559610d75268edd0bd4ef7d391d841742fc5","treeHash":"fcd9cf64de7cf340a20b3cc65d96617a37f674560d7f189446b64e3f3c28a561","pluginPath":"skills/brianlovin/tdd","auditPayloadHash":"fb79b453cbf735e4cb3750a2984d168a"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/brianlovin-tdd/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}