{"data":{"skill":{"slug":"caffeinelabs-extension-http-outcalls","name":"extension-http-outcalls","icon":"📦","repo":"https://github.com/caffeinelabs/skills/tree/main/skills/extension-http-outcalls/","status":"approved","author":"caffeinelabs","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"382ffd86-0393-450a-a016-e5ed54c83d78","skill_id":"6e254f1c-5357-4b00-a75d-5add41811541","version":1,"content_hash":"v2:b2036d7931ef61c79ffdf43dae2a82ea8514f89a:c2dfef615ea3f9db2165f3bbe5b7a7a78211917747fbe1d70bcc1c8dee5af188:f82138bb96976314c7b77eb8c45ccc101b383234d5b3a5d9ddb5fa48e7a10a8c:5d7273677d9a44e5955a978dc91a6680","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The static backtick findings are false positives from Markdown inline text and Motoko code fences, not shell execution. The hardcoded URL is a documentation link, not a runtime network request. No prompt injection or malicious intent was found in SKILL.md.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":46,"line_start":24},{"file":"SKILL.md","line_end":50,"line_start":46},{"file":"SKILL.md","line_end":62,"line_start":50}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":67,"audit_model":"codex","audited_at":"2026-07-07T12:24:06.627+00:00","created_at":"2026-07-07T13:06:43.64504+00:00","static_findings":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"There is the prefabricated module `mo:caffeineai-http-outcalls/outcall.mo` that that cannot be modif","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```mo:caffeineai-http-outcalls/outcall","category":"external_commands","line_end":46,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":50,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```motoko filepath=src/backend/main.mo","category":"external_commands","line_end":62,"severity":"medium","line_start":50},{"id":"network:SKILL.md:12:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"HTTP outcalls extension for [Caffeine AI](https://caffeine.ai?utm_source=caffeine-skill&utm_medium=r","category":"network","line_end":12,"severity":"low","line_start":12}],"finding_verdicts":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"Line 22 uses Markdown inline backticks around a Motoko module path. It is documentation text, not Ruby or shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"Lines 24-46 are a fenced Motoko module API description. The backticks mark a code block and do not execute commands.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"Line 46 closes the fenced code block. It is Markdown syntax with no executable shell context.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"Lines 50-62 are a fenced Motoko usage example. The snippet imports a Motoko module and performs no shell execution.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:12:hardcoded-url","reason":"Line 12 is a documentation hyperlink to Caffeine AI. It is not a runtime HTTP request or data exfiltration path.","verdict":"false_positive","confidence":0.93}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}