{"data":{"skill":{"slug":"caldoai-untangle-codebase","name":"untangle-codebase","icon":"📦","repo":"https://github.com/caldoai/skills/tree/f3cf47774975a7d9fca45730babf4ff7ad765ada/skills/untangle-codebase","status":"approved","author":"caldoai","authorVersion":null,"skillstoreRevision":1,"license":null},"licenseCorrection":null,"audit":{"id":"86a910cd-b751-4f68-9d58-1e25a9972609","skill_id":"ae299056-240d-415a-abd8-d9fb5361152c","version":1,"content_hash":"v3:c993c6abcbffafea2683d7748b53b3dfaf438415:b4eb6b5130c38ca04532601e99d2d174cf4faa4df520b5b7ba609e8707e55761:595992cacab8fbed504076fdcbcc5b95c61a17000ff93aa5341cd8bc83793a49:736b696c6c732f63616c646f61692f756e74616e676c652d636f646562617365:97ddb24fe4b03d2f99b0da5c3a7b8ab2","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 29 static findings are false positives caused by Markdown backticks around examples, identifiers, and code fences. No evidence found of credential theft, data exfiltration, or prompt injection. One semantic risk concerns stripping function bodies without specifying a separate analysis copy, which could damage working source.","remediation":[{"issue":"The skeleton-generation tip does not require a separate copy before removing function bodies.","severity":"medium","suggestion":"Generate skeletons in a separate temporary directory without overwriting source files, and preserve all existing user changes."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":114,"line_start":113},{"file":"SKILL.md","line_end":115,"line_start":114},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":116,"line_start":116},{"file":"SKILL.md","line_end":118,"line_start":117},{"file":"SKILL.md","line_end":119,"line_start":118},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":121,"line_start":120},{"file":"SKILL.md","line_end":121,"line_start":121},{"file":"SKILL.md","line_end":123,"line_start":122},{"file":"SKILL.md","line_end":123,"line_start":123},{"file":"SKILL.md","line_end":128,"line_start":124},{"file":"SKILL.md","line_end":129,"line_start":128},{"file":"SKILL.md","line_end":130,"line_start":129},{"file":"SKILL.md","line_end":131,"line_start":130},{"file":"SKILL.md","line_end":131,"line_start":131},{"file":"SKILL.md","line_end":133,"line_start":132},{"file":"SKILL.md","line_end":133,"line_start":133},{"file":"SKILL.md","line_end":134,"line_start":134},{"file":"SKILL.md","line_end":136,"line_start":136},{"file":"SKILL.md","line_end":138,"line_start":137},{"file":"SKILL.md","line_end":139,"line_start":138},{"file":"SKILL.md","line_end":140,"line_start":139},{"file":"SKILL.md","line_end":141,"line_start":140},{"file":"SKILL.md","line_end":141,"line_start":141}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Skeleton Generation Lacks Source Preservation Safeguard","locations":[{"file":"SKILL.md","line_end":102,"line_start":102}],"confidence":0.86,"description":"The tip says \"script away the function bodies\" without requiring a separate analysis copy. Applying this directly could erase implementation and uncommitted work.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The instruction explicitly proposes removing function bodies but provides no output-location or preservation constraint. Data loss depends on the implementing agent modifying originals."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":143,"audit_model":"codex","audited_at":"2026-11-06T15:33:11.636+00:00","created_at":"2026-11-09T15:33:03.682441+00:00","static_findings":[{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- An `if` for one value","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Comments that restate the implementation, like `// sort first so the binary search works`, only ch","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Comments about something outside the code, like `// the proxy drops websockets, so we poll`, chang","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Comments that explain a workaround om the codebase, like `// wait 100ms because the cache isn't re","category":"external_commands","line_end":80,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```md","category":"external_commands","line_end":114,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ui/LogoutDialog.tsx:30` waits 100ms after closing and hopes the message input can take focus by t","category":"external_commands","line_end":115,"severity":"medium","line_start":114},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ui/Toolbar.tsx:40` and `ui/Menu.tsx:22` call the same actions, each with its own check for when t","category":"external_commands","line_end":115,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `checkout/submit.ts:9` depends directly on `payments/stripe.ts`.","category":"external_commands","line_end":116,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `shortcuts/keymap.ts:18` has a switch with one case per action, separate from the menu's list.","category":"external_commands","line_end":118,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ui/CommandPalette.tsx:55` keeps its own list of actions, and it's missing the newer ones.","category":"external_commands","line_end":119,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ui/SettingsDialog.tsx:61` sets a global `skipRefocus` flag to stop the logout dialog it opens fro","category":"external_commands","line_end":119,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `history/undo.ts:30` has a special case for every action that can be undone.","category":"external_commands","line_end":121,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `refunds/refund.ts:22` wraps every Stripe call in `if (order.provider === \"paypal\")`.","category":"external_commands","line_end":121,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Every action handler has to call `track()` by hand, and some don't.","category":"external_commands","line_end":123,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ui/Toolbar.test.tsx` and `ui/Menu.test.tsx` test the same actions separately.","category":"external_commands","line_end":123,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":128,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```md","category":"external_commands","line_end":129,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Make the general `Dialog` give focus back to whatever had it before it opened, so the wait and the","category":"external_commands","line_end":130,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ui/LogoutDialog.tsx:30` waits 100ms after closing and hopes the message input can take focus by t","category":"external_commands","line_end":131,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ui/SettingsDialog.tsx:61` sets a global `skipRefocus` flag to stop the logout dialog it opens fro","category":"external_commands","line_end":131,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Define a `PaymentProvider` interface that Stripe and PayPal both implement, so checkout and refund","category":"external_commands","line_end":133,"severity":"medium","line_start":132},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `checkout/submit.ts:9` depends directly on `payments/stripe.ts`.","category":"external_commands","line_end":133,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `refunds/refund.ts:22` wraps every Stripe call in `if (order.provider === \"paypal\")`.","category":"external_commands","line_end":134,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ui/Toolbar.tsx:40` and `ui/Menu.tsx:22` call the same actions, each with its own check for when t","category":"external_commands","line_end":136,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `shortcuts/keymap.ts:18` has a switch with one case per action, separate from the menu's list.","category":"external_commands","line_end":138,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ui/CommandPalette.tsx:55` keeps its own list of actions, and it's missing the newer ones.","category":"external_commands","line_end":139,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `history/undo.ts:30` has a special case for every action that can be undone.","category":"external_commands","line_end":140,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Every action handler has to call `track()` by hand, and some don't.","category":"external_commands","line_end":141,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ui/Toolbar.test.tsx` and `ui/Menu.test.tsx` test the same actions separately.","category":"external_commands","line_end":141,"severity":"medium","line_start":141}],"finding_verdicts":[{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The backticks format the keyword if in a Markdown list of special cases. There is no shell or Ruby execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The backticks delimit an illustrative source comment about sorting. The text explains comment cleanup rather than executing a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The backticks format a source-comment example about polling. No executable shell expression or network operation is provided.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The backticks surround a comment describing a cache workaround. This is documentation, not a command to run.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"The triple backticks open a Markdown example containing a problem list. They do not introduce shell or Ruby code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","reason":"The example formats a hypothetical source location while describing a focus delay. No command execution is requested.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The backticks format illustrative toolbar and menu source references. The surrounding prose describes duplicated action checks, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"This example describes a dependency between checkout and a payment module. Its backticks are Markdown path formatting, not executable substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"The example uses a formatted source reference to describe a duplicated action switch. No shell command appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"The backticks mark an illustrative command-palette source reference. The text describes a stale action list and contains no executable command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"Backticks format a hypothetical dialog location and the skipRefocus identifier. The example describes global state rather than invoking a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"This is a Markdown problem-list entry about undo special cases. Its formatted source location is not a shell expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"Backticks format an example refund location and a conditional expression. The fenced Markdown list does not execute that expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"The track() text names an illustrative application function in a documentation example. It neither executes tracking nor defines a shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The backticks format two hypothetical test-file references. The prose discusses duplicated test coverage without executing files.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The matched span crosses a closing Markdown fence and the opening of another example. These are document delimiters, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"The triple backticks open a Markdown decision-log example. The following text proposes a dialog redesign, not an executable command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The Dialog identifier is formatted inline within a focus-management proposal. Adjacent backticks remain part of the documentation example.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"This nested example entry formats a source location and describes an existing delay. It contains no shell invocation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"The example formats a dialog reference and global flag name. Neither is evaluated as code in this Markdown document.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","reason":"PaymentProvider is an inline-formatted interface name in an architectural recommendation. The text does not run payment operations or shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"Backticks format hypothetical checkout and payment-module references. This documents a dependency problem rather than executing either file.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The refund reference and conditional are illustrative inline code in a Markdown list. They do not represent shell substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"This decision-log entry formats example toolbar and menu references. It describes shared action checks without executing commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"The backticks format an illustrative keymap location. The surrounding text describes a structural problem rather than an executable shell statement.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"The source reference belongs to a hypothetical command-palette problem in the decision log. Markdown backticks do not execute the reference.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","reason":"The formatted undo-module location illustrates a special-case problem. There is no shell or Ruby code in this entry.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"The backticks highlight track() within an example of inconsistent instrumentation. They do not execute the function or an external command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"The example formats two test-file references to illustrate duplicated action tests. No executable command is present.","verdict":"false_positive","confidence":1}],"semantic_findings":[{"title":"Skeleton Generation Lacks Source Preservation Safeguard","severity":"medium","locations":[{"file":"SKILL.md","line_end":102,"line_start":102}],"confidence":0.86,"description":"The tip says \"script away the function bodies\" without requiring a separate analysis copy. Applying this directly could erase implementation and uncommitted work.","confidence_reasoning":"The instruction explicitly proposes removing function bodies but provides no output-location or preservation constraint. Data loss depends on the implementing agent modifying originals."}],"subject_marketplace_commit_sha":"c993c6abcbffafea2683d7748b53b3dfaf438415","subject_content_hash":"b4eb6b5130c38ca04532601e99d2d174cf4faa4df520b5b7ba609e8707e55761","subject_tree_hash":"595992cacab8fbed504076fdcbcc5b95c61a17000ff93aa5341cd8bc83793a49","subject_plugin_path":"skills/caldoai/untangle-codebase","audit_payload_hash":"97ddb24fe4b03d2f99b0da5c3a7b8ab2","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"c993c6abcbffafea2683d7748b53b3dfaf438415","contentHash":"b4eb6b5130c38ca04532601e99d2d174cf4faa4df520b5b7ba609e8707e55761","treeHash":"595992cacab8fbed504076fdcbcc5b95c61a17000ff93aa5341cd8bc83793a49","pluginPath":"skills/caldoai/untangle-codebase","auditPayloadHash":"97ddb24fe4b03d2f99b0da5c3a7b8ab2"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/caldoai-untangle-codebase/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}