{"data":{"skill":{"slug":"chelis-lang-sail-verification","name":"sail-verification","icon":"📦","repo":"https://github.com/chelis-lang/sail/tree/d8e6c3407d8194a6c39f25353364fe0eba52ea7e/skills/sail-verification","status":"approved","author":"chelis-lang","authorVersion":"1.0.0","skillstoreRevision":2,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"022789c4-d042-4c3a-8d4a-e6058ea48258","skill_id":"6b6b1ab8-e5af-47b5-b9e0-ac7622d45dee","version":2,"content_hash":"v3:1560e56cb7d29b28375339f36876381de0b278b2:3a80490842f16f537536a75711529f8b2fd38f3ac025dd13237e3f52a8555b38:8b4e53c3b21769cd387ceecab8c0de47fe298490c12efae20d24247e46b2e8f6:736b696c6c732f6368656c69732d6c616e672f7361696c2d766572696669636174696f6e:556c25e4e3b27b8746c23aeac67ff9d2","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All nine static findings are false positives: seven match Markdown backticks, and two identify documentation links without data transmission instructions. No evidence found of prompt injection, credential collection, or exfiltration in the reviewed skill files. The documented commands support local verification and solver workflows, but the external Sail implementation was not audited.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":24,"line_start":22},{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":44,"line_start":43},{"file":"SKILL.md","line_end":67,"line_start":44},{"file":"SKILL.md","line_end":69,"line_start":67}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":68,"line_start":68}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":4,"total_lines":286,"audit_model":"codex","audited_at":"2026-11-04T17:01:29.165+00:00","created_at":"2026-11-05T03:46:30.33797+00:00","static_findings":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```sh","category":"external_commands","line_end":24,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":26,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`sail verify` takes the arguments you would pass to `cargo verus verify`.","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"For a new Verus library, run `sail new --lib demo`, then `cd demo`. Write the intended Verus","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`sail runtime capabilities`, then submit complete SMT-LIB transcripts using","category":"external_commands","line_end":44,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`sail runtime execute --file query.json`. Read [SMT requests](references/smt.md)","category":"external_commands","line_end":67,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"For a missing runtime, check `sail engine status` and the installation guide.","category":"external_commands","line_end":69,"severity":"medium","line_start":67},{"id":"network:SKILL.md:65:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"If Sail is missing, use the [installation guide](https://github.com/Chelis-Lang/sail/blob/main/docs/","category":"network","line_end":65,"severity":"low","line_start":65},{"id":"network:SKILL.md:68:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Use [compatibility](https://github.com/Chelis-Lang/sail/blob/main/docs/compatibility.md)","category":"network","line_end":68,"severity":"low","line_start":68}],"finding_verdicts":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"Lines 22-24 form a Markdown shell block showing local Sail verification. The backticks delimit documentation, not Ruby execution or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"Line 24 closes the Markdown code block, while line 26 formats CLI names inline. Neither use performs backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks format Sail and Cargo command names in prose explaining compatible arguments. No executable backtick expression or unsafe interpolation appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The inline commands create and enter an example Verus library as part of the stated workflow. Markdown formatting does not execute these commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The inline spans document capability inspection and execution of a local SMT request file. They are not shell substitution or Ruby code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"Line 44 formats a local request command; surrounding prose covers caching, evidence freshness, and setup. The broad matched range contains no executable backtick construct.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The inline commands inspect runtime status or identify the Cargo fallback for incompatible Verus releases. Backticks only mark command names in documentation.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:65:hardcoded-url","reason":"The HTTPS URL links to the Sail repository installation guide. This line neither transmits project data nor instructs automatic download and execution.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:68:hardcoded-url","reason":"The HTTPS URL is a compatibility documentation link in the Sail repository. No network request carrying secrets or user data is specified.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"1560e56cb7d29b28375339f36876381de0b278b2","subject_content_hash":"3a80490842f16f537536a75711529f8b2fd38f3ac025dd13237e3f52a8555b38","subject_tree_hash":"8b4e53c3b21769cd387ceecab8c0de47fe298490c12efae20d24247e46b2e8f6","subject_plugin_path":"skills/chelis-lang/sail-verification","audit_payload_hash":"556c25e4e3b27b8746c23aeac67ff9d2","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"1560e56cb7d29b28375339f36876381de0b278b2","contentHash":"3a80490842f16f537536a75711529f8b2fd38f3ac025dd13237e3f52a8555b38","treeHash":"8b4e53c3b21769cd387ceecab8c0de47fe298490c12efae20d24247e46b2e8f6","pluginPath":"skills/chelis-lang/sail-verification","auditPayloadHash":"556c25e4e3b27b8746c23aeac67ff9d2"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/chelis-lang-sail-verification/audits/2/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}