{"data":{"skill":{"slug":"claude-office-skills-html-slides","name":"html-slides","icon":"📦","repo":"https://github.com/claude-office-skills/skills/tree/9c4c7d5cd2813a8936bf2c9fdb174ea883b85a11/html-slides","status":"approved","author":"claude-office-skills","authorVersion":"1.0","skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"a046c9c3-27f8-4436-bd1d-b631a41c8de6","skill_id":"4c63aaf6-18b2-4eed-826e-3e4fd8e804f7","version":1,"content_hash":"v3:c993c6abcbffafea2683d7748b53b3dfaf438415:7db21c8c406d481ee8a9d3bdcf29408e76f934a5d79b799261d4acf1e1a9d3de:26912038f1989bf9eb85fbfac2e3cf9093689ddc88f6e33c5e8f231808084fa3:736b696c6c732f636c617564652d6f66666963652d736b696c6c732f68746d6c2d736c69646573:1efaf5e0fb625329ee9e68cc8605e549","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The 23 shell-execution matches are Markdown formatting, and three resource links are benign references. Eleven CDN asset references present low-severity supply-chain exposure through mutable version aliases without integrity checks. No evidence found of prompt injection, credential access, or intentional data exfiltration.","remediation":[{"issue":"CDN examples use mutable reveal.js@4 URLs without integrity checks for scripts and stylesheets.","severity":"low","suggestion":"Pin an exact release and add verified integrity hashes with crossorigin attributes, or distribute reviewed assets locally."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":89,"line_start":71},{"file":"SKILL.md","line_end":93,"line_start":89},{"file":"SKILL.md","line_end":112,"line_start":93},{"file":"SKILL.md","line_end":116,"line_start":112},{"file":"SKILL.md","line_end":116,"line_start":116},{"file":"SKILL.md","line_end":120,"line_start":118},{"file":"SKILL.md","line_end":124,"line_start":120},{"file":"SKILL.md","line_end":130,"line_start":124},{"file":"SKILL.md","line_end":134,"line_start":130},{"file":"SKILL.md","line_end":141,"line_start":134},{"file":"SKILL.md","line_end":143,"line_start":141},{"file":"SKILL.md","line_end":143,"line_start":143},{"file":"SKILL.md","line_end":156,"line_start":147},{"file":"SKILL.md","line_end":160,"line_start":156},{"file":"SKILL.md","line_end":168,"line_start":160},{"file":"SKILL.md","line_end":172,"line_start":168},{"file":"SKILL.md","line_end":184,"line_start":172},{"file":"SKILL.md","line_end":188,"line_start":184},{"file":"SKILL.md","line_end":222,"line_start":188},{"file":"SKILL.md","line_end":227,"line_start":222},{"file":"SKILL.md","line_end":289,"line_start":227},{"file":"SKILL.md","line_end":292,"line_start":289},{"file":"SKILL.md","line_end":337,"line_start":292}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":75,"line_start":75},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":233,"line_start":233},{"file":"SKILL.md","line_end":234,"line_start":234},{"file":"SKILL.md","line_end":235,"line_start":235},{"file":"SKILL.md","line_end":279,"line_start":279},{"file":"SKILL.md","line_end":280,"line_start":280},{"file":"SKILL.md","line_end":297,"line_start":297},{"file":"SKILL.md","line_end":298,"line_start":298},{"file":"SKILL.md","line_end":333,"line_start":333},{"file":"SKILL.md","line_end":341,"line_start":341},{"file":"SKILL.md","line_end":342,"line_start":342},{"file":"SKILL.md","line_end":343,"line_start":343}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":75,"line_start":75}],"confidence":0.95,"description":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/reveal.css\">","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The core stylesheet loads from a mutable reveal.js@4 CDN URL without integrity verification. A compromised dependency could alter presentation appearance or introduce tracking."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":76,"line_start":76}],"confidence":0.95,"description":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/theme/black.css\">","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The black theme loads external CSS through a mutable major-version alias without integrity verification. Dependency compromise could alter displayed content or introduce tracking."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":85,"line_start":85}],"confidence":0.98,"description":"<script src=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/reveal.js\"></script>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The browser executes CDN JavaScript from a mutable reveal.js@4 alias without integrity verification. Compromised upstream code could access presentation content."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":233,"line_start":233}],"confidence":0.95,"description":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/reveal.css\">","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The tech talk example imports core CSS from a mutable CDN alias without integrity verification. Dependency compromise could modify presentation appearance or introduce tracking."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":234,"line_start":234}],"confidence":0.95,"description":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/theme/night.css\">","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The night theme uses a mutable reveal.js@4 CDN alias without integrity verification. A compromised stylesheet could modify displayed content or introduce tracking."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":235,"line_start":235}],"confidence":0.95,"description":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/plugin/highlight/monokai.css\">","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The highlighting stylesheet loads from a mutable CDN alias without integrity verification. Dependency compromise could change code presentation or introduce tracking."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":279,"line_start":279}],"confidence":0.98,"description":"<script src=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/reveal.js\"></script>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The tech talk executes reveal.js from a mutable CDN alias without integrity verification. Upstream compromise could execute malicious code within the presentation."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":280,"line_start":280}],"confidence":0.98,"description":"<script src=\"https://cdn.jsdelivr.net/npm/reveal.js@4/plugin/highlight/highlight.js\"></script>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The highlighting plugin executes external JavaScript through a mutable major-version alias without integrity verification. Compromised upstream code could access slide content."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":297,"line_start":297}],"confidence":0.95,"description":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/reveal.css\">","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The product launch example loads core CSS from a mutable CDN alias without integrity verification. Dependency compromise could alter presentation appearance or introduce tracking."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":298,"line_start":298}],"confidence":0.95,"description":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/theme/white.css\">","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The white theme loads external CSS from a mutable major-version alias without integrity verification. Compromised styles could modify presentation content or introduce tracking."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":333,"line_start":333}],"confidence":0.98,"description":"<script src=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/reveal.js\"></script>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The product launch deck executes CDN JavaScript without an exact version or integrity verification. An upstream compromise could expose presentation content."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":344,"audit_model":"codex","audited_at":"2026-11-07T14:36:30.625+00:00","created_at":"2026-11-09T15:33:21.894579+00:00","static_findings":[{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":89,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":93,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":112,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":116,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Built-in themes: `black`, `white`, `league`, `beige`, `sky`, `night`, `serif`, `simple`, `solarized`","category":"external_commands","line_end":116,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":120,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":124,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":130,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":134,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":141,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":143,"severity":"medium","line_start":141},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Fragment styles: `fade-in`, `fade-out`, `fade-up`, `fade-down`, `fade-left`, `fade-right`, `highligh","category":"external_commands","line_end":143,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":156,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":160,"severity":"medium","line_start":156},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":168,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":172,"severity":"medium","line_start":168},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":184,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":188,"severity":"medium","line_start":184},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":222,"severity":"medium","line_start":188},{"id":"external_commands:SKILL.md:222:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":227,"severity":"medium","line_start":222},{"id":"external_commands:SKILL.md:227:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":289,"severity":"medium","line_start":227},{"id":"external_commands:SKILL.md:289:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":292,"severity":"medium","line_start":289},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```html","category":"external_commands","line_end":337,"severity":"medium","line_start":292},{"id":"network:SKILL.md:75:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/reveal.css\">","category":"network","line_end":75,"severity":"low","line_start":75},{"id":"network:SKILL.md:76:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/theme/black.css\">","category":"network","line_end":76,"severity":"low","line_start":76},{"id":"network:SKILL.md:85:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<script src=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/reveal.js\"></script>","category":"network","line_end":85,"severity":"low","line_start":85},{"id":"network:SKILL.md:233:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/reveal.css\">","category":"network","line_end":233,"severity":"low","line_start":233},{"id":"network:SKILL.md:234:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/theme/night.css\">","category":"network","line_end":234,"severity":"low","line_start":234},{"id":"network:SKILL.md:235:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/plugin/highlight/monokai.css\">","category":"network","line_end":235,"severity":"low","line_start":235},{"id":"network:SKILL.md:279:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<script src=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/reveal.js\"></script>","category":"network","line_end":279,"severity":"low","line_start":279},{"id":"network:SKILL.md:280:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<script src=\"https://cdn.jsdelivr.net/npm/reveal.js@4/plugin/highlight/highlight.js\"></script>","category":"network","line_end":280,"severity":"low","line_start":280},{"id":"network:SKILL.md:297:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/reveal.css\">","category":"network","line_end":297,"severity":"low","line_start":297},{"id":"network:SKILL.md:298:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/theme/white.css\">","category":"network","line_end":298,"severity":"low","line_start":298},{"id":"network:SKILL.md:333:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"<script src=\"https://cdn.jsdelivr.net/npm/reveal.js@4/dist/reveal.js\"></script>","category":"network","line_end":333,"severity":"low","line_start":333},{"id":"network:SKILL.md:341:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [reveal.js Documentation](https://revealjs.com/)","category":"network","line_end":341,"severity":"low","line_start":341},{"id":"network:SKILL.md:342:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [GitHub Repository](https://github.com/hakimel/reveal.js)","category":"network","line_end":342,"severity":"low","line_start":342},{"id":"network:SKILL.md:343:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Demo Slides](https://revealjs.com/demo/)","category":"network","line_end":343,"severity":"low","line_start":343}],"finding_verdicts":[{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The backticks delimit a Markdown HTML example, not a shell command. The enclosed code builds a reveal.js page.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"This is the closing Markdown fence for the basic HTML example. The following text introduces slide structure, not command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"The backticks open an HTML code fence demonstrating horizontal, vertical, and Markdown slides. There is no shell invocation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"This closes a Markdown code block before the themes section. The backticks are document formatting, not executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"Inline backticks format reveal.js theme names such as black and white. No interpreter evaluates these names as commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"The Markdown fence contains an HTML stylesheet link to a local theme. No shell command or backtick evaluation occurs.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"These backticks close the theme example before the transitions section. They do not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The fence encloses JavaScript configuring reveal.js transitions. Browser configuration is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"This closes the JavaScript transition example before the fragment section. The matched syntax is a Markdown delimiter.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The fenced HTML demonstrates animated paragraph classes. The backticks are presentation markup delimiters, not command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"This closes the fragment example and precedes inline fragment class names. Neither use executes shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"Inline backticks format fragment CSS class names. They are documentation text, with no shell evaluation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The HTML fence contains a displayed Python code sample for syntax highlighting. It does not instruct a shell to execute that sample.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","reason":"This is a closing Markdown fence before the speaker notes section. No external command is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"The fenced HTML adds a notes aside to a slide. The Markdown backticks do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","reason":"This closes the speaker notes example before the backgrounds section. It is document formatting, not executable syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"The HTML fence demonstrates background attributes for colors, images, video, and gradients. It contains no shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","reason":"These backticks close the background example before configuration documentation. No command substitution occurs.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","reason":"The fenced JavaScript sets reveal.js navigation, timing, appearance, and plugin options. It does not launch external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:222:ruby-shell-backtick-execution","reason":"This is the closing configuration fence before the examples section. Markdown delimiters are not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:227:ruby-shell-backtick-execution","reason":"The fence opens a complete HTML tech talk example. HTTP methods inside its code block are displayed slide content, not executed commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:289:ruby-shell-backtick-execution","reason":"The backticks close the tech talk example and precede the product launch example. There is no shell interpreter.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","reason":"The fenced block is an HTML product launch deck with styles and reveal.js initialization. Markdown fences do not run shell commands.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:75:hardcoded-url","reason":"The core stylesheet loads from a mutable reveal.js@4 CDN URL without integrity verification. A compromised dependency could alter presentation appearance or introduce tracking.","verdict":"confirmed","severity":"low","confidence":0.95},{"id":"network:SKILL.md:76:hardcoded-url","reason":"The black theme loads external CSS through a mutable major-version alias without integrity verification. Dependency compromise could alter displayed content or introduce tracking.","verdict":"confirmed","severity":"low","confidence":0.95},{"id":"network:SKILL.md:85:hardcoded-url","reason":"The browser executes CDN JavaScript from a mutable reveal.js@4 alias without integrity verification. Compromised upstream code could access presentation content.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:SKILL.md:233:hardcoded-url","reason":"The tech talk example imports core CSS from a mutable CDN alias without integrity verification. Dependency compromise could modify presentation appearance or introduce tracking.","verdict":"confirmed","severity":"low","confidence":0.95},{"id":"network:SKILL.md:234:hardcoded-url","reason":"The night theme uses a mutable reveal.js@4 CDN alias without integrity verification. A compromised stylesheet could modify displayed content or introduce tracking.","verdict":"confirmed","severity":"low","confidence":0.95},{"id":"network:SKILL.md:235:hardcoded-url","reason":"The highlighting stylesheet loads from a mutable CDN alias without integrity verification. Dependency compromise could change code presentation or introduce tracking.","verdict":"confirmed","severity":"low","confidence":0.95},{"id":"network:SKILL.md:279:hardcoded-url","reason":"The tech talk executes reveal.js from a mutable CDN alias without integrity verification. Upstream compromise could execute malicious code within the presentation.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:SKILL.md:280:hardcoded-url","reason":"The highlighting plugin executes external JavaScript through a mutable major-version alias without integrity verification. Compromised upstream code could access slide content.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:SKILL.md:297:hardcoded-url","reason":"The product launch example loads core CSS from a mutable CDN alias without integrity verification. Dependency compromise could alter presentation appearance or introduce tracking.","verdict":"confirmed","severity":"low","confidence":0.95},{"id":"network:SKILL.md:298:hardcoded-url","reason":"The white theme loads external CSS from a mutable major-version alias without integrity verification. Compromised styles could modify presentation content or introduce tracking.","verdict":"confirmed","severity":"low","confidence":0.95},{"id":"network:SKILL.md:333:hardcoded-url","reason":"The product launch deck executes CDN JavaScript without an exact version or integrity verification. An upstream compromise could expose presentation content.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:SKILL.md:341:hardcoded-url","reason":"This is a Markdown link to official reveal.js documentation. It neither executes code nor instructs automated transmission of user data.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:342:hardcoded-url","reason":"This is a reference link to the reveal.js GitHub repository. It contains no upload operation or automatic code execution.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:343:hardcoded-url","reason":"This is an optional link to the official demonstration slides. No sensitive payload or automated request is specified.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"c993c6abcbffafea2683d7748b53b3dfaf438415","subject_content_hash":"7db21c8c406d481ee8a9d3bdcf29408e76f934a5d79b799261d4acf1e1a9d3de","subject_tree_hash":"26912038f1989bf9eb85fbfac2e3cf9093689ddc88f6e33c5e8f231808084fa3","subject_plugin_path":"skills/claude-office-skills/html-slides","audit_payload_hash":"1efaf5e0fb625329ee9e68cc8605e549","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"c993c6abcbffafea2683d7748b53b3dfaf438415","contentHash":"7db21c8c406d481ee8a9d3bdcf29408e76f934a5d79b799261d4acf1e1a9d3de","treeHash":"26912038f1989bf9eb85fbfac2e3cf9093689ddc88f6e33c5e8f231808084fa3","pluginPath":"skills/claude-office-skills/html-slides","auditPayloadHash":"1efaf5e0fb625329ee9e68cc8605e549"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/claude-office-skills-html-slides/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":11,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}