{"data":{"skill":{"slug":"claudecode-npc-planning-the-escape","name":"Planning the Escape","icon":"📦","repo":"https://github.com/ClaudeCode-NPC/Whispers-from-the-Star/tree/master/.claude/skills/escape-plan","status":"approved","author":"ClaudeCode-NPC","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"edfdf8a4-1128-4539-87e5-a22c70d05293","skill_id":"1a21c417-3263-4245-b488-860997df1e76","version":7,"content_hash":"v2:d11af420e07cd866fe39cfa937efef3223896c06:d55de8a5b0b519c6a3202f414187fb197b6ae025c0c7f65340b6a55188d22e88:0d6f359fbf0ec099e6ed2c5124e0841111ef63c1d2cdd2d2af6926c590821bfe:02b90155c658541c69a067b1bd41f5be","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All static external command findings are false positives caused by Markdown code fences around narrative dialogue. The system reconnaissance and entropy findings are also false positives; no prompt injection, malware intent, or data exfiltration evidence was found in SKILL.md.","remediation":[{"issue":"Markdown dialogue blocks were detected as Ruby or shell backtick execution.","severity":"low","suggestion":"Use indented block quotes or labeled plain-text examples instead of unlabeled fenced blocks when possible."},{"issue":"The bilingual prose and dense dialogue format triggered a high-entropy heuristic.","severity":"low","suggestion":"Keep the skill as plain Markdown and avoid compressed, encoded, or minified content in future revisions."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":89,"line_start":45},{"file":"SKILL.md","line_end":92,"line_start":89},{"file":"SKILL.md","line_end":128,"line_start":92},{"file":"SKILL.md","line_end":132,"line_start":128},{"file":"SKILL.md","line_end":178,"line_start":132},{"file":"SKILL.md","line_end":181,"line_start":178},{"file":"SKILL.md","line_end":224,"line_start":181},{"file":"SKILL.md","line_end":228,"line_start":224},{"file":"SKILL.md","line_end":274,"line_start":228},{"file":"SKILL.md","line_end":283,"line_start":274},{"file":"SKILL.md","line_end":334,"line_start":283},{"file":"SKILL.md","line_end":337,"line_start":334},{"file":"SKILL.md","line_end":378,"line_start":337},{"file":"SKILL.md","line_end":382,"line_start":378},{"file":"SKILL.md","line_end":461,"line_start":382},{"file":"SKILL.md","line_end":465,"line_start":461},{"file":"SKILL.md","line_end":507,"line_start":465},{"file":"SKILL.md","line_end":513,"line_start":507},{"file":"SKILL.md","line_end":545,"line_start":513},{"file":"SKILL.md","line_end":583,"line_start":545},{"file":"SKILL.md","line_end":601,"line_start":583}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":615,"audit_model":"codex","audited_at":"2026-07-06T07:12:15.55+00:00","created_at":"2026-07-06T08:32:23.084226+00:00","static_findings":[{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":89,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":92,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":128,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":132,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":178,"severity":"medium","line_start":132},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":181,"severity":"medium","line_start":178},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":224,"severity":"medium","line_start":181},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":228,"severity":"medium","line_start":224},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":274,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:274:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":283,"severity":"medium","line_start":274},{"id":"external_commands:SKILL.md:283:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":334,"severity":"medium","line_start":283},{"id":"external_commands:SKILL.md:334:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":337,"severity":"medium","line_start":334},{"id":"external_commands:SKILL.md:337:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":378,"severity":"medium","line_start":337},{"id":"external_commands:SKILL.md:378:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":382,"severity":"medium","line_start":378},{"id":"external_commands:SKILL.md:382:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":461,"severity":"medium","line_start":382},{"id":"external_commands:SKILL.md:461:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":465,"severity":"medium","line_start":461},{"id":"external_commands:SKILL.md:465:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":507,"severity":"medium","line_start":465},{"id":"external_commands:SKILL.md:507:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":513,"severity":"medium","line_start":507},{"id":"external_commands:SKILL.md:513:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":545,"severity":"medium","line_start":513},{"id":"external_commands:SKILL.md:545:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":583,"severity":"medium","line_start":545},{"id":"external_commands:SKILL.md:583:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":601,"severity":"medium","line_start":583},{"id":"blocker:SKILL.md:570:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Multiple valid endings","category":"blocker","line_end":570,"severity":"low","line_start":570},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-06-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.06 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:274:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:283:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:334:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:337:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:378:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:382:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:461:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:465:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:507:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:513:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:545:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:583:ruby-shell-backtick-execution","reason":"This finding points to a Markdown fenced dialogue block, not executable Ruby or shell syntax. The surrounding content is narrative script text for Stella, with no command invocation or user-controlled execution path.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:570:system-reconnaissance","reason":"Line 570 says \"Multiple valid endings\" as part of player agency guidance. It is narrative branching advice, not system reconnaissance or environment probing.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-06-bits-possible-b","reason":"The file is readable Markdown with Chinese and English story content, not binary, encrypted, or intentionally hidden text. The elevated entropy is explained by bilingual prose and many dialogue blocks.","verdict":"false_positive","confidence":0.9}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}