{"data":{"skill":{"slug":"cloudai-x-designing-apis","name":"designing-apis","icon":"📦","repo":"https://github.com/CloudAI-X/claude-workflow/tree/main/skills/designing-apis","status":"approved","author":"CloudAI-X","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"7dd5888f-3d78-4a13-b1ea-88c3854cff91","skill_id":"e3fad88f-8a24-4870-bca5-61776183c3d9","version":6,"content_hash":"d7e35705f0fea02d52697b836ab9ef60","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported many high-risk patterns, but review found they are markdown code fences, REST method examples, OpenAPI references, and authentication documentation. No prompt injection, credential access, data exfiltration, or executable malware behavior was found. The remaining concern is optional guidance to run external npx validation tools, which creates a moderate supply-chain risk if users execute it without pinning or review.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"OPENAPI-TEMPLATE.md","line_end":171,"line_start":164}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"External CLI Validation Commands","locations":[{"file":"OPENAPI-TEMPLATE.md","line_end":171,"line_start":164}],"confidence":0.72,"description":"The OpenAPI template recommends running npx-based validation and linting commands. This is legitimate API documentation, but executing external CLI packages can run third-party code and should be reviewed or pinned before use.","confidence_reasoning":"The commands are clearly present in a documentation section and are not hidden or automatically executed. Risk remains because npx can fetch and execute external packages when a user follows the instructions."}],"low_findings":[{"title":"Markdown Code Fences Misclassified as Shell Backticks","locations":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":97,"line_start":97},{"file":"SKILL.md","line_end":113,"line_start":113},{"file":"SKILL.md","line_end":118,"line_start":118},{"file":"SKILL.md","line_end":121,"line_start":121},{"file":"SKILL.md","line_end":124,"line_start":124},{"file":"SKILL.md","line_end":126,"line_start":126},{"file":"SKILL.md","line_end":131,"line_start":131},{"file":"SKILL.md","line_end":133,"line_start":133},{"file":"SKILL.md","line_end":136,"line_start":136},{"file":"SKILL.md","line_end":138,"line_start":138},{"file":"SKILL.md","line_end":141,"line_start":141},{"file":"SKILL.md","line_end":146,"line_start":146},{"file":"SKILL.md","line_end":151,"line_start":151},{"file":"SKILL.md","line_end":178,"line_start":178},{"file":"SKILL.md","line_end":188,"line_start":188},{"file":"OPENAPI-TEMPLATE.md","line_end":5,"line_start":5},{"file":"OPENAPI-TEMPLATE.md","line_end":160,"line_start":160},{"file":"OPENAPI-TEMPLATE.md","line_end":166,"line_start":166}],"confidence":0.97,"description":"The Ruby backtick findings point to markdown fenced examples, not Ruby code or automatic shell execution. The content is instructional text for API design and OpenAPI templates.","confidence_reasoning":"The flagged syntax appears inside markdown fences and surrounding text describes examples. There is no Ruby source file, interpreter call, or automatic execution path."},{"title":"Weak Cryptography Detections Are Documentation False Positives","locations":[{"file":"SKILL.md","line_end":2,"line_start":2},{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":6,"line_start":6},{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":150,"line_start":150},{"file":"SKILL.md","line_end":184,"line_start":184},{"file":"SKILL.md","line_end":186,"line_start":186},{"file":"SKILL.md","line_end":200,"line_start":200},{"file":"OPENAPI-TEMPLATE.md","line_end":10,"line_start":10},{"file":"OPENAPI-TEMPLATE.md","line_end":27,"line_start":27},{"file":"OPENAPI-TEMPLATE.md","line_end":42,"line_start":42},{"file":"OPENAPI-TEMPLATE.md","line_end":48,"line_start":48},{"file":"OPENAPI-TEMPLATE.md","line_end":65,"line_start":65},{"file":"OPENAPI-TEMPLATE.md","line_end":71,"line_start":71},{"file":"OPENAPI-TEMPLATE.md","line_end":156,"line_start":148}],"confidence":0.94,"description":"The weak cryptography alerts map to API terminology, JWT bearer examples, and API key documentation. No code performs cryptography, stores secrets, or selects an insecure algorithm.","confidence_reasoning":"The reviewed lines are explanatory authentication examples in markdown. I found no cryptographic implementation or operational use of a weak algorithm."},{"title":"Example API URL Is Not Network Exfiltration","locations":[{"file":"OPENAPI-TEMPLATE.md","line_end":13,"line_start":12}],"confidence":0.96,"description":"The hardcoded URL is an example server value in an OpenAPI template. The skill does not make network requests or send data to that URL.","confidence_reasoning":"The URL uses the reserved example.com domain in a YAML documentation example. No executable network client or data transfer logic is present."},{"title":"System Reconnaissance Detections Are HTTP Examples","locations":[{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":101,"line_start":101},{"file":"SKILL.md","line_end":105,"line_start":105},{"file":"SKILL.md","line_end":197,"line_start":197},{"file":"OPENAPI-TEMPLATE.md","line_end":58,"line_start":58},{"file":"OPENAPI-TEMPLATE.md","line_end":90,"line_start":90}],"confidence":0.93,"description":"The reconnaissance findings align with REST endpoint examples and response metadata, not commands that inspect a host or environment. No evidence found of system inventory or local information gathering.","confidence_reasoning":"The reviewed content consists of REST routes, HTTP methods, and API design checklist items. I found no system commands, host probes, or filesystem enumeration."}],"dangerous_patterns":[{"title":"npx Package Execution Guidance","locations":[{"file":"OPENAPI-TEMPLATE.md","line_end":171,"line_start":166}],"confidence":0.72,"description":"The template includes commands that may execute third-party packages for OpenAPI validation. Users should prefer pinned versions or trusted local tooling.","confidence_reasoning":"The command pattern is real, but it appears as transparent documentation rather than hidden execution. The risk depends on whether a user runs the commands and how packages are resolved."}],"files_scanned":2,"total_lines":385,"audit_model":"codex","audited_at":"2026-06-28T23:12:43.081+00:00","created_at":"2026-06-29T00:44:05.500783+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"low","confirmedFindingCount":2,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":2,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}