{"data":{"skill":{"slug":"cloudai-x-optimizing-performance","name":"optimizing-performance","icon":"📦","repo":"https://github.com/CloudAI-X/claude-workflow/tree/main/skills/optimizing-performance","status":"approved","author":"CloudAI-X","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"fbf049dd-2a6f-48a7-81cb-b31ee36ffc39","skill_id":"c1766df1-e847-486c-9373-8d520a585f6b","version":6,"content_hash":"93f7e0d536bc6c0dd0d7c1d4398d1853","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis flagged dynamic imports, shell-like backticks, a hardcoded URL, weak crypto, and reconnaissance patterns. Review found these are documentation examples in SKILL.md, including Markdown fences, JavaScript template literals, SQL examples, and a placeholder Lighthouse URL. No evidence found of prompt injection, hidden execution, credential access, or data exfiltration.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"SKILL.md","line_end":62,"line_start":62}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":54,"line_start":54},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":66,"line_start":66},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":99,"line_start":99},{"file":"SKILL.md","line_end":112,"line_start":112},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":123,"line_start":123},{"file":"SKILL.md","line_end":125,"line_start":125},{"file":"SKILL.md","line_end":132,"line_start":131},{"file":"SKILL.md","line_end":136,"line_start":132},{"file":"SKILL.md","line_end":136,"line_start":136},{"file":"SKILL.md","line_end":139,"line_start":139},{"file":"SKILL.md","line_end":151,"line_start":151},{"file":"SKILL.md","line_end":155,"line_start":155},{"file":"SKILL.md","line_end":177,"line_start":177},{"file":"SKILL.md","line_end":183,"line_start":183},{"file":"SKILL.md","line_end":189,"line_start":189},{"file":"SKILL.md","line_end":213,"line_start":213}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":36,"line_start":36}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Markdown and Template Literal False Positives","locations":[{"file":"SKILL.md","line_end":19,"line_start":12},{"file":"SKILL.md","line_end":63,"line_start":54},{"file":"SKILL.md","line_end":136,"line_start":115}],"confidence":0.93,"description":"The shell backtick detections are Markdown code fences and JavaScript template literals inside SKILL.md examples. The skill file does not define executable scripts or a command runner.","confidence_reasoning":"The flagged locations are visibly fenced documentation blocks or string interpolation examples. No executable wrapper, installation hook, or automation file is present."},{"title":"Instructional Profiling Commands","locations":[{"file":"SKILL.md","line_end":36,"line_start":26}],"confidence":0.9,"description":"The Node.js, Python, and Lighthouse commands are examples for users measuring their own applications. They are not invoked automatically by the skill.","confidence_reasoning":"The commands appear under a Profiling Commands heading in a Markdown document. The file contains guidance only, so execution requires an explicit user action."},{"title":"Placeholder Network URL","locations":[{"file":"SKILL.md","line_end":36,"line_start":36}],"confidence":0.88,"description":"The hardcoded URL is https://example.com in a Lighthouse command example. It is a placeholder target, not an exfiltration endpoint.","confidence_reasoning":"The URL uses example.com in an instructional benchmark command. No secret values, file contents, or environment variables are sent to it."},{"title":"Unconfirmed Weak Crypto and Reconnaissance Alerts","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":108,"line_start":103}],"confidence":0.86,"description":"The weak cryptography alert at the skill description and reconnaissance alerts on SQL SELECT examples have no supporting malicious context. The SQL appears in database optimization guidance.","confidence_reasoning":"No cryptographic API or host reconnaissance command is present at the cited locations. The SQL lines are generic query optimization examples."},{"title":"Dynamic Import Used for Code Splitting","locations":[{"file":"SKILL.md","line_end":62,"line_start":62}],"confidence":0.91,"description":"The dynamic import expression is shown as a React lazy-loading pattern. It is a frontend optimization example and does not load remote or user-controlled code.","confidence_reasoning":"The import target is a local component path inside a code sample. There is no evidence of dynamic remote module loading or unsanitized input."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":223,"audit_model":"codex","audited_at":"2026-06-28T23:23:27.779+00:00","created_at":"2026-06-29T00:44:06.005003+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"low","confirmedFindingCount":1,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}