{"data":{"skill":{"slug":"codewithmukesh-container-publish","name":"container-publish","icon":"📦","repo":"https://github.com/codewithmukesh/dotnet-claude-kit/tree/23300897f4d1a276bc475e373ecfe886e43dd7c5/skills/container-publish","status":"approved","author":"codewithmukesh","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"98335ee9-1d2c-41ff-96b0-8d3769026a08","skill_id":"056dac73-ab6a-4879-9e28-efe90870e85a","version":1,"content_hash":"v3:f7b161679d1208226f24d167acf8573bb901d0ee:4fafdfeda7602eea8bde5c0394bd094a8317b36c26054cfc4925fa8d11895c62:ae249560ef9f7719d22999c056318c6d7699032ca0cd4dd34e67adc4edcb1cb1:736b696c6c732f636f6465776974686d756b6573682f636f6e7461696e65722d7075626c697368:f7c3e681476e3f445b323c15f267ed10","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 48 static findings are false positives: 47 match Markdown backticks, and one references a GitHub Actions token for registry authentication. Commands and credentials support the documented container publishing workflow. No evidence found of prompt injection, credential exfiltration, or malicious execution.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":30,"line_start":28},{"file":"SKILL.md","line_end":32,"line_start":30},{"file":"SKILL.md","line_end":36,"line_start":32},{"file":"SKILL.md","line_end":53,"line_start":36},{"file":"SKILL.md","line_end":57,"line_start":53},{"file":"SKILL.md","line_end":59,"line_start":57},{"file":"SKILL.md","line_end":75,"line_start":59},{"file":"SKILL.md","line_end":81,"line_start":75},{"file":"SKILL.md","line_end":86,"line_start":81},{"file":"SKILL.md","line_end":88,"line_start":86},{"file":"SKILL.md","line_end":90,"line_start":88},{"file":"SKILL.md","line_end":96,"line_start":90},{"file":"SKILL.md","line_end":100,"line_start":96},{"file":"SKILL.md","line_end":104,"line_start":100},{"file":"SKILL.md","line_end":106,"line_start":104},{"file":"SKILL.md","line_end":112,"line_start":106},{"file":"SKILL.md","line_end":118,"line_start":112},{"file":"SKILL.md","line_end":125,"line_start":118},{"file":"SKILL.md","line_end":126,"line_start":125},{"file":"SKILL.md","line_end":127,"line_start":126},{"file":"SKILL.md","line_end":129,"line_start":127},{"file":"SKILL.md","line_end":135,"line_start":129},{"file":"SKILL.md","line_end":137,"line_start":135},{"file":"SKILL.md","line_end":139,"line_start":137},{"file":"SKILL.md","line_end":142,"line_start":139},{"file":"SKILL.md","line_end":146,"line_start":142},{"file":"SKILL.md","line_end":168,"line_start":146},{"file":"SKILL.md","line_end":174,"line_start":168},{"file":"SKILL.md","line_end":180,"line_start":174},{"file":"SKILL.md","line_end":184,"line_start":180},{"file":"SKILL.md","line_end":190,"line_start":184},{"file":"SKILL.md","line_end":194,"line_start":190},{"file":"SKILL.md","line_end":200,"line_start":194},{"file":"SKILL.md","line_end":204,"line_start":200},{"file":"SKILL.md","line_end":211,"line_start":204},{"file":"SKILL.md","line_end":215,"line_start":211},{"file":"SKILL.md","line_end":221,"line_start":215},{"file":"SKILL.md","line_end":227,"line_start":221},{"file":"SKILL.md","line_end":231,"line_start":227},{"file":"SKILL.md","line_end":232,"line_start":231},{"file":"SKILL.md","line_end":233,"line_start":232},{"file":"SKILL.md","line_end":234,"line_start":233},{"file":"SKILL.md","line_end":235,"line_start":234},{"file":"SKILL.md","line_end":235,"line_start":235}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":161,"line_start":161}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":236,"audit_model":"codex","audited_at":"2026-10-31T14:11:35.452+00:00","created_at":"2026-10-31T15:40:47.849405+00:00","static_findings":[{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **No Dockerfile needed** — The .NET 10 SDK builds OCI-compliant container images directly from `d","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Chiseled images for production** — Use `noble-chiseled` base images: no shell, no package manag","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Non-root by default** — .NET 10 container images run as the `app` user automatically. Never ove","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":30,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":32,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"This creates a container image in your local Docker daemon using the default `aspnet:10.0` base imag","category":"external_commands","line_end":36,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```xml","category":"external_commands","line_end":53,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":57,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Authenticate with `docker login` first, then specify the registry:","category":"external_commands","line_end":59,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":75,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":81,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```xml","category":"external_commands","line_end":86,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":88,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":90,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":96,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":100,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":104,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```xml","category":"external_commands","line_end":106,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":112,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":118,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":125,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `noble-chiseled` | Production (no shell) | No | ~110 MB |","category":"external_commands","line_end":126,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `noble-chiseled-extra` | Production with localization (ICU) | No | ~120 MB |","category":"external_commands","line_end":127,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `alpine` | Small size, has shell | Yes | ~112 MB |","category":"external_commands","line_end":129,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```xml","category":"external_commands","line_end":135,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":137,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"For Native AOT, the SDK auto-selects `chiseled-aot`:","category":"external_commands","line_end":139,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```xml","category":"external_commands","line_end":142,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":146,"severity":"medium","line_start":142},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":168,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":174,"severity":"medium","line_start":168},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```xml","category":"external_commands","line_end":180,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":184,"severity":"medium","line_start":180},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":190,"severity":"medium","line_start":184},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":194,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":200,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":204,"severity":"medium","line_start":200},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":211,"severity":"medium","line_start":204},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":215,"severity":"medium","line_start":211},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```xml","category":"external_commands","line_end":221,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":227,"severity":"medium","line_start":221},{"id":"external_commands:SKILL.md:227:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Standard ASP.NET Core API | SDK container publishing with `noble-chiseled` |","category":"external_commands","line_end":231,"severity":"medium","line_start":227},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| CI without Docker daemon | Tarball output with `ContainerArchiveOutputPath` |","category":"external_commands","line_end":232,"severity":"medium","line_start":231},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Multi-arch deployment (x64 + arm64) | `ContainerRuntimeIdentifiers` property |","category":"external_commands","line_end":233,"severity":"medium","line_start":232},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Production image size | `noble-chiseled` (~110 MB) or Native AOT (~10 MB) |","category":"external_commands","line_end":234,"severity":"medium","line_start":233},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Local development | `dotnet publish /t:PublishContainer --os linux --arch x64` |","category":"external_commands","line_end":235,"severity":"medium","line_start":234},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Registry push | `ContainerRegistry` + `docker login` |","category":"external_commands","line_end":235,"severity":"medium","line_start":235},{"id":"env_access:SKILL.md:161:git-platform-tokens","file":"SKILL.md","pattern":"Git platform tokens","snippet":"password: ${{ secrets.GITHUB_TOKEN }}","category":"env_access","line_end":161,"severity":"high","line_start":161}],"finding_verdicts":[{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"Backticks format the documented dotnet publish command as inline Markdown. They do not perform shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"Backticks mark the noble-chiseled image family in explanatory prose. No executable expression is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"Backticks identify the non-root app user in Markdown. The text discourages running production containers as root.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"This is a Markdown code fence around a standard local container publishing example. No backtick execution or command injection appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The matched characters close a Markdown code block. The adjacent prose describes the expected local image output.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"Inline backticks name the aspnet:10.0 base image, followed by an XML code fence. Neither construct executes a shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The fenced XML configures image metadata, port 8080, and nonsecret runtime settings. It contains no shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"This match spans an XML closing fence and prose about registry authentication. Markdown delimiters are not executable backticks.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The docker login reference is inline Markdown introducing normal registry authentication. It does not capture or redirect credentials.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"Fenced commands authenticate and publish to the named GitHub, Azure, and Docker registries. These are documented publishing operations, not backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The matched text closes the registry example and opens an XML example. Code fences do not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The XML block declares Linux x64 and ARM64 runtime identifiers. No executable backtick expression exists.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The match consists of Markdown fences separating XML and Bash examples. These delimiters are not shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"A fenced dotnet publish example demonstrates the container target. The command contains no backtick substitution or injected arguments.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The closing fence precedes an explanation of OCI image indexes. No shell execution is performed by the matched Markdown.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"The Bash example quotes the semicolon-separated image tags. The backticks are code fences, and the tag separator is not an unquoted shell command separator.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"The match spans Markdown fences around alternative tag configuration examples. No executable backticks are present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"Fenced XML assigns two image tags to ContainerImageTags. This is declarative project configuration, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The matched fences surround prose introducing archive output. There is no executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"The example writes a container archive and scans it with Trivy. Both operations match the documented workflow; the backticks only delimit Markdown.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"The closing code fence and image comparison table are documentation. No command substitution occurs.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"Backticks format image family names in table cells. The text describes image characteristics rather than executing commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"The noble-chiseled-extra and alpine names are inline Markdown in a comparison table. No executable expression appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"The match spans an inline image name and an XML code fence. Neither is shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The fenced XML selects standard or localization-enabled chiseled image families. These property values do not execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"The closing fence precedes prose naming the chiseled-aot image variant. The backticks are Markdown formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"The inline chiseled-aot name and following XML fence are documentation delimiters. No command substitution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","reason":"The XML sets PublishAot and comments on base image selection. No shell command is embedded.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","reason":"The match spans closing and opening code fences around a GitHub Actions heading. Markdown delimiters are not executable.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The YAML example authenticates to ghcr.io and publishes a repository image with a commit tag. Its backticks are Markdown fences, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","reason":"The match spans a YAML closing fence and an XML opening fence. The surrounding text introduces deprecated property guidance.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"The XML contrasts deprecated ContainerImageName with ContainerRepository. This is declarative configuration guidance, not executable backticks.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","reason":"The matched fences separate property examples from publish target guidance. Neither delimiter executes a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","reason":"The Bash example compares an older publish profile with the recommended PublishContainer target. No backtick substitution or command injection appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"Markdown fences surround the next platform targeting example. The matched delimiters are not executable.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"The fenced example recommends explicit Linux and x64 targets. These are fixed SDK arguments without shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"The match spans Markdown code fences around authentication guidance. No executable backtick expression is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","reason":"The example explains authentication failures and shows docker login before publishing to ghcr.io. This is expected registry use, not backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","reason":"The closing Bash fence and opening XML fence delimit documentation about custom base images. They do not execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"XML comments explain that SDK publishing cannot install OS packages, then show a custom base image property. No package installation command executes.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","reason":"The match closes an XML block before a decision table. No executable shell syntax is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:227:ruby-shell-backtick-execution","reason":"Backticks format the noble-chiseled recommendation within a decision table. The following rows describe supported scenarios, not executable code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","reason":"Backticks mark ContainerArchiveOutputPath and ContainerRuntimeIdentifiers as property names. These table cells do not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","reason":"Inline Markdown identifies a runtime property and image family. There is no executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","reason":"The table formats an image family and a local publish command as inline Markdown. It does not contain shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","reason":"Inline backticks mark the standard local publish command and registry settings. They are documentation formatting rather than executable delimiters.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","reason":"ContainerRegistry and docker login are formatted as inline Markdown in the registry push recommendation. No executable backtick syntax appears.","verdict":"false_positive","confidence":1},{"id":"env_access:SKILL.md:161:git-platform-tokens","reason":"The GitHub Actions secret supplies docker/login-action with a password for ghcr.io. This is intended registry authentication, without logging or unrelated credential transmission.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"f7b161679d1208226f24d167acf8573bb901d0ee","subject_content_hash":"4fafdfeda7602eea8bde5c0394bd094a8317b36c26054cfc4925fa8d11895c62","subject_tree_hash":"ae249560ef9f7719d22999c056318c6d7699032ca0cd4dd34e67adc4edcb1cb1","subject_plugin_path":"skills/codewithmukesh/container-publish","audit_payload_hash":"f7c3e681476e3f445b323c15f267ed10","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f7b161679d1208226f24d167acf8573bb901d0ee","contentHash":"4fafdfeda7602eea8bde5c0394bd094a8317b36c26054cfc4925fa8d11895c62","treeHash":"ae249560ef9f7719d22999c056318c6d7699032ca0cd4dd34e67adc4edcb1cb1","pluginPath":"skills/codewithmukesh/container-publish","auditPayloadHash":"f7c3e681476e3f445b323c15f267ed10"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/codewithmukesh-container-publish/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}