{"data":{"skill":{"slug":"consiliency-stack-analyzer","name":"stack-analyzer","icon":"📦","repo":"https://github.com/Consiliency/treesitter-chunker/tree/main/.ai-dev-kit/skills/stack-analyzer","status":"approved","author":"Consiliency","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"2dac7aa6-a6cf-45fb-bbb7-727b56a8f96e","skill_id":"d72aad3b-13aa-44eb-a0a8-1419637cd4a5","version":13,"content_hash":"v3:a97d7edf7f0f20a32837c04a3936b78615ff5cfa:bde7ed2e93547a370475c4af5f1d2b9d9239cd131f37617d01e2455d343d4b30:5c629d8e67d166fee8d82b5d3e280ec9bd8526ae8a35d3419aff46ab589c29f4:736b696c6c732f636f6e73696c69656e63792f737461636b2d616e616c797a6572:1f392f71b174043d30a25ac7dcbb6492","risk_level":"medium","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 46 static alerts were dismissed after contextual review, including manual inspection of the three templates. One semantic finding identifies unsafe scaffolding writes that can overwrite files outside the intended destination. No evidence found of credential theft, data exfiltration, or audit-manipulation instructions.","remediation":[{"issue":"Scaffolding writes to relative files without entering the generated skill directory.","severity":"medium","suggestion":"Resolve every output beneath the approved destination, reject existing files and symlinks, and use unique temporary files before atomic replacement."},{"issue":"The scaffolding example uses an unquoted target path and inserts the project name directly into a sed expression.","severity":"medium","suggestion":"Validate project identifiers, quote target paths, enforce repository containment, and use literal template replacement instead of interpolating sed syntax."},{"issue":"Template names contain unquoted placeholders, and the generation example prepends a comment before YAML frontmatter.","severity":"low","suggestion":"Quote placeholder names, render them before loading, keep frontmatter first, and validate each generated skill before activation."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":76,"line_start":67},{"file":"SKILL.md","line_end":80,"line_start":76},{"file":"SKILL.md","line_end":82,"line_start":80},{"file":"SKILL.md","line_end":88,"line_start":82},{"file":"SKILL.md","line_end":94,"line_start":88},{"file":"SKILL.md","line_end":118,"line_start":94},{"file":"SKILL.md","line_end":124,"line_start":118},{"file":"SKILL.md","line_end":134,"line_start":124},{"file":"SKILL.md","line_end":138,"line_start":134},{"file":"SKILL.md","line_end":140,"line_start":138},{"file":"SKILL.md","line_end":157,"line_start":140},{"file":"SKILL.md","line_end":165,"line_start":157},{"file":"SKILL.md","line_end":165,"line_start":165},{"file":"SKILL.md","line_end":166,"line_start":166},{"file":"SKILL.md","line_end":167,"line_start":167},{"file":"SKILL.md","line_end":168,"line_start":168},{"file":"SKILL.md","line_end":175,"line_start":169},{"file":"SKILL.md","line_end":175,"line_start":175},{"file":"SKILL.md","line_end":176,"line_start":176},{"file":"SKILL.md","line_end":185,"line_start":177},{"file":"SKILL.md","line_end":192,"line_start":185},{"file":"SKILL.md","line_end":198,"line_start":192},{"file":"SKILL.md","line_end":205,"line_start":198},{"file":"SKILL.md","line_end":211,"line_start":205},{"file":"SKILL.md","line_end":218,"line_start":211},{"file":"SKILL.md","line_end":226,"line_start":218},{"file":"SKILL.md","line_end":237,"line_start":226},{"file":"SKILL.md","line_end":243,"line_start":237},{"file":"SKILL.md","line_end":255,"line_start":243},{"file":"SKILL.md","line_end":259,"line_start":255},{"file":"SKILL.md","line_end":295,"line_start":259},{"file":"SKILL.md","line_end":301,"line_start":295},{"file":"SKILL.md","line_end":317,"line_start":301},{"file":"SKILL.md","line_end":129,"line_start":129},{"file":"SKILL.md","line_end":134,"line_start":124}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":261,"line_start":261}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":126,"line_start":126}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Scaffolding Writes Are Not Confined to the Destination","locations":[{"file":"SKILL.md","line_end":133,"line_start":124}],"confidence":0.97,"description":"After copying the template, the example uses '> temp && mv temp SKILL.md' without changing directories. Following it can overwrite the caller's SKILL.md; a preexisting temp symlink can redirect truncation to another writable file.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The complete scaffolding block contains relative writes and no destination directory change or collision checks. Damage requires executing the documented example with scaffolding enabled."}],"low_findings":[{"title":"Unscanned file (invalid_frontmatter) — manual review required","locations":[{"file":"templates/project-testing/SKILL.md","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: invalid_frontmatter]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (invalid_frontmatter) — manual review required","locations":[{"file":"templates/project-research/SKILL.md","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: invalid_frontmatter]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."},{"title":"Unscanned file (invalid_frontmatter) — manual review required","locations":[{"file":"templates/project-domain/SKILL.md","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: invalid_frontmatter]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."}],"dangerous_patterns":[],"files_scanned":2,"total_lines":542,"audit_model":"codex","audited_at":"2026-10-23T12:09:59.746+00:00","created_at":"2026-10-23T13:23:25.822483+00:00","static_findings":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"A meta-skill that analyzes a project's technology stack and recommends or scaffolds appropriate skil","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Generic skills | `plugins/ai-dev-kit/skills/` | Removed with plugin |","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Project-specific skills | Target repo `.claude/skills/` | User's choice |","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Generated manifest | `.claude/skills/_generated.json` | User's choice |","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Run `library-detection` skill to get project stack","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Invoke the `library-detection` skill first:","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":76,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Load recommendations from `./config/recommendations.yaml` and match:","category":"external_commands","line_end":82,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":88,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":94,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":118,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":124,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":134,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":138,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Create or update `.claude/skills/_generated.json`:","category":"external_commands","line_end":140,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":157,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":165,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `baml-integration` | `baml_src/**/*.baml` exists OR `baml-py`/`baml` dependency |","category":"external_commands","line_end":165,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `supabase-patterns` | `supabase` dependency OR `supabase/migrations/` exists |","category":"external_commands","line_end":166,"severity":"medium","line_start":166},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `schema-alignment` | `sqlalchemy`/`prisma`/`django`/`alembic` detected |","category":"external_commands","line_end":167,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `treesitter-patterns` | `tree-sitter`/`tree_sitter` dependency |","category":"external_commands","line_end":168,"severity":"medium","line_start":168},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `security-audit` | Always recommended for production codebases |","category":"external_commands","line_end":175,"severity":"medium","line_start":169},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `project-research` | `.claude/commands/**/research/**` OR `subagent.*research` pattern |","category":"external_commands","line_end":175,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `project-domain` | `src/models/**` OR `services/domain/**` exists |","category":"external_commands","line_end":176,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `project-testing` | Custom test patterns beyond standard frameworks |","category":"external_commands","line_end":185,"severity":"medium","line_start":177},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":192,"severity":"medium","line_start":185},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":198,"severity":"medium","line_start":192},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":205,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":211,"severity":"medium","line_start":205},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":218,"severity":"medium","line_start":211},{"id":"external_commands:SKILL.md:218:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":226,"severity":"medium","line_start":218},{"id":"external_commands:SKILL.md:226:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":237,"severity":"medium","line_start":226},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":243,"severity":"medium","line_start":237},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":255,"severity":"medium","line_start":243},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":259,"severity":"medium","line_start":255},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":295,"severity":"medium","line_start":259},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":301,"severity":"medium","line_start":295},{"id":"external_commands:SKILL.md:301:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":317,"severity":"medium","line_start":301},{"id":"external_commands:SKILL.md:129:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"echo \"<!-- Generated by ai-dev-kit:recommend-skills on $(date) -->\" | \\","category":"external_commands","line_end":129,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:124:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"```bash","category":"external_commands","line_end":134,"severity":"medium","line_start":124},{"id":"network:SKILL.md:261:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"$schema\": \"http://json-schema.org/draft-07/schema#\",","category":"network","line_end":261,"severity":"low","line_start":261},{"id":"filesystem:SKILL.md:126:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"cp -r ./templates/{template}/ ${TARGET_REPO}/.claude/skills/{project}-{template}/","category":"filesystem","line_end":126,"severity":"medium","line_start":126},{"id":"metadata:templates/project-testing/SKILL.md:1:unscanned-file-invalid-frontmatter-manual-review","file":"templates/project-testing/SKILL.md","pattern":"Unscanned file (invalid_frontmatter) — manual review required","snippet":"[unscanned: invalid_frontmatter]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:templates/project-research/SKILL.md:1:unscanned-file-invalid-frontmatter-manual-review","file":"templates/project-research/SKILL.md","pattern":"Unscanned file (invalid_frontmatter) — manual review required","snippet":"[unscanned: invalid_frontmatter]","category":"metadata","line_end":1,"severity":"low","line_start":1},{"id":"metadata:templates/project-domain/SKILL.md:1:unscanned-file-invalid-frontmatter-manual-review","file":"templates/project-domain/SKILL.md","pattern":"Unscanned file (invalid_frontmatter) — manual review required","snippet":"[unscanned: invalid_frontmatter]","category":"metadata","line_end":1,"severity":"low","line_start":1}],"finding_verdicts":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","reason":"The line describes the skill and formats a setup command as inline Markdown. It contains no Ruby or shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"Backticks format the generic skills directory in a Markdown table. No command is executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"Backticks identify the documented project skills directory. This table entry is not shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The manifest path is inline Markdown in a location table. It is not an executable expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"Backticks identify the library-detection skill in a workflow step, not a shell expression. Its external implementation is not included in this review.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"This is an inline reference to the library-detection dependency. No backtick-based process execution appears here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The backticks open a Markdown example describing another skill and its expected results. They do not perform Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The matched characters close a Markdown example before the recommendation section. They are formatting delimiters.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The recommendation configuration path is formatted as inline code. Referencing this local configuration does not execute a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"This YAML fence contains recommendation-matching pseudocode. The backticks are not executable syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The match is the closing fence of recommendation pseudocode. No process invocation appears in this location.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The fenced block is a sample stack analysis report with tables. It contains no shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"The match closes the example report before the scaffolding section. The backticks are Markdown formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"Triple backticks delimit a Bash example rather than execute a backtick expression. Unsafe file writes in that example are reported separately.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The match is the closing Markdown fence of the scaffolding example. It is not an additional command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"Backticks format the generated manifest path in prose. Updating the documented manifest is not shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"This JSON fence introduces a manifest example containing generation metadata. Its backticks are formatting, not executable code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"The match closes the JSON manifest example. No shell or Ruby expression is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"Backticks label BAML skill names, file globs, and dependencies in a detection table. These are matching criteria, not commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","reason":"Backticks label the Supabase skill, dependency, and migrations directory. The table describes detection criteria without executing them.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"The matched text lists ORM dependency names as inline Markdown. It contains no executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","reason":"The row associates Tree-sitter dependencies with a recommended skill. Its backticks only format names.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","reason":"The backticks format the security-audit recommendation and nearby template names. No shell backtick execution occurs.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"This row lists research file globs and a text pattern for detection. Inline Markdown does not execute these strings.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","reason":"The domain template row contains directory detection criteria. Backticks format those criteria rather than execute a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","reason":"The testing template name is inline Markdown in a recommendation table. There is no executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","reason":"The fenced block depicts the proposed research template directory tree. It does not contain shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","reason":"The match closes a directory-tree illustration. These backticks have no execution semantics.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"This fence introduces a domain template directory-tree illustration. It is not shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"The matched fence closes the domain directory-tree illustration. No command execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","reason":"The fence surrounds a testing template directory-tree illustration. The listed directories are documentation, not commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:218:ruby-shell-backtick-execution","reason":"The match closes the testing directory-tree illustration. Triple backticks are Markdown delimiters here.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:226:ruby-shell-backtick-execution","reason":"The fenced Markdown describes setup prompts that request permission before activation or scaffolding. No backtick-based command execution appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","reason":"The matched characters close the setup workflow example. They are not a shell expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","reason":"The backticks delimit documented plugin command invocations with explicit activation and scaffolding options. There is no Ruby or shell backtick substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","reason":"The matched fence closes plugin usage examples. It does not execute another command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","reason":"This fence surrounds the output JSON Schema. The schema describes report fields and contains no executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","reason":"The match closes the output schema example. It is Markdown formatting rather than process execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:301:ruby-shell-backtick-execution","reason":"The fenced Markdown contains an uninstall notice and generated-file inventory. It does not execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:129:shell-command-substitution","reason":"The substitution runs the fixed date command to populate a generation timestamp. It contains no user-controlled command or sensitive-data access.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:template-literal-with-command-substitution","reason":"This is a fenced Bash example, not a JavaScript template literal. Its fixed date substitution is benign; unsafe destination writes are reported separately.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:261:hardcoded-url","reason":"The URL identifies the standard JSON Schema dialect in an example. No network request or data transmission is instructed.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:126:hidden-file-access","reason":"The hidden directory is the documented destination for optional, user-approved skill scaffolding. No covert access occurs; unsafe write handling is a separate semantic finding.","verdict":"false_positive","confidence":0.98},{"id":"metadata:templates/project-testing/SKILL.md:1:unscanned-file-invalid-frontmatter-manual-review","reason":"Manual review found conventional testing guidance and an unresolved project placeholder in the name. No evidence found of malicious instructions in this template.","verdict":"false_positive","confidence":0.98},{"id":"metadata:templates/project-research/SKILL.md:1:unscanned-file-invalid-frontmatter-manual-review","reason":"Manual review found research scoping, citation, and synthesis guidance with an unresolved project placeholder. No evidence found of exfiltration or instruction override attempts.","verdict":"false_positive","confidence":0.98},{"id":"metadata:templates/project-domain/SKILL.md:1:unscanned-file-invalid-frontmatter-manual-review","reason":"Manual review found domain glossary and relationship guidance with placeholder content. The frontmatter issue does not conceal malicious instructions in the reviewed file.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Scaffolding Writes Are Not Confined to the Destination","severity":"medium","locations":[{"file":"SKILL.md","line_end":133,"line_start":124}],"confidence":0.97,"description":"After copying the template, the example uses '> temp && mv temp SKILL.md' without changing directories. Following it can overwrite the caller's SKILL.md; a preexisting temp symlink can redirect truncation to another writable file.","confidence_reasoning":"The complete scaffolding block contains relative writes and no destination directory change or collision checks. Damage requires executing the documented example with scaffolding enabled."}],"subject_marketplace_commit_sha":"a97d7edf7f0f20a32837c04a3936b78615ff5cfa","subject_content_hash":"bde7ed2e93547a370475c4af5f1d2b9d9239cd131f37617d01e2455d343d4b30","subject_tree_hash":"5c629d8e67d166fee8d82b5d3e280ec9bd8526ae8a35d3419aff46ab589c29f4","subject_plugin_path":"skills/consiliency/stack-analyzer","audit_payload_hash":"1f392f71b174043d30a25ac7dcbb6492","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"a97d7edf7f0f20a32837c04a3936b78615ff5cfa","contentHash":"bde7ed2e93547a370475c4af5f1d2b9d9239cd131f37617d01e2455d343d4b30","treeHash":"5c629d8e67d166fee8d82b5d3e280ec9bd8526ae8a35d3419aff46ab589c29f4","pluginPath":"skills/consiliency/stack-analyzer","auditPayloadHash":"1f392f71b174043d30a25ac7dcbb6492"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/consiliency-stack-analyzer/audits/13/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":4,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}