{"data":{"skill":{"slug":"consiliency-stack-analyzer","name":"stack-analyzer","icon":"📦","repo":"https://github.com/Consiliency/treesitter-chunker/tree/main/.ai-dev-kit/skills/stack-analyzer","status":"approved","author":"Consiliency","authorVersion":null,"skillstoreRevision":3},"audit":{"id":"3f50c46e-5d36-4e63-a002-09521811b67c","skill_id":"d72aad3b-13aa-44eb-a0a8-1419637cd4a5","version":14,"content_hash":"v3:43994e3a0b630dd937942fb60c36b310e7b8dc04:bde7ed2e93547a370475c4af5f1d2b9d9239cd131f37617d01e2455d343d4b30:4538cfff5b07c04683037df2930be014ccef5a12babb74bad27798815e932de7:736b696c6c732f636f6e73696c69656e63792f737461636b2d616e616c797a6572:df836485c348446db76f16972d07fab0","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 61 static alerts are false positives involving Markdown, benign date substitution, a schema identifier, and expected optional repository writes. Scaffolding has a separate overwrite risk because header generation replaces SKILL.md in the current directory rather than the copied destination. No evidence found of malicious prompt injection, credential theft, or data exfiltration in the reviewed files.","remediation":[{"issue":"Scaffolding writes SKILL.md and a predictable temporary file in the current directory instead of the copied destination.","severity":"medium","suggestion":"Resolve the destination explicitly, quote paths, create temporary files securely there, and require confirmation before replacing existing skill files."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":76,"line_start":67},{"file":"SKILL.md","line_end":80,"line_start":76},{"file":"SKILL.md","line_end":82,"line_start":80},{"file":"SKILL.md","line_end":88,"line_start":82},{"file":"SKILL.md","line_end":94,"line_start":88},{"file":"SKILL.md","line_end":118,"line_start":94},{"file":"SKILL.md","line_end":124,"line_start":118},{"file":"SKILL.md","line_end":134,"line_start":124},{"file":"SKILL.md","line_end":138,"line_start":134},{"file":"SKILL.md","line_end":140,"line_start":138},{"file":"SKILL.md","line_end":157,"line_start":140},{"file":"SKILL.md","line_end":165,"line_start":157},{"file":"SKILL.md","line_end":165,"line_start":165},{"file":"SKILL.md","line_end":166,"line_start":166},{"file":"SKILL.md","line_end":167,"line_start":167},{"file":"SKILL.md","line_end":168,"line_start":168},{"file":"SKILL.md","line_end":175,"line_start":169},{"file":"SKILL.md","line_end":175,"line_start":175},{"file":"SKILL.md","line_end":176,"line_start":176},{"file":"SKILL.md","line_end":185,"line_start":177},{"file":"SKILL.md","line_end":192,"line_start":185},{"file":"SKILL.md","line_end":198,"line_start":192},{"file":"SKILL.md","line_end":205,"line_start":198},{"file":"SKILL.md","line_end":211,"line_start":205},{"file":"SKILL.md","line_end":218,"line_start":211},{"file":"SKILL.md","line_end":226,"line_start":218},{"file":"SKILL.md","line_end":237,"line_start":226},{"file":"SKILL.md","line_end":243,"line_start":237},{"file":"SKILL.md","line_end":255,"line_start":243},{"file":"SKILL.md","line_end":259,"line_start":255},{"file":"SKILL.md","line_end":295,"line_start":259},{"file":"SKILL.md","line_end":301,"line_start":295},{"file":"SKILL.md","line_end":317,"line_start":301},{"file":"SKILL.md","line_end":129,"line_start":129},{"file":"SKILL.md","line_end":134,"line_start":124},{"file":"templates/project-domain/SKILL.md","line_end":54,"line_start":47},{"file":"templates/project-domain/SKILL.md","line_end":87,"line_start":54},{"file":"templates/project-domain/SKILL.md","line_end":88,"line_start":87},{"file":"templates/project-research/SKILL.md","line_end":83,"line_start":78},{"file":"templates/project-research/SKILL.md","line_end":88,"line_start":83},{"file":"templates/project-research/SKILL.md","line_end":90,"line_start":88},{"file":"templates/project-testing/SKILL.md","line_end":43,"line_start":43},{"file":"templates/project-testing/SKILL.md","line_end":52,"line_start":52},{"file":"templates/project-testing/SKILL.md","line_end":61,"line_start":61}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":261,"line_start":261}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":126,"line_start":126}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Scaffolding Can Overwrite the Current Skill","locations":[{"file":"SKILL.md","line_end":133,"line_start":124}],"confidence":0.98,"description":"The copy command targets the repository, but 'mv temp SKILL.md' and sed modify the current directory without changing to that destination. Running from the skill directory can replace the analyzer instructions with a template and leave the copied skill uncustomized.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The example uses relative output paths and never changes directories after copying. The overwrite is clear if followed literally; agent interpretation may differ."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":5,"total_lines":861,"audit_model":"codex","audited_at":"2026-10-29T18:17:09.227+00:00","created_at":"2026-10-30T03:12:18.995087+00:00","static_findings":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"A meta-skill that analyzes a project's technology stack and recommends or scaffolds appropriate skil","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Generic skills | `plugins/ai-dev-kit/skills/` | Removed with plugin |","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Project-specific skills | Target repo `.claude/skills/` | User's choice |","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Generated manifest | `.claude/skills/_generated.json` | User's choice |","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Run `library-detection` skill to get project stack","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Invoke the `library-detection` skill first:","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":76,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Load recommendations from `./config/recommendations.yaml` and match:","category":"external_commands","line_end":82,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":88,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":94,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":118,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":124,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":134,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":138,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Create or update `.claude/skills/_generated.json`:","category":"external_commands","line_end":140,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":157,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":165,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `baml-integration` | `baml_src/**/*.baml` exists OR `baml-py`/`baml` dependency |","category":"external_commands","line_end":165,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `supabase-patterns` | `supabase` dependency OR `supabase/migrations/` exists |","category":"external_commands","line_end":166,"severity":"medium","line_start":166},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `schema-alignment` | `sqlalchemy`/`prisma`/`django`/`alembic` detected |","category":"external_commands","line_end":167,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `treesitter-patterns` | `tree-sitter`/`tree_sitter` dependency |","category":"external_commands","line_end":168,"severity":"medium","line_start":168},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `security-audit` | Always recommended for production codebases |","category":"external_commands","line_end":175,"severity":"medium","line_start":169},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `project-research` | `.claude/commands/**/research/**` OR `subagent.*research` pattern |","category":"external_commands","line_end":175,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `project-domain` | `src/models/**` OR `services/domain/**` exists |","category":"external_commands","line_end":176,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `project-testing` | Custom test patterns beyond standard frameworks |","category":"external_commands","line_end":185,"severity":"medium","line_start":177},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":192,"severity":"medium","line_start":185},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":198,"severity":"medium","line_start":192},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":205,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":211,"severity":"medium","line_start":205},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":218,"severity":"medium","line_start":211},{"id":"external_commands:SKILL.md:218:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":226,"severity":"medium","line_start":218},{"id":"external_commands:SKILL.md:226:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":237,"severity":"medium","line_start":226},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":243,"severity":"medium","line_start":237},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":255,"severity":"medium","line_start":243},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":259,"severity":"medium","line_start":255},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":295,"severity":"medium","line_start":259},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":301,"severity":"medium","line_start":295},{"id":"external_commands:SKILL.md:301:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":317,"severity":"medium","line_start":301},{"id":"external_commands:SKILL.md:129:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"echo \"<!-- Generated by ai-dev-kit:recommend-skills on $(date) -->\" | \\","category":"external_commands","line_end":129,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:124:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"```bash","category":"external_commands","line_end":134,"severity":"medium","line_start":124},{"id":"network:SKILL.md:261:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"$schema\": \"http://json-schema.org/draft-07/schema#\",","category":"network","line_end":261,"severity":"low","line_start":261},{"id":"filesystem:SKILL.md:126:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"cp -r ./templates/{template}/ ${TARGET_REPO}/.claude/skills/{project}-{template}/","category":"filesystem","line_end":126,"severity":"medium","line_start":126},{"id":"external_commands:templates/project-domain/SKILL.md:47:ruby-shell-backtick-execution","file":"templates/project-domain/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":54,"severity":"medium","line_start":47},{"id":"external_commands:templates/project-domain/SKILL.md:54:ruby-shell-backtick-execution","file":"templates/project-domain/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":87,"severity":"medium","line_start":54},{"id":"external_commands:templates/project-domain/SKILL.md:87:ruby-shell-backtick-execution","file":"templates/project-domain/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ORM models in `src/models/`","category":"external_commands","line_end":88,"severity":"medium","line_start":87},{"id":"blocker:templates/project-domain/SKILL.md:60:system-reconnaissance","file":"templates/project-domain/SKILL.md","pattern":"System reconnaissance","snippet":"| Concept | Correct Term | Avoid |","category":"blocker","line_end":60,"severity":"low","line_start":60},{"id":"blocker:templates/project-domain/SKILL.md:66:system-reconnaissance","file":"templates/project-domain/SKILL.md","pattern":"System reconnaissance","snippet":"| Entity | Valid Statuses | Transitions |","category":"blocker","line_end":66,"severity":"low","line_start":66},{"id":"external_commands:templates/project-research/SKILL.md:78:ruby-shell-backtick-execution","file":"templates/project-research/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":83,"severity":"medium","line_start":78},{"id":"external_commands:templates/project-research/SKILL.md:83:ruby-shell-backtick-execution","file":"templates/project-research/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":88,"severity":"medium","line_start":83},{"id":"external_commands:templates/project-research/SKILL.md:88:ruby-shell-backtick-execution","file":"templates/project-research/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Research subagents in `.claude/agents/`","category":"external_commands","line_end":90,"severity":"medium","line_start":88},{"id":"external_commands:templates/project-testing/SKILL.md:43:ruby-shell-backtick-execution","file":"templates/project-testing/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Location: `tests/unit/`","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:templates/project-testing/SKILL.md:52:ruby-shell-backtick-execution","file":"templates/project-testing/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Location: `tests/integration/`","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:templates/project-testing/SKILL.md:61:ruby-shell-backtick-execution","file":"templates/project-testing/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Location: `tests/e2e/` or `playwright/`","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:templates/project-testing/SKILL.md:72:ruby-shell-backtick-execution","file":"templates/project-testing/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Location: `tests/fixtures/`","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:templates/project-testing/SKILL.md:75:ruby-shell-backtick-execution","file":"templates/project-testing/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":82,"severity":"medium","line_start":75},{"id":"external_commands:templates/project-testing/SKILL.md:82:ruby-shell-backtick-execution","file":"templates/project-testing/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":86,"severity":"medium","line_start":82},{"id":"external_commands:templates/project-testing/SKILL.md:86:ruby-shell-backtick-execution","file":"templates/project-testing/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Location: `tests/mocks/`","category":"external_commands","line_end":95,"severity":"medium","line_start":86},{"id":"external_commands:templates/project-testing/SKILL.md:95:ruby-shell-backtick-execution","file":"templates/project-testing/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Unit | `test_*.py` | `test_<function>_<scenario>` |","category":"external_commands","line_end":95,"severity":"medium","line_start":95},{"id":"external_commands:templates/project-testing/SKILL.md:96:ruby-shell-backtick-execution","file":"templates/project-testing/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Integration | `test_*_integration.py` | `test_<component>_<action>` |","category":"external_commands","line_end":96,"severity":"medium","line_start":96},{"id":"external_commands:templates/project-testing/SKILL.md:97:ruby-shell-backtick-execution","file":"templates/project-testing/SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| E2E | `*.spec.ts` | `test('<feature> - <scenario>')` |","category":"external_commands","line_end":97,"severity":"medium","line_start":97}],"finding_verdicts":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","reason":"Backticks format the setup command name in prose. This line contains no Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"This table documents the generic skill directory using inline Markdown. The path is not an executable expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"Inline Markdown identifies the project skill directory. No shell backtick substitution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The table displays the generated manifest path as inline code. It does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"Backticks identify the library-detection skill dependency. This is workflow documentation, not Ruby or shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The skill name is formatted with inline Markdown. The line does not contain executable backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"This Markdown fence encloses instructions for invoking the detection dependency and describing its output. It is not shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The matched characters close a Markdown example. No executable backtick expression is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"Inline Markdown names the local recommendation configuration. Reading this configuration is part of the stated workflow, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The YAML fence contains recommendation matching pseudocode. Markdown delimiters are not Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"This is the closing fence for matching pseudocode. It performs no command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The fenced Markdown shows an example stack analysis report. Its tables and headings are output examples, not executable commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"The matched delimiter closes the report example. It is Markdown formatting rather than backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The matched backticks open a Bash code fence, not a Ruby or shell substitution. The separate scaffolding overwrite issue is recorded semantically.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"This delimiter closes the scaffolding code block. It is not an executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"Inline Markdown identifies the generated manifest. The documented bookkeeping path is not a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"The fenced JSON illustrates manifest fields and generated artifact tracking. No Ruby or shell execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"This is the closing Markdown fence for the manifest example. It does not execute its contents.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"Backticks format BAML skill names, file globs, and dependency names in a recommendation table. They are not executable expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","reason":"The table formats Supabase detection criteria as inline code. No shell command is embedded in the backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"Inline Markdown lists ORM dependency names and the schema-alignment skill. These identifiers are recommendation data, not commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","reason":"Backticks format the Tree-sitter skill and dependency names. No Ruby or shell execution is specified.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","reason":"The security-audit skill name is an inline Markdown identifier. The surrounding table recommends a development skill rather than executing shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"The research template row contains formatted file globs and a detection pattern. These are matching criteria, not shell substitutions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","reason":"Inline Markdown names the domain template and model directory patterns. No executable backticks occur.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","reason":"The testing template name is formatted as inline code. The row describes a scaffolding trigger, not a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","reason":"This fence displays the proposed research template directory tree. Directory diagrams do not execute shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","reason":"The delimiter closes the research directory diagram. The backticks are Markdown syntax only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"This code fence contains a proposed domain template directory tree. It contains no executable shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"The matched delimiter closes the domain directory diagram. It does not execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","reason":"The fenced block illustrates testing template directories. The backticks delimit documentation, not Ruby or shell expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:218:ruby-shell-backtick-execution","reason":"This is the closing Markdown fence for a directory diagram. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:226:ruby-shell-backtick-execution","reason":"The Markdown example describes setup integration with explicit activation and scaffolding prompts. Its fence is not an executable expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","reason":"The delimiter closes the setup integration example. It is Markdown formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","reason":"The Bash fence lists documented plugin slash-command options. The matched backticks are not Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","reason":"This closes the invocation examples. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","reason":"The fenced block defines the expected report schema in JSON. The backticks are presentation syntax, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","reason":"The delimiter closes the output schema example. It is not an executable expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:301:ruby-shell-backtick-execution","reason":"This Markdown block contains an uninstall notice listing generated artifacts. It does not execute cleanup or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:129:shell-command-substitution","reason":"The substitution runs the fixed date command solely to timestamp a generation header. No untrusted input becomes executable code through this substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:124:template-literal-with-command-substitution","reason":"This is a fenced Bash example, not a JavaScript template literal. Its date substitution is benign; the separate destination error is recorded semantically.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:261:hardcoded-url","reason":"The URL identifies the JSON Schema draft in a documentation example. There is no request instruction or data transmission at this location.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:126:hidden-file-access","reason":"Copying templates into repository-local .claude/skills is the documented optional scaffolding function. Hidden-directory placement alone does not indicate secret access or unauthorized persistence.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:templates/project-domain/SKILL.md:47:ruby-shell-backtick-execution","reason":"This fenced block contains a placeholder entity relationship diagram. It is not executable Ruby or shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-domain/SKILL.md:54:ruby-shell-backtick-execution","reason":"The matched backticks close the entity relationship example. The following vocabulary tables also contain no commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-domain/SKILL.md:87:ruby-shell-backtick-execution","reason":"Inline Markdown names the ORM model directory. The path is an integration reference, not a shell expression.","verdict":"false_positive","confidence":0.99},{"id":"blocker:templates/project-domain/SKILL.md:60:system-reconnaissance","reason":"The complete line is a vocabulary table header: Concept, Correct Term, Avoid. It performs no host or system reconnaissance.","verdict":"false_positive","confidence":1},{"id":"blocker:templates/project-domain/SKILL.md:66:system-reconnaissance","reason":"The complete line labels entity statuses and transitions in a domain table. It contains no system discovery behavior.","verdict":"false_positive","confidence":1},{"id":"external_commands:templates/project-research/SKILL.md:78:ruby-shell-backtick-execution","reason":"The Markdown fence contains a placeholder research pattern with trigger, action, and output labels. It does not execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-research/SKILL.md:83:ruby-shell-backtick-execution","reason":"The delimiter closes the research pattern example. It is Markdown formatting rather than executable backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-research/SKILL.md:88:ruby-shell-backtick-execution","reason":"Inline code formats the research subagent directory. The line documents integration and does not execute the directory contents.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-testing/SKILL.md:43:ruby-shell-backtick-execution","reason":"The unit test directory is shown with inline Markdown. There is no Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-testing/SKILL.md:52:ruby-shell-backtick-execution","reason":"Backticks format the integration test directory. This is a location reference, not an executable expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-testing/SKILL.md:61:ruby-shell-backtick-execution","reason":"The line lists possible E2E test directories using inline code. It does not invoke browser tooling or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-testing/SKILL.md:72:ruby-shell-backtick-execution","reason":"Inline Markdown identifies the fixture directory. No executable backticks occur.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-testing/SKILL.md:75:ruby-shell-backtick-execution","reason":"This Python fence contains an illustrative fixture import and an empty test body. It contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-testing/SKILL.md:82:ruby-shell-backtick-execution","reason":"The delimiter closes the Python fixture example. Markdown fences do not execute their contents.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-testing/SKILL.md:86:ruby-shell-backtick-execution","reason":"The mock service directory is formatted as inline code. It is not an executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-testing/SKILL.md:95:ruby-shell-backtick-execution","reason":"The table lists unit test filename and function naming patterns. Backticks mark literal patterns rather than shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-testing/SKILL.md:96:ruby-shell-backtick-execution","reason":"Inline code formats integration test naming conventions. The patterns are not executable shell expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:templates/project-testing/SKILL.md:97:ruby-shell-backtick-execution","reason":"The table shows E2E filename and test naming conventions. These examples do not execute commands or tests.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Scaffolding Can Overwrite the Current Skill","severity":"medium","locations":[{"file":"SKILL.md","line_end":133,"line_start":124}],"confidence":0.98,"description":"The copy command targets the repository, but 'mv temp SKILL.md' and sed modify the current directory without changing to that destination. Running from the skill directory can replace the analyzer instructions with a template and leave the copied skill uncustomized.","confidence_reasoning":"The example uses relative output paths and never changes directories after copying. The overwrite is clear if followed literally; agent interpretation may differ."}],"subject_marketplace_commit_sha":"43994e3a0b630dd937942fb60c36b310e7b8dc04","subject_content_hash":"bde7ed2e93547a370475c4af5f1d2b9d9239cd131f37617d01e2455d343d4b30","subject_tree_hash":"4538cfff5b07c04683037df2930be014ccef5a12babb74bad27798815e932de7","subject_plugin_path":"skills/consiliency/stack-analyzer","audit_payload_hash":"df836485c348446db76f16972d07fab0","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"43994e3a0b630dd937942fb60c36b310e7b8dc04","contentHash":"bde7ed2e93547a370475c4af5f1d2b9d9239cd131f37617d01e2455d343d4b30","treeHash":"4538cfff5b07c04683037df2930be014ccef5a12babb74bad27798815e932de7","pluginPath":"skills/consiliency/stack-analyzer","auditPayloadHash":"df836485c348446db76f16972d07fab0"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/consiliency-stack-analyzer/audits/14/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}