{"data":{"skill":{"slug":"coreyhaines31-co-marketing","name":"co-marketing","icon":"📦","repo":"https://github.com/coreyhaines31/marketingskills/tree/dda3841f0b294e01e93b1541486beefbfab0915e/skills/co-marketing","status":"approved","author":"coreyhaines31","authorVersion":"2.0.2","skillstoreRevision":1},"audit":{"id":"40fe06ae-db0a-4371-97b4-71259d039871","skill_id":"29dfb508-291a-4dc9-8556-e94a3062769d","version":1,"content_hash":"v3:d4619c83e7ae847148d7f3b28bfd2cb979b3d6a1:0d2c02c569d429e4653392acc83a85ee025ee0cb3012cb16cd862912eae8927c:1a7d298650935999c0f2b06a59b5154fd42e3dc071f167b629cd5472edc90a84:736b696c6c732f636f7265796861696e657333312f636f2d6d61726b6574696e67:d92d51a24662092386aae3468cfebab7","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All eight static findings are false positives involving Markdown formatting, documentation links, and ordinary marketing language. The local context-file instruction supports campaign planning, not command execution. No evidence found of prompt injection, credential collection, unauthorized data transfer, or executable payloads in the reviewed files.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":200,"line_start":186}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":295,"line_start":295},{"file":"SKILL.md","line_end":299,"line_start":299},{"file":"SKILL.md","line_end":300,"line_start":300},{"file":"SKILL.md","line_end":301,"line_start":301}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":3,"total_lines":511,"audit_model":"codex","audited_at":"2026-10-05T16:42:56.84+00:00","created_at":"2026-10-05T17:03:02.734932+00:00","static_findings":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":200,"severity":"medium","line_start":186},{"id":"network:SKILL.md:295:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"For implementation, see the [tools registry](https://github.com/coreyhaines31/marketingskills/blob/m","category":"network","line_end":295,"severity":"low","line_start":295},{"id":"network:SKILL.md:299:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| **Crossbeam** | Account overlap with partners | [crossbeam.md](https://github.com/coreyhaines31/ma","category":"network","line_end":299,"severity":"low","line_start":299},{"id":"network:SKILL.md:300:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| **Introw** | Partner program management, deal registration | [introw.md](https://github.com/coreyh","category":"network","line_end":300,"severity":"low","line_start":300},{"id":"network:SKILL.md:301:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| **PartnerStack** | Partner and affiliate program management | [partnerstack.md](https://github.com","category":"network","line_end":301,"severity":"low","line_start":301},{"id":"blocker:SKILL.md:176:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- \"What would make customers say 'finally, someone did this'?\"","category":"blocker","line_end":176,"severity":"low","line_start":176},{"id":"blocker:SKILL.md:249:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- Partner responsiveness","category":"blocker","line_end":250,"severity":"low","line_start":249}],"finding_verdicts":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"The backticks mark local Markdown filenames, not Ruby or shell expressions. Reading existing product-marketing context is directly relevant to the requested planning task.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","reason":"Lines 186-200 contain a fenced outreach email template with company and name placeholders. The fence is Markdown formatting, with no executable commands inside.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:295:hardcoded-url","reason":"This GitHub link points to the author's tools registry as an implementation reference. It contains no data payload or instruction to transmit local information.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:299:hardcoded-url","reason":"The Crossbeam entry links to a GitHub integration guide relevant to partner account overlap. It does not execute a request or instruct account-data uploads.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:300:hardcoded-url","reason":"The Introw entry is a documentation link for partner-program management. No credential access, data transmission, or automatic integration execution appears in this entry.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:301:hardcoded-url","reason":"The PartnerStack entry links to a GitHub guide for partner and affiliate management. The link is informational and contains no exfiltration payload.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:176:system-reconnaissance","reason":"The quoted question asks what campaign would satisfy customers. It contains no system inspection command or request to enumerate machine information.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:249:network-reconnaissance","reason":"Partner responsiveness and audience reception are qualitative campaign measures. They do not describe network probing, host discovery, or technical reconnaissance.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"d4619c83e7ae847148d7f3b28bfd2cb979b3d6a1","subject_content_hash":"0d2c02c569d429e4653392acc83a85ee025ee0cb3012cb16cd862912eae8927c","subject_tree_hash":"1a7d298650935999c0f2b06a59b5154fd42e3dc071f167b629cd5472edc90a84","subject_plugin_path":"skills/coreyhaines31/co-marketing","audit_payload_hash":"d92d51a24662092386aae3468cfebab7","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"d4619c83e7ae847148d7f3b28bfd2cb979b3d6a1","contentHash":"0d2c02c569d429e4653392acc83a85ee025ee0cb3012cb16cd862912eae8927c","treeHash":"1a7d298650935999c0f2b06a59b5154fd42e3dc071f167b629cd5472edc90a84","pluginPath":"skills/coreyhaines31/co-marketing","auditPayloadHash":"d92d51a24662092386aae3468cfebab7"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/coreyhaines31-co-marketing/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}