{"data":{"skill":{"slug":"coreyhaines31-community-marketing","name":"community-marketing","icon":"📦","repo":"https://github.com/coreyhaines31/marketingskills/tree/main/skills/community-marketing/","status":"approved","author":"coreyhaines31","authorVersion":"2.0.1","skillstoreRevision":2},"audit":{"id":"268afc7b-7944-44fd-ba00-6611efe60559","skill_id":"ffae5cf4-d9bb-475b-a1d3-e2c1ce9b5c08","version":7,"content_hash":"v3:fda6952e22603cf4ac79b6304dd29c7c5e61b956:e4c4a21e82a04e8ef6e2845fa34ebaf5512ba59ae1c9c74d8caa9f045628f4da:8396d76980232ea454e6b09d8b01d64dddfd5b198208dc5fa91fb93f67e0e372:736b696c6c732f636f7265796861696e657333312f636f6d6d756e6974792d6d61726b6574696e67:fabfddca411995361031e1c579cca02a","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All four static findings are false positives involving Markdown formatting or ordinary community-building advice. The reviewed files provide strategy instructions, supporting reference material, and evaluation scenarios. No evidence found of malicious instruction overrides, credential theft, or data exfiltration.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":60,"line_start":56},{"file":"SKILL.md","line_end":103,"line_start":60}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":3,"total_lines":344,"audit_model":"codex","audited_at":"2026-10-24T11:38:33.44+00:00","created_at":"2026-10-24T12:01:51.265326+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":60,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":103,"severity":"medium","line_start":60},{"id":"blocker:SKILL.md:46:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- Exclusive knowledge or early access","category":"blocker","line_end":47,"severity":"low","line_start":46}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"SKILL.md line 15 uses inline Markdown backticks around optional local context filenames. It requests reading product context, not shell execution or command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"SKILL.md lines 56 through 60 contain a fenced text diagram showing member participation and community discovery. The backticks delimit Markdown, with no executable commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"Line 60 closes the community diagram; line 103 formats a reference filename with inline backticks. The intervening playbooks contain prose, not executable shell or Ruby code.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:46:network-reconnaissance","reason":"SKILL.md lines 46 and 47 list member benefits: exclusive knowledge, early access, and peer connections. These describe community value, not network probing or reconnaissance.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"fda6952e22603cf4ac79b6304dd29c7c5e61b956","subject_content_hash":"e4c4a21e82a04e8ef6e2845fa34ebaf5512ba59ae1c9c74d8caa9f045628f4da","subject_tree_hash":"8396d76980232ea454e6b09d8b01d64dddfd5b198208dc5fa91fb93f67e0e372","subject_plugin_path":"skills/coreyhaines31/community-marketing","audit_payload_hash":"fabfddca411995361031e1c579cca02a","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"fda6952e22603cf4ac79b6304dd29c7c5e61b956","contentHash":"e4c4a21e82a04e8ef6e2845fa34ebaf5512ba59ae1c9c74d8caa9f045628f4da","treeHash":"8396d76980232ea454e6b09d8b01d64dddfd5b198208dc5fa91fb93f67e0e372","pluginPath":"skills/coreyhaines31/community-marketing","auditPayloadHash":"fabfddca411995361031e1c579cca02a"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/coreyhaines31-community-marketing/audits/7/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}