{"data":{"skill":{"slug":"daichihoshina-ecommerce","name":"ecommerce","icon":"📦","repo":"https://github.com/DaichiHoshina/ai-tools/tree/main/claude-code/skills-archive/ecommerce","status":"approved","author":"DaichiHoshina","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"ed86b1c4-6c78-4999-a2be-026895e42d83","skill_id":"cd1c8e5f-e630-4fbc-8001-bbd7a0540b04","version":7,"content_hash":"53d64b2268b9a16d419bd3107f6a77f1","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported weak crypto, external command, reconnaissance, entropy, and hardcoded URL patterns. Manual review found markdown documentation, fenced examples, REST route text, and one public API documentation link with no executable commands, cryptography, system probing, exfiltration, or prompt injection.","remediation":[],"risk_factor_evidence":[],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Weak crypto alerts are false positives","locations":[{"file":"audit_output.json","line_end":9,"line_start":4},{"file":"audit_output.json","line_end":45,"line_start":28},{"file":"audit_output.json","line_end":82,"line_start":51},{"file":"SKILL.md","line_end":6,"line_start":3}],"confidence":0.92,"description":"The weak cryptography alerts occur in descriptive JSON and markdown metadata. No hashing, encryption, or insecure cryptographic algorithm implementation was found.","confidence_reasoning":"The cited lines are plain metadata or user-facing guidance. There is no executable crypto code or API usage in either reviewed file."},{"title":"Markdown fences are not shell execution","locations":[{"file":"SKILL.md","line_end":35,"line_start":32},{"file":"SKILL.md","line_end":93,"line_start":74},{"file":"SKILL.md","line_end":114,"line_start":97},{"file":"SKILL.md","line_end":162,"line_start":150},{"file":"SKILL.md","line_end":170,"line_start":166}],"confidence":0.95,"description":"The Ruby or shell backtick alerts match markdown code fences used for examples. They do not execute commands or interpolate user-controlled input.","confidence_reasoning":"The backticks delimit markdown examples for state transitions, TypeScript, YAML routes, and output formats. No runtime shell, Ruby, or command invocation exists."},{"title":"Documentation URL and route examples are benign","locations":[{"file":"SKILL.md","line_end":114,"line_start":107},{"file":"SKILL.md","line_end":140,"line_start":140}],"confidence":0.9,"description":"The hardcoded URL points to public STORES retail API documentation. The reconnaissance alerts are REST endpoint examples, not host or system probes.","confidence_reasoning":"The reviewed content contains only documentation references and example HTTP routes. There is no code that performs network access or reconnaissance."},{"title":"Entropy alert is readable markdown content","locations":[{"file":"SKILL.md","line_end":6,"line_start":1}],"confidence":0.88,"description":"The high entropy alert appears to be caused by Japanese markdown text and front matter. The file is readable plain text with no encoded payload.","confidence_reasoning":"Manual inspection shows ordinary YAML front matter and Japanese description text. No binary, encrypted, compressed, or obfuscated content was found."}],"dangerous_patterns":[],"files_scanned":2,"total_lines":316,"audit_model":"codex","audited_at":"2026-06-29T08:51:41.878+00:00","created_at":"2026-06-29T10:07:03.95837+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"low","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":2,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}