{"data":{"skill":{"slug":"expo-expo-cicd-workflows","name":"expo-cicd-workflows","icon":"📦","repo":"https://github.com/expo/skills/tree/main/plugins/expo-deployment/skills/expo-cicd-workflows/","status":"approved","author":"expo","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"0bdffba6-ac50-42ad-8a68-17d073281a30","skill_id":"0dbc3b06-a61a-4ab4-b2cb-ccc1474f9c3a","version":4,"content_hash":"e26af663423bc01815aab1cd6d6522f0","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static command findings are false positives caused by JavaScript template literals and Markdown inline code. The remaining confirmed findings are expected network fetches and documented Node or npm commands used for Expo workflow validation. No prompt injection, credential harvesting, data exfiltration, or destructive behavior was found in the reviewed files.","remediation":[{"issue":"General-purpose URL fetch helper","severity":"low","suggestion":"Restrict fetch.js to documented Expo and GitHub raw URLs, or require explicit user confirmation before fetching other hosts."},{"issue":"Runtime dependency installation guidance","severity":"medium","suggestion":"Add a scripts package manifest and lockfile before recommending npm install, and require confirmation before installing dependencies."},{"issue":"Agent-run validation commands","severity":"medium","suggestion":"Keep command usage limited to the bundled Node scripts and avoid passing unreviewed URLs or unexpected workflow paths."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"scripts/fetch.js","line_end":37,"line_start":37},{"file":"scripts/fetch.js","line_end":103,"line_start":99},{"file":"scripts/validate.js","line_end":34,"line_start":34},{"file":"scripts/validate.js","line_end":50,"line_start":50},{"file":"scripts/validate.js","line_end":62,"line_start":60},{"file":"scripts/validate.js","line_end":76,"line_start":76},{"file":"scripts/validate.js","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":20,"line_start":17},{"file":"SKILL.md","line_end":42,"line_start":20},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":49,"line_start":48},{"file":"SKILL.md","line_end":50,"line_start":49},{"file":"SKILL.md","line_end":51,"line_start":50},{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":58,"line_start":52},{"file":"SKILL.md","line_end":60,"line_start":58},{"file":"SKILL.md","line_end":61,"line_start":60},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":63,"line_start":62},{"file":"SKILL.md","line_end":64,"line_start":63},{"file":"SKILL.md","line_end":65,"line_start":64},{"file":"SKILL.md","line_end":73,"line_start":65},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":81,"line_start":75},{"file":"SKILL.md","line_end":86,"line_start":81}]},{"factor":"network","evidence":[{"file":"scripts/fetch.js","line_end":22,"line_start":22},{"file":"scripts/validate.js","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":34,"line_start":34}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":20,"line_start":17}],"confidence":0.8,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The Markdown code block instructs the agent to run a local Node fetch helper with a URL argument. This is intentional, but it is real command execution combined with network access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":86,"line_start":81}],"confidence":0.84,"description":"```sh","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The validation code block instructs agents to run npm install if dependencies are missing and then run the Node validator. This is expected for the skill, but it is real local command execution and dependency-install risk."}],"low_findings":[{"title":"Fetch API call","locations":[{"file":"scripts/fetch.js","line_end":22,"line_start":22}],"confidence":0.82,"description":"const response = await fetch(url, {","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"fetchCached performs a real outbound HTTP request to the caller-provided URL, then caches and prints the response. This is expected for public Expo references, but it is real network egress and should stay limited to trusted URLs."},{"title":"Hardcoded URL","locations":[{"file":"scripts/validate.js","line_end":13,"line_start":13}],"confidence":0.87,"description":"const SCHEMA_URL = 'https://api.expo.dev/v2/workflows/schema';","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The validator uses a hardcoded Expo schema endpoint that is fetched during validation. This is legitimate for current schema checks, but remote schema availability and content affect results."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":22,"line_start":22}],"confidence":0.88,"description":"1. **JSON Schema** — https://api.expo.dev/v2/workflows/schema","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill explicitly instructs agents to fetch the official Expo workflow schema URL. This is a legitimate public endpoint, but it creates a network dependency that can influence validation output."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":29,"line_start":29}],"confidence":0.86,"description":"2. **Syntax Documentation** — https://raw.githubusercontent.com/expo/expo/refs/heads/main/docs/pages","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill points to raw GitHub documentation that agents are expected to fetch for syntax guidance. The URL is public Expo documentation, but remote content changes can affect generated advice."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":34,"line_start":34}],"confidence":0.86,"description":"3. **Pre-packaged Jobs** — https://raw.githubusercontent.com/expo/expo/refs/heads/main/docs/pages/ea","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill points to raw GitHub documentation for pre-packaged jobs. This is expected documentation retrieval, but it is still a remote content dependency."}],"dangerous_patterns":[],"files_scanned":3,"total_lines":288,"audit_model":"codex","audited_at":"2026-07-05T15:10:49.26+00:00","created_at":"2026-07-05T16:55:44.716618+00:00","static_findings":[{"id":"external_commands:scripts/fetch.js:37:ruby-shell-backtick-execution","file":"scripts/fetch.js","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`HTTP ${response.status}: ${response.statusText}`);","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:scripts/fetch.js:99:ruby-shell-backtick-execution","file":"scripts/fetch.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Usage: fetch <url>","category":"external_commands","line_end":103,"severity":"medium","line_start":99},{"id":"network:scripts/fetch.js:22:fetch-api-call","file":"scripts/fetch.js","pattern":"Fetch API call","snippet":"const response = await fetch(url, {","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"external_commands:scripts/validate.js:34:ruby-shell-backtick-execution","file":"scripts/validate.js","pattern":"Ruby/shell backtick execution","snippet":"return { valid: false, error: `YAML parse error: ${e.message}` };","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:scripts/validate.js:50:ruby-shell-backtick-execution","file":"scripts/validate.js","pattern":"Ruby/shell backtick execution","snippet":"return `  ${path}: ${error.message}${allowed ? ` (allowed: ${allowed})` : ''}`;","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:scripts/validate.js:60:ruby-shell-backtick-execution","file":"scripts/validate.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Usage: validate <workflow.yml> [workflow2.yml ...]","category":"external_commands","line_end":62,"severity":"medium","line_start":60},{"id":"external_commands:scripts/validate.js:76:ruby-shell-backtick-execution","file":"scripts/validate.js","pattern":"Ruby/shell backtick execution","snippet":"console.log(`✓ ${file}`);","category":"external_commands","line_end":76,"severity":"medium","line_start":76},{"id":"external_commands:scripts/validate.js:78:ruby-shell-backtick-execution","file":"scripts/validate.js","pattern":"Ruby/shell backtick execution","snippet":"console.error(`✗ ${file}\\n${result.error}`);","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"network:scripts/validate.js:13:hardcoded-url","file":"scripts/validate.js","pattern":"Hardcoded URL","snippet":"const SCHEMA_URL = 'https://api.expo.dev/v2/workflows/schema';","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"blocker:scripts/validate.js:37:system-reconnaissance","file":"scripts/validate.js","pattern":"System reconnaissance","snippet":"const valid = validator(doc);","category":"blocker","line_end":37,"severity":"low","line_start":37},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Fetch these resources before generating or validating workflow files. Use the fetch script (implemen","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":20,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":42,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Workflows live in `.eas/workflows/*.yml` (or `.yaml`).","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `name` — Display name for the workflow","category":"external_commands","line_end":49,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `on` — Triggers that start the workflow (at least one required)","category":"external_commands","line_end":50,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `jobs` — Job definitions (required)","category":"external_commands","line_end":51,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `defaults` — Shared defaults for all jobs","category":"external_commands","line_end":52,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `concurrency` — Control parallel workflow runs","category":"external_commands","line_end":58,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `${{ }}` syntax for dynamic values. The schema defines available contexts:","category":"external_commands","line_end":60,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `github.*` — GitHub repository and event information","category":"external_commands","line_end":61,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `inputs.*` — Values from `workflow_dispatch` inputs","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `needs.*` — Outputs and status from dependent jobs","category":"external_commands","line_end":63,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `jobs.*` — Job outputs (alternative syntax)","category":"external_commands","line_end":64,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `steps.*` — Step outputs within custom jobs","category":"external_commands","line_end":65,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `workflow.*` — Workflow metadata","category":"external_commands","line_end":73,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Verify job references in `needs` and `after` exist in the workflow","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. Ensure `if` conditions respect the schema's length constraints","category":"external_commands","line_end":81,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```sh","category":"external_commands","line_end":86,"severity":"medium","line_start":81},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"1. **JSON Schema** — https://api.expo.dev/v2/workflows/schema","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:SKILL.md:29:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"2. **Syntax Documentation** — https://raw.githubusercontent.com/expo/expo/refs/heads/main/docs/pages","category":"network","line_end":29,"severity":"low","line_start":29},{"id":"network:SKILL.md:34:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"3. **Pre-packaged Jobs** — https://raw.githubusercontent.com/expo/expo/refs/heads/main/docs/pages/ea","category":"network","line_end":34,"severity":"low","line_start":34},{"id":"blocker:SKILL.md:74:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"4. Check that expressions reference valid contexts and outputs","category":"blocker","line_end":74,"severity":"low","line_start":74}],"finding_verdicts":[{"id":"external_commands:scripts/fetch.js:37:ruby-shell-backtick-execution","reason":"This line is a JavaScript template literal used to format an HTTP error message. It does not invoke a shell, Ruby backticks, child_process, or eval.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:scripts/fetch.js:99:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal printed as CLI help text. It contains no shell execution path or command interpolation.","verdict":"false_positive","confidence":0.98},{"id":"network:scripts/fetch.js:22:fetch-api-call","reason":"fetchCached performs a real outbound HTTP request to the caller-provided URL, then caches and prints the response. This is expected for public Expo references, but it is real network egress and should stay limited to trusted URLs.","verdict":"confirmed","severity":"low","confidence":0.82},{"id":"external_commands:scripts/validate.js:34:ruby-shell-backtick-execution","reason":"This line is a JavaScript template literal used to report YAML parse errors. It does not execute a command or evaluate dynamic code.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:scripts/validate.js:50:ruby-shell-backtick-execution","reason":"This line formats AJV validation errors with JavaScript template literals. It does not pass user input to a shell or process execution API.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:scripts/validate.js:60:ruby-shell-backtick-execution","reason":"This is a multi-line JavaScript template literal used for CLI usage output. No shell, Ruby backtick execution, or child process call is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:scripts/validate.js:76:ruby-shell-backtick-execution","reason":"This line logs a validation success message with the file name. It is console output only and does not execute the file path as a command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:scripts/validate.js:78:ruby-shell-backtick-execution","reason":"This line logs validation errors with a JavaScript template literal. It does not invoke a shell or execute the supplied workflow file.","verdict":"false_positive","confidence":0.98},{"id":"network:scripts/validate.js:13:hardcoded-url","reason":"The validator uses a hardcoded Expo schema endpoint that is fetched during validation. This is legitimate for current schema checks, but remote schema availability and content affect results.","verdict":"confirmed","severity":"low","confidence":0.87},{"id":"blocker:scripts/validate.js:37:system-reconnaissance","reason":"validator(doc) runs AJV validation against a parsed workflow document. It does not collect host, network, environment, or system inventory data.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The line uses Markdown inline code around the scripts directory name and describes the helper. The actual command examples are handled separately; this line is not shell backtick execution.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The Markdown code block instructs the agent to run a local Node fetch helper with a URL argument. This is intentional, but it is real command execution combined with network access.","verdict":"confirmed","severity":"medium","confidence":0.8},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The reported line is Markdown code-fence formatting, followed by public documentation references. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"This line uses Markdown inline code to show the workflow file path pattern. It does not execute a command or request command execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The backticks mark the YAML key name in Markdown documentation. This is formatting, not executable shell syntax.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The backticks mark the YAML trigger key in documentation. No command execution or shell interpolation is present.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The backticks mark the YAML jobs key in Markdown. This is documentation text, not shell execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The backticks mark a YAML defaults key in Markdown documentation. They are not Ruby or shell backticks.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The backticks mark the YAML concurrency key and nearby section text. The line documents workflow structure and does not run commands.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The line documents EAS expression syntax with Markdown inline code. It does not evaluate the expression or invoke a shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The backticks mark a workflow context name in documentation. This is a static reference, not command execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The backticks mark an inputs context name. The text explains workflow expressions and does not execute code.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The backticks mark a needs context name in documentation. There is no shell command, subprocess call, or dynamic execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The backticks mark a jobs context name in Markdown documentation. It is not executable syntax.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The backticks mark a steps context name. The line is explanatory documentation and does not execute commands.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The backticks mark a workflow context name and nearby documentation. No shell execution or code evaluation is present.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The line uses Markdown inline code for workflow keys that should be checked. It describes validation logic and does not execute commands.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The backticks mark the workflow if field in documentation. This is Markdown formatting, not shell command execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The validation code block instructs agents to run npm install if dependencies are missing and then run the Node validator. This is expected for the skill, but it is real local command execution and dependency-install risk.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"network:SKILL.md:22:hardcoded-url","reason":"The skill explicitly instructs agents to fetch the official Expo workflow schema URL. This is a legitimate public endpoint, but it creates a network dependency that can influence validation output.","verdict":"confirmed","severity":"low","confidence":0.88},{"id":"network:SKILL.md:29:hardcoded-url","reason":"The skill points to raw GitHub documentation that agents are expected to fetch for syntax guidance. The URL is public Expo documentation, but remote content changes can affect generated advice.","verdict":"confirmed","severity":"low","confidence":0.86},{"id":"network:SKILL.md:34:hardcoded-url","reason":"The skill points to raw GitHub documentation for pre-packaged jobs. This is expected documentation retrieval, but it is still a remote content dependency.","verdict":"confirmed","severity":"low","confidence":0.86},{"id":"blocker:SKILL.md:74:system-reconnaissance","reason":"The line asks the assistant to check workflow expression references and outputs. It does not request host reconnaissance, credential discovery, or environment inspection.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":7,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}