{"data":{"skill":{"slug":"halt-catch-fire-character-design-sheet","name":"character-design-sheet","icon":"📦","repo":"https://github.com/halt-catch-fire/skills/tree/main/guides/design/character-design-sheet/","status":"approved","author":"halt-catch-fire","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"6ea66b94-c630-4db9-bdc8-0edeceb0732b","skill_id":"4ff2c523-143a-4e78-918a-ed389093bf2d","version":2,"content_hash":"634b5462e302ea31f69a4ef350d44c69","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The static findings are false positives caused by Markdown code fences, fixed CLI examples, and disclosed documentation links. I found no prompt-injection text, hidden exfiltration intent, dynamic command construction, or system reconnaissance in SKILL.md.","remediation":[{"issue":"External CLI examples call a hosted inference service.","severity":"low","suggestion":"State that belt commands may send prompts and selected image inputs to inference.sh before users run them."},{"issue":"Install commands are mixed with usage guidance.","severity":"low","suggestion":"Separate optional installation commands from normal workflow examples so agents do not treat them as required actions."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":26,"line_start":17},{"file":"SKILL.md","line_end":49,"line_start":26},{"file":"SKILL.md","line_end":56,"line_start":49},{"file":"SKILL.md","line_end":58,"line_start":56},{"file":"SKILL.md","line_end":92,"line_start":58},{"file":"SKILL.md","line_end":98,"line_start":92},{"file":"SKILL.md","line_end":106,"line_start":98},{"file":"SKILL.md","line_end":110,"line_start":106},{"file":"SKILL.md","line_end":133,"line_start":110},{"file":"SKILL.md","line_end":150,"line_start":133},{"file":"SKILL.md","line_end":160,"line_start":150},{"file":"SKILL.md","line_end":168,"line_start":160},{"file":"SKILL.md","line_end":173,"line_start":168},{"file":"SKILL.md","line_end":177,"line_start":173},{"file":"SKILL.md","line_end":184,"line_start":177},{"file":"SKILL.md","line_end":204,"line_start":184},{"file":"SKILL.md","line_end":210,"line_start":204},{"file":"SKILL.md","line_end":233,"line_start":210},{"file":"SKILL.md","line_end":259,"line_start":233},{"file":"SKILL.md","line_end":274,"line_start":259},{"file":"SKILL.md","line_end":278,"line_start":274},{"file":"SKILL.md","line_end":280,"line_start":278}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":15,"line_start":15}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":282,"audit_model":"codex","audited_at":"2026-07-03T12:00:43.371+00:00","created_at":"2026-07-03T13:40:26.360607+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}