{"data":{"skill":{"slug":"hau823823-gen-paylink-govilo","name":"gen-paylink-govilo","icon":"📦","repo":"https://github.com/hau823823/gen-paylink-govilo/tree/main/skills/gen-paylink-govilo/","status":"approved","author":"hau823823","authorVersion":"1.0","skillstoreRevision":1},"audit":{"id":"69e6632c-d8a5-418d-869d-1c3872a876db","skill_id":"542ec911-7cc5-4085-8663-43ae83ad2a15","version":4,"content_hash":"v3:a06681402992ceae98ba04d54cfd4ab004862696:8eb3484ef60817ebdb264917712eb3da6678edbff2787dec9a9d301a6f60f054:1472202eab4f3ff9e0cc42b8fe7d32499dd7fec2930cf08fcbd740a4c6ccff13:736b696c6c732f6861753832333832332f67656e2d7061796c696e6b2d676f76696c6f:b62ab2ef6ee9411a8e87ca3543ce2fbe","risk_level":"critical","is_blocked":true,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"blocked","manual_install_policy":"allowed_with_warning","summary":"The skill intentionally packages user-selected files, reads Govilo-specific credentials, and uploads the archive to the documented Govilo workflow. Most static matches are capability or documentation false positives, but the setup guide executes remotely downloaded installers and the packager uses race-prone temporary paths. No prompt-injection text, covert data collection, or undeclared exfiltration intent was found.","remediation":[{"issue":"Remote installer execution in setup instructions","severity":"critical","suggestion":"Replace pipe-to-shell and PowerShell execution-policy bypass instructions with verified package-manager installation steps or a download, checksum verification, and explicit execution flow."},{"issue":"Unsafe temporary archive creation","severity":"low","suggestion":"Replace tempfile.mktemp with tempfile.NamedTemporaryFile(delete=False) or mkstemp, close the descriptor safely, and retain cleanup in finally."},{"issue":"Unrestricted presigned upload destination","severity":"medium","suggestion":"Validate that the presigned upload URL uses HTTPS and an expected Govilo storage host before uploading user files."},{"issue":"Missing HTTP request safeguards","severity":"medium","suggestion":"Set explicit connect and read timeouts, and disable or tightly validate redirects for API and upload requests."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"references/setup-guide.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":48,"line_start":40},{"file":"SKILL.md","line_end":50,"line_start":48},{"file":"SKILL.md","line_end":52,"line_start":50},{"file":"SKILL.md","line_end":55,"line_start":52},{"file":"SKILL.md","line_end":57,"line_start":55},{"file":"SKILL.md","line_end":59,"line_start":57},{"file":"SKILL.md","line_end":65,"line_start":59},{"file":"SKILL.md","line_end":66,"line_start":65},{"file":"SKILL.md","line_end":67,"line_start":66},{"file":"SKILL.md","line_end":68,"line_start":67},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":75,"line_start":69},{"file":"SKILL.md","line_end":76,"line_start":75},{"file":"SKILL.md","line_end":77,"line_start":76},{"file":"SKILL.md","line_end":90,"line_start":77},{"file":"SKILL.md","line_end":91,"line_start":90},{"file":"SKILL.md","line_end":95,"line_start":91},{"file":"SKILL.md","line_end":95,"line_start":95}]},{"factor":"env_access","evidence":[{"file":"references/setup-guide.md","line_end":23,"line_start":23},{"file":"references/setup-guide.md","line_end":41,"line_start":41},{"file":"scripts/api_client.py","line_end":13,"line_start":13},{"file":"scripts/api_client.py","line_end":16,"line_start":16},{"file":"scripts/config.py","line_end":23,"line_start":23},{"file":"scripts/config.py","line_end":30,"line_start":30},{"file":"scripts/config.py","line_end":14,"line_start":14},{"file":"scripts/config.py","line_end":20,"line_start":20},{"file":"scripts/config.py","line_end":23,"line_start":23},{"file":"scripts/config.py","line_end":24,"line_start":24},{"file":"scripts/config.py","line_end":27,"line_start":27},{"file":"scripts/config.py","line_end":37,"line_start":37},{"file":"scripts/workflow_create.py","line_end":33,"line_start":33},{"file":"scripts/workflow_create.py","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":90,"line_start":90}]},{"factor":"network","evidence":[{"file":"scripts/api_client.py","line_end":20,"line_start":20},{"file":"scripts/api_client.py","line_end":27,"line_start":27},{"file":"scripts/api_client.py","line_end":36,"line_start":36},{"file":"scripts/api_client.py","line_end":51,"line_start":51},{"file":"scripts/config.py","line_end":5,"line_start":5},{"file":"scripts/config.py","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":93,"line_start":93}]},{"factor":"filesystem","evidence":[{"file":"scripts/packager.py","line_end":1,"line_start":1},{"file":"scripts/packager.py","line_end":44,"line_start":44},{"file":"scripts/packager.py","line_end":54,"line_start":54},{"file":"scripts/packager.py","line_end":2,"line_start":2},{"file":"scripts/packager.py","line_end":16,"line_start":16},{"file":"scripts/packager.py","line_end":22,"line_start":22},{"file":"scripts/packager.py","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":42,"line_start":42}]}],"critical_findings":[{"title":"Pipe to shell pattern","locations":[{"file":"references/setup-guide.md","line_end":10,"line_start":10}],"confidence":0.98,"description":"curl -LsSf https://astral.sh/uv/install.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The setup guide downloads a remote installer and immediately executes it through a shell. A compromised or substituted installer would execute arbitrary code on the user system."}],"high_findings":[{"title":"PowerShell invocation","locations":[{"file":"references/setup-guide.md","line_end":13,"line_start":13}],"confidence":0.98,"description":"powershell -ExecutionPolicy ByPass -c \"irm https://astral.sh/uv/install.ps1 | iex\"","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"The Windows setup command downloads remote content and executes it with PowerShell while bypassing the execution policy. A compromised installer endpoint would execute arbitrary code."}],"medium_findings":[],"low_findings":[{"title":"Network reconnaissance","locations":[{"file":"references/setup-guide.md","line_end":13,"line_start":13}],"confidence":0.97,"description":"powershell -ExecutionPolicy ByPass -c \"irm https://astral.sh/uv/install.ps1 | iex\"","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The command retrieves a remote script and executes it through PowerShell. This is remote code execution exposure, not network reconnaissance."},{"title":"Temp file creation","locations":[{"file":"scripts/packager.py","line_end":44,"line_start":44}],"confidence":0.93,"description":"dest = Path(tempfile.mktemp(suffix=\".zip\"))","review_kind":"capability","source_category":"filesystem","source_severity":"low","confidence_reasoning":"tempfile.mktemp creates a predictable path without atomically reserving it. A local attacker can race the later archive write and redirect or replace the file."},{"title":"Temp file creation","locations":[{"file":"scripts/packager.py","line_end":54,"line_start":54}],"confidence":0.93,"description":"dest = Path(tempfile.mktemp(suffix=\".zip\"))","review_kind":"capability","source_category":"filesystem","source_severity":"low","confidence_reasoning":"tempfile.mktemp creates a predictable path without atomically reserving it. A local attacker can race the later archive write and redirect or replace the file."}],"dangerous_patterns":[{"title":"Pipe to shell pattern","locations":[{"file":"references/setup-guide.md","line_end":10,"line_start":10}],"confidence":0.98,"description":"curl -LsSf https://astral.sh/uv/install.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The setup guide downloads a remote installer and immediately executes it through a shell. A compromised or substituted installer would execute arbitrary code on the user system."},{"title":"Network reconnaissance","locations":[{"file":"references/setup-guide.md","line_end":13,"line_start":13}],"confidence":0.97,"description":"powershell -ExecutionPolicy ByPass -c \"irm https://astral.sh/uv/install.ps1 | iex\"","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The command retrieves a remote script and executes it through PowerShell. This is remote code execution exposure, not network reconnaissance."}],"files_scanned":9,"total_lines":498,"audit_model":"claude","audited_at":"2026-07-21T07:42:23.989+00:00","created_at":"2026-07-21T07:48:27.516451+00:00","static_findings":[{"id":"blocker:references/bot-api-quick-ref.md:42:system-reconnaissance","file":"references/bot-api-quick-ref.md","pattern":"System reconnaissance","snippet":"| 809108001 | 401 | invalid api key |","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"external_commands:references/setup-guide.md:13:powershell-invocation","file":"references/setup-guide.md","pattern":"PowerShell invocation","snippet":"powershell -ExecutionPolicy ByPass -c \"irm https://astral.sh/uv/install.ps1 | iex\"","category":"external_commands","line_end":13,"severity":"high","line_start":13},{"id":"env_access:references/setup-guide.md:23:generic-api-secret-keys","file":"references/setup-guide.md","pattern":"Generic API/secret keys","snippet":"- `GOVILO_API_KEY` — Bot API authentication token","category":"env_access","line_end":23,"severity":"high","line_start":23},{"id":"env_access:references/setup-guide.md:41:generic-api-secret-keys","file":"references/setup-guide.md","pattern":"Generic API/secret keys","snippet":"GOVILO_API_KEY=sk_live_xxx","category":"env_access","line_end":41,"severity":"high","line_start":41},{"id":"sensitive:references/setup-guide.md:38:environment-file-access","file":"references/setup-guide.md","pattern":"Environment file access","snippet":"Create a **dedicated** env file (e.g. `.env.govilo`) containing only Govilo credentials:","category":"sensitive","line_end":38,"severity":"high","line_start":38},{"id":"sensitive:references/setup-guide.md:40:environment-file-access","file":"references/setup-guide.md","pattern":"Environment file access","snippet":"# .env.govilo","category":"sensitive","line_end":40,"severity":"high","line_start":40},{"id":"sensitive:references/setup-guide.md:43:environment-file-access","file":"references/setup-guide.md","pattern":"Environment file access","snippet":"> **Important:** Do not use a shared project `.env` that may contain unrelated secrets.","category":"sensitive","line_end":43,"severity":"high","line_start":43},{"id":"sensitive:references/setup-guide.md:44:environment-file-access","file":"references/setup-guide.md","pattern":"Environment file access","snippet":"> Always use a dedicated file like `.env.govilo` to avoid accidental leakage.","category":"sensitive","line_end":44,"severity":"high","line_start":44},{"id":"sensitive:references/setup-guide.md:49:environment-file-access","file":"references/setup-guide.md","pattern":"Environment file access","snippet":"uv run --env-file .env.govilo create-link --help","category":"sensitive","line_end":49,"severity":"high","line_start":49},{"id":"sensitive:references/setup-guide.md:83:environment-file-access","file":"references/setup-guide.md","pattern":"Environment file access","snippet":"Add to your `.env.govilo` file:","category":"sensitive","line_end":83,"severity":"high","line_start":83},{"id":"blocker:references/setup-guide.md:10:pipe-to-shell-pattern","file":"references/setup-guide.md","pattern":"Pipe to shell pattern","snippet":"curl -LsSf https://astral.sh/uv/install.sh | sh","category":"blocker","line_end":10,"severity":"critical","line_start":10},{"id":"blocker:references/setup-guide.md:44:system-reconnaissance","file":"references/setup-guide.md","pattern":"System reconnaissance","snippet":"> Always use a dedicated file like `.env.govilo` to avoid accidental leakage.","category":"blocker","line_end":44,"severity":"low","line_start":44},{"id":"blocker:references/setup-guide.md:13:network-reconnaissance","file":"references/setup-guide.md","pattern":"Network reconnaissance","snippet":"powershell -ExecutionPolicy ByPass -c \"irm https://astral.sh/uv/install.ps1 | iex\"","category":"blocker","line_end":13,"severity":"low","line_start":13},{"id":"network:scripts/api_client.py:20:python-http-libraries","file":"scripts/api_client.py","pattern":"Python HTTP libraries","snippet":"def _check_response(self, resp: requests.Response) -> dict:","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"network:scripts/api_client.py:27:python-http-libraries","file":"scripts/api_client.py","pattern":"Python HTTP libraries","snippet":"resp = requests.post(","category":"network","line_end":27,"severity":"low","line_start":27},{"id":"network:scripts/api_client.py:36:python-http-libraries","file":"scripts/api_client.py","pattern":"Python HTTP libraries","snippet":"resp = requests.put(","category":"network","line_end":36,"severity":"low","line_start":36},{"id":"network:scripts/api_client.py:51:python-http-libraries","file":"scripts/api_client.py","pattern":"Python HTTP libraries","snippet":"resp = requests.post(","category":"network","line_end":51,"severity":"low","line_start":51},{"id":"env_access:scripts/api_client.py:13:generic-api-secret-keys","file":"scripts/api_client.py","pattern":"Generic API/secret keys","snippet":"def __init__(self, api_key: str, base_url: str):","category":"env_access","line_end":13,"severity":"high","line_start":13},{"id":"env_access:scripts/api_client.py:16:generic-api-secret-keys","file":"scripts/api_client.py","pattern":"Generic API/secret keys","snippet":"\"Authorization\": f\"Bearer {api_key}\",","category":"env_access","line_end":16,"severity":"high","line_start":16},{"id":"network:scripts/config.py:5:hardcoded-url","file":"scripts/config.py","pattern":"Hardcoded URL","snippet":"BASE_URL = \"https://api.unlock.govilo.xyz\"","category":"network","line_end":5,"severity":"low","line_start":5},{"id":"network:scripts/config.py:27:hardcoded-url","file":"scripts/config.py","pattern":"Hardcoded URL","snippet":"\"Register at https://govilo.xyz/ then set GOVILO_API_KEY=sk_live_xxx\"","category":"network","line_end":27,"severity":"low","line_start":27},{"id":"env_access:scripts/config.py:23:python-environment-access","file":"scripts/config.py","pattern":"Python environment access","snippet":"api_key = cli_api_key or os.environ.get(\"GOVILO_API_KEY\")","category":"env_access","line_end":23,"severity":"low","line_start":23},{"id":"env_access:scripts/config.py:30:python-environment-access","file":"scripts/config.py","pattern":"Python environment access","snippet":"seller_address = cli_address or os.environ.get(\"SELLER_ADDRESS\")","category":"env_access","line_end":30,"severity":"low","line_start":30},{"id":"env_access:scripts/config.py:14:generic-api-secret-keys","file":"scripts/config.py","pattern":"Generic API/secret keys","snippet":"api_key: str","category":"env_access","line_end":14,"severity":"high","line_start":14},{"id":"env_access:scripts/config.py:20:generic-api-secret-keys","file":"scripts/config.py","pattern":"Generic API/secret keys","snippet":"cli_api_key: str | None = None,","category":"env_access","line_end":20,"severity":"high","line_start":20},{"id":"env_access:scripts/config.py:23:generic-api-secret-keys","file":"scripts/config.py","pattern":"Generic API/secret keys","snippet":"api_key = cli_api_key or os.environ.get(\"GOVILO_API_KEY\")","category":"env_access","line_end":23,"severity":"high","line_start":23},{"id":"env_access:scripts/config.py:24:generic-api-secret-keys","file":"scripts/config.py","pattern":"Generic API/secret keys","snippet":"if not api_key:","category":"env_access","line_end":24,"severity":"high","line_start":24},{"id":"env_access:scripts/config.py:27:generic-api-secret-keys","file":"scripts/config.py","pattern":"Generic API/secret keys","snippet":"\"Register at https://govilo.xyz/ then set GOVILO_API_KEY=sk_live_xxx\"","category":"env_access","line_end":27,"severity":"high","line_start":27},{"id":"env_access:scripts/config.py:37:generic-api-secret-keys","file":"scripts/config.py","pattern":"Generic API/secret keys","snippet":"return Config(api_key=api_key, seller_address=seller_address)","category":"env_access","line_end":37,"severity":"high","line_start":37},{"id":"filesystem:scripts/packager.py:1:temp-file-creation","file":"scripts/packager.py","pattern":"Temp file creation","snippet":"import tempfile","category":"filesystem","line_end":1,"severity":"low","line_start":1},{"id":"filesystem:scripts/packager.py:44:temp-file-creation","file":"scripts/packager.py","pattern":"Temp file creation","snippet":"dest = Path(tempfile.mktemp(suffix=\".zip\"))","category":"filesystem","line_end":44,"severity":"low","line_start":44},{"id":"filesystem:scripts/packager.py:54:temp-file-creation","file":"scripts/packager.py","pattern":"Temp file creation","snippet":"dest = Path(tempfile.mktemp(suffix=\".zip\"))","category":"filesystem","line_end":54,"severity":"low","line_start":54},{"id":"filesystem:scripts/packager.py:2:python-archive-libraries","file":"scripts/packager.py","pattern":"Python archive libraries","snippet":"import zipfile","category":"filesystem","line_end":2,"severity":"medium","line_start":2},{"id":"filesystem:scripts/packager.py:16:python-archive-libraries","file":"scripts/packager.py","pattern":"Python archive libraries","snippet":"with zipfile.ZipFile(zp) as zf:","category":"filesystem","line_end":16,"severity":"medium","line_start":16},{"id":"filesystem:scripts/packager.py:22:python-archive-libraries","file":"scripts/packager.py","pattern":"Python archive libraries","snippet":"with zipfile.ZipFile(dest, \"w\", zipfile.ZIP_DEFLATED) as zf:","category":"filesystem","line_end":22,"severity":"medium","line_start":22},{"id":"filesystem:scripts/packager.py:45:python-archive-libraries","file":"scripts/packager.py","pattern":"Python archive libraries","snippet":"with zipfile.ZipFile(dest, \"w\", zipfile.ZIP_DEFLATED) as zf:","category":"filesystem","line_end":45,"severity":"medium","line_start":45},{"id":"env_access:scripts/workflow_create.py:33:generic-api-secret-keys","file":"scripts/workflow_create.py","pattern":"Generic API/secret keys","snippet":"cfg = load_config(cli_api_key=None, cli_address=args.address)","category":"env_access","line_end":33,"severity":"high","line_start":33},{"id":"env_access:scripts/workflow_create.py:44:generic-api-secret-keys","file":"scripts/workflow_create.py","pattern":"Generic API/secret keys","snippet":"client = GoviloClient(api_key=cfg.api_key, base_url=cfg.base_url)","category":"env_access","line_end":44,"severity":"high","line_start":44},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run from this skill's base directory. Use a **dedicated** env file containing only `GOVILO_API_KEY` ","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":48,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":50,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If no `.env.govilo` exists, create one before running:","category":"external_commands","line_end":52,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```dotenv","category":"external_commands","line_end":55,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":57,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--input` accepts ZIP file, folder, or individual files (repeatable). Non-ZIP inputs are auto-packag","category":"external_commands","line_end":59,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"All output is JSON `{\"ok\": true/false, ...}` with exit code 1 on failure.","category":"external_commands","line_end":65,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--input`       | Yes      | CLI (repeatable)           | ZIP, folder, or file paths |","category":"external_commands","line_end":66,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--title`       | Yes      | CLI                        | Product title              |","category":"external_commands","line_end":67,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--price`       | Yes      | CLI                        | Price in USDC              |","category":"external_commands","line_end":68,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--address`     | No       | CLI > `SELLER_ADDRESS` env | Seller EVM wallet          |","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--description` | No       | CLI                        | Product description        |","category":"external_commands","line_end":75,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. `POST /api/v1/bot/uploads/presign` → get upload_url + session_id","category":"external_commands","line_end":76,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. `PUT upload_url` → upload ZIP to R2","category":"external_commands","line_end":77,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. `POST /api/v1/bot/items` → get unlock_url","category":"external_commands","line_end":90,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `GOVILO_API_KEY` | Yes      | Bot API key from [govilo.xyz][]          |","category":"external_commands","line_end":91,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `SELLER_ADDRESS` | Yes*     | EVM wallet address on **Base chain**     |","category":"external_commands","line_end":95,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"*`SELLER_ADDRESS` can also be passed via `--address` CLI parameter.","category":"external_commands","line_end":95,"severity":"medium","line_start":95},{"id":"network:SKILL.md:9:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"If missing, guides user to register at https://govilo.xyz/.","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:SKILL.md:19:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: https://github.com/hau823823/gen-paylink-govilo","category":"network","line_end":19,"severity":"low","line_start":19},{"id":"network:SKILL.md:36:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Requires [uv](https://docs.astral.sh/uv/). See [references/setup-guide.md](references/setup-guide.","category":"network","line_end":36,"severity":"low","line_start":36},{"id":"network:SKILL.md:93:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"[govilo.xyz]: https://govilo.xyz/","category":"network","line_end":93,"severity":"low","line_start":93},{"id":"filesystem:SKILL.md:42:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"uv run --env-file <path_to>/.env.govilo create-link \\","category":"filesystem","line_end":42,"severity":"medium","line_start":42},{"id":"env_access:SKILL.md:52:dotenv-library","file":"SKILL.md","pattern":"dotenv library","snippet":"```dotenv","category":"env_access","line_end":52,"severity":"low","line_start":52},{"id":"env_access:SKILL.md:8:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"Requires GOVILO_API_KEY and SELLER_ADDRESS env vars.","category":"env_access","line_end":8,"severity":"high","line_start":8},{"id":"env_access:SKILL.md:16:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- GOVILO_API_KEY","category":"env_access","line_end":16,"severity":"high","line_start":16},{"id":"env_access:SKILL.md:18:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"primaryEnv: GOVILO_API_KEY","category":"env_access","line_end":18,"severity":"high","line_start":18},{"id":"env_access:SKILL.md:38:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"Run from this skill's base directory. Use a **dedicated** env file containing only `GOVILO_API_KEY` ","category":"env_access","line_end":38,"severity":"high","line_start":38},{"id":"env_access:SKILL.md:53:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"GOVILO_API_KEY=sk_live_xxx","category":"env_access","line_end":53,"severity":"high","line_start":53},{"id":"env_access:SKILL.md:90:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"| `GOVILO_API_KEY` | Yes      | Bot API key from [govilo.xyz][]          |","category":"env_access","line_end":90,"severity":"high","line_start":90},{"id":"sensitive:SKILL.md:38:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"Run from this skill's base directory. Use a **dedicated** env file containing only `GOVILO_API_KEY` ","category":"sensitive","line_end":38,"severity":"high","line_start":38},{"id":"sensitive:SKILL.md:42:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"uv run --env-file <path_to>/.env.govilo create-link \\","category":"sensitive","line_end":42,"severity":"high","line_start":42},{"id":"sensitive:SKILL.md:50:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"If no `.env.govilo` exists, create one before running:","category":"sensitive","line_end":50,"severity":"high","line_start":50},{"id":"blocker:SKILL.md:24:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Turn any file into a paid unlock link — one command to package, upload, and collect crypto payments.","category":"blocker","line_end":24,"severity":"low","line_start":24},{"id":"blocker:SKILL.md:75:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"3. `POST /api/v1/bot/uploads/presign` → get upload_url + session_id","category":"blocker","line_end":76,"severity":"low","line_start":75}],"finding_verdicts":[{"id":"blocker:references/bot-api-quick-ref.md:42:system-reconnaissance","reason":"The matched text is an error code, a payment workflow description, or a security precaution. It does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:references/setup-guide.md:13:powershell-invocation","reason":"The Windows setup command downloads remote content and executes it with PowerShell while bypassing the execution policy. A compromised installer endpoint would execute arbitrary code.","verdict":"confirmed","severity":"high","confidence":0.98},{"id":"env_access:references/setup-guide.md:23:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:references/setup-guide.md:41:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"sensitive:references/setup-guide.md:38:environment-file-access","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"sensitive:references/setup-guide.md:40:environment-file-access","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"sensitive:references/setup-guide.md:43:environment-file-access","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"sensitive:references/setup-guide.md:44:environment-file-access","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"sensitive:references/setup-guide.md:49:environment-file-access","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"sensitive:references/setup-guide.md:83:environment-file-access","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"blocker:references/setup-guide.md:10:pipe-to-shell-pattern","reason":"The setup guide downloads a remote installer and immediately executes it through a shell. A compromised or substituted installer would execute arbitrary code on the user system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:references/setup-guide.md:44:system-reconnaissance","reason":"The matched text is an error code, a payment workflow description, or a security precaution. It does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/setup-guide.md:13:network-reconnaissance","reason":"The command retrieves a remote script and executes it through PowerShell. This is remote code execution exposure, not network reconnaissance.","verdict":"confirmed","severity":"low","confidence":0.97},{"id":"network:scripts/api_client.py:20:python-http-libraries","reason":"This is an explicitly documented Govilo API endpoint or upload operation required to create the requested link. No evidence shows covert network access or transmission beyond the stated workflow.","verdict":"false_positive","confidence":0.92},{"id":"network:scripts/api_client.py:27:python-http-libraries","reason":"This is an explicitly documented Govilo API endpoint or upload operation required to create the requested link. No evidence shows covert network access or transmission beyond the stated workflow.","verdict":"false_positive","confidence":0.92},{"id":"network:scripts/api_client.py:36:python-http-libraries","reason":"This is an explicitly documented Govilo API endpoint or upload operation required to create the requested link. No evidence shows covert network access or transmission beyond the stated workflow.","verdict":"false_positive","confidence":0.92},{"id":"network:scripts/api_client.py:51:python-http-libraries","reason":"This is an explicitly documented Govilo API endpoint or upload operation required to create the requested link. No evidence shows covert network access or transmission beyond the stated workflow.","verdict":"false_positive","confidence":0.92},{"id":"env_access:scripts/api_client.py:13:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:scripts/api_client.py:16:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"network:scripts/config.py:5:hardcoded-url","reason":"This is an explicitly documented Govilo API endpoint or upload operation required to create the requested link. No evidence shows covert network access or transmission beyond the stated workflow.","verdict":"false_positive","confidence":0.92},{"id":"network:scripts/config.py:27:hardcoded-url","reason":"This is an explicitly documented Govilo API endpoint or upload operation required to create the requested link. No evidence shows covert network access or transmission beyond the stated workflow.","verdict":"false_positive","confidence":0.92},{"id":"env_access:scripts/config.py:23:python-environment-access","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:scripts/config.py:30:python-environment-access","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:scripts/config.py:14:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:scripts/config.py:20:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:scripts/config.py:23:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:scripts/config.py:24:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:scripts/config.py:27:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:scripts/config.py:37:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:scripts/packager.py:1:temp-file-creation","reason":"This is normal packaging or a documented dedicated environment-file path. Apart from the separately identified mktemp calls, no unsafe filesystem behavior is shown by this pattern.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:scripts/packager.py:44:temp-file-creation","reason":"tempfile.mktemp creates a predictable path without atomically reserving it. A local attacker can race the later archive write and redirect or replace the file.","verdict":"confirmed","severity":"low","confidence":0.93},{"id":"filesystem:scripts/packager.py:54:temp-file-creation","reason":"tempfile.mktemp creates a predictable path without atomically reserving it. A local attacker can race the later archive write and redirect or replace the file.","verdict":"confirmed","severity":"low","confidence":0.93},{"id":"filesystem:scripts/packager.py:2:python-archive-libraries","reason":"This is normal packaging or a documented dedicated environment-file path. Apart from the separately identified mktemp calls, no unsafe filesystem behavior is shown by this pattern.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:scripts/packager.py:16:python-archive-libraries","reason":"This is normal packaging or a documented dedicated environment-file path. Apart from the separately identified mktemp calls, no unsafe filesystem behavior is shown by this pattern.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:scripts/packager.py:22:python-archive-libraries","reason":"This is normal packaging or a documented dedicated environment-file path. Apart from the separately identified mktemp calls, no unsafe filesystem behavior is shown by this pattern.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:scripts/packager.py:45:python-archive-libraries","reason":"This is normal packaging or a documented dedicated environment-file path. Apart from the separately identified mktemp calls, no unsafe filesystem behavior is shown by this pattern.","verdict":"false_positive","confidence":0.91},{"id":"env_access:scripts/workflow_create.py:33:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:scripts/workflow_create.py:44:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"This finding matches Markdown syntax, command documentation, or API notation rather than shell execution in code. The documented CLI workflow has a stated purpose and no command injection evidence is present.","verdict":"false_positive","confidence":0.93},{"id":"network:SKILL.md:9:hardcoded-url","reason":"This is an explicitly documented Govilo API endpoint or upload operation required to create the requested link. No evidence shows covert network access or transmission beyond the stated workflow.","verdict":"false_positive","confidence":0.92},{"id":"network:SKILL.md:19:hardcoded-url","reason":"This is an explicitly documented Govilo API endpoint or upload operation required to create the requested link. No evidence shows covert network access or transmission beyond the stated workflow.","verdict":"false_positive","confidence":0.92},{"id":"network:SKILL.md:36:hardcoded-url","reason":"This is an explicitly documented Govilo API endpoint or upload operation required to create the requested link. No evidence shows covert network access or transmission beyond the stated workflow.","verdict":"false_positive","confidence":0.92},{"id":"network:SKILL.md:93:hardcoded-url","reason":"This is an explicitly documented Govilo API endpoint or upload operation required to create the requested link. No evidence shows covert network access or transmission beyond the stated workflow.","verdict":"false_positive","confidence":0.92},{"id":"filesystem:SKILL.md:42:hidden-file-access","reason":"This is normal packaging or a documented dedicated environment-file path. Apart from the separately identified mktemp calls, no unsafe filesystem behavior is shown by this pattern.","verdict":"false_positive","confidence":0.91},{"id":"env_access:SKILL.md:52:dotenv-library","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:SKILL.md:8:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:SKILL.md:16:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:SKILL.md:18:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:SKILL.md:38:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:SKILL.md:53:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"env_access:SKILL.md:90:generic-api-secret-keys","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"sensitive:SKILL.md:38:environment-file-access","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"sensitive:SKILL.md:42:environment-file-access","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"sensitive:SKILL.md:50:environment-file-access","reason":"This is documented, scoped configuration for the Govilo API key or seller address. The skill advises a dedicated environment file and no evidence shows unrelated secret collection or disclosure.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:24:system-reconnaissance","reason":"The matched text is an error code, a payment workflow description, or a security precaution. It does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:75:system-reconnaissance","reason":"The matched text is an error code, a payment workflow description, or a security precaution. It does not perform system or network reconnaissance.","verdict":"false_positive","confidence":0.97}],"semantic_findings":[],"subject_marketplace_commit_sha":"a06681402992ceae98ba04d54cfd4ab004862696","subject_content_hash":"8eb3484ef60817ebdb264917712eb3da6678edbff2787dec9a9d301a6f60f054","subject_tree_hash":"1472202eab4f3ff9e0cc42b8fe7d32499dd7fec2930cf08fcbd740a4c6ccff13","subject_plugin_path":"skills/hau823823/gen-paylink-govilo","audit_payload_hash":"b62ab2ef6ee9411a8e87ca3543ce2fbe","confirmed_risk_level":"critical","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"a06681402992ceae98ba04d54cfd4ab004862696","contentHash":"8eb3484ef60817ebdb264917712eb3da6678edbff2787dec9a9d301a6f60f054","treeHash":"1472202eab4f3ff9e0cc42b8fe7d32499dd7fec2930cf08fcbd740a4c6ccff13","pluginPath":"skills/hau823823/gen-paylink-govilo","auditPayloadHash":"b62ab2ef6ee9411a8e87ca3543ce2fbe"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"unavailable","url":null,"status":null},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"critical","confirmedFindingCount":2,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"blocked","manualInstallPolicy":"allowed_with_warning","artifactSignatureState":"available","attestationState":"unavailable","verificationState":"not_verified"},"isLatest":true}}