{"data":{"skill":{"slug":"heygen-com-three","name":"three","icon":"📦","repo":"https://github.com/heygen-com/hyperframes/tree/main/skills/three/","status":"approved","author":"heygen-com","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"09837e70-6ab3-4c8d-8677-582784f4b2b3","skill_id":"2e8ea154-65ec-47c4-a997-dafa762bd365","version":1,"content_hash":"408a8cd17a2f7a9d3aaadcb406bdca85","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"All 26 static analysis findings are false positives. The 20 backtick execution detections are markdown code fence delimiters, inline code formatting, and JavaScript template literals in documentation code examples, not Ruby shell execution. The 3 hardcoded URL findings point to a legitimate Three.js CDN import and official documentation links. The weak cryptographic algorithm and system reconnaissance blockers are misclassifications of YAML frontmatter and standard coding guidelines. This is a documentation skill for Three.js integration with HyperFrames with no security concerns.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":56,"line_start":56},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":75,"line_start":75},{"file":"SKILL.md","line_end":77,"line_start":77},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":97,"line_start":97},{"file":"SKILL.md","line_end":100,"line_start":100},{"file":"SKILL.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":105,"line_start":105}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":105,"line_start":105},{"file":"SKILL.md","line_end":106,"line_start":106}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Markdown Backtick Formatting Misidentified as Shell Execution","locations":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":97,"line_start":97}],"description":"Static analyzer flagged 20 instances of backtick characters as Ruby/shell backtick execution. All instances are standard markdown formatting: code fence delimiters, inline code spans, and JavaScript template literals within documentation code examples. No actual command execution is present."},{"title":"Hardcoded URLs Are Legitimate References","locations":[{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":105,"line_start":105},{"file":"SKILL.md","line_end":106,"line_start":106}],"description":"Static analyzer flagged 3 hardcoded URLs. One is a jsdelivr CDN import for the Three.js library (standard practice), and two are official Three.js documentation links. No data exfiltration or malicious endpoints detected."},{"title":"YAML Frontmatter Misidentified as Weak Cryptography","locations":[{"file":"SKILL.md","line_end":3,"line_start":3}],"description":"Static analyzer flagged line 3 as a weak cryptographic algorithm. Line 3 contains YAML frontmatter description metadata, not any cryptographic code. This is a false positive from pattern matching."},{"title":"Coding Guidelines Misidentified as System Reconnaissance","locations":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":87,"line_start":85}],"description":"Static analyzer flagged coding best practice instructions as system reconnaissance. Lines 16 and 85 contain standard Three.js development guidelines about avoiding requestAnimationFrame and using time-based rendering."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":107,"audit_model":"claude","audited_at":"2026-05-14T09:06:56.914+00:00","created_at":"2026-05-14T09:28:10.933496+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"low","confirmedFindingCount":1,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}