{"data":{"skill":{"slug":"ibelick-baseline-ui","name":"baseline-ui","icon":"📦","repo":"https://github.com/ibelick/ui-skills/tree/main/skills/baseline-ui/","status":"approved","author":"ibelick","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"1a682608-524f-4d09-b028-187218cb8f6f","skill_id":"4b25c915-f9d9-4434-9f08-f6eb4a4333dd","version":6,"content_hash":"v3:c43861a65bb95efcae259cd161c9d6f4dc7eec6f:fea3322f36d58fdafafce2aef56e4556dd2ac7b20876b7dff7d8be7f25fa597f:24fbd798fb76c213e892689845fc32729ffc6641cd1ec3147c1179cf407f9f2f:736b696c6c732f6962656c69636b2f626173656c696e652d7569:dbf80b71b433daa2479a2d4ee909211a","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 30 static findings are false positives caused by Markdown inline code, a documentation hyperlink, and ordinary UI terminology. SKILL.md contains frontend review guidance without executable scripts, network requests, system reconnaissance, credential access, or prompt injection. No semantic security findings were identified.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":74,"line_start":74},{"file":"SKILL.md","line_end":75,"line_start":75}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":33,"line_start":33}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":86,"audit_model":"codex","audited_at":"2026-07-23T18:35:13.89+00:00","created_at":"2026-07-25T11:10:04.05236+00:00","static_findings":[{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/baseline-ui`","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `/baseline-ui <file>`","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- MUST use `motion/react` (formerly `framer-motion`) when JavaScript animation is required","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- SHOULD use `tw-animate-css` for entrance and micro-animations in Tailwind CSS","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- MUST use `cn` utility (`clsx` + `tailwind-merge`) for class logic","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- MUST use accessible component primitives for anything with keyboard or focus behavior (`Base UI`, ","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- SHOULD prefer [`Base UI`](https://base-ui.com/react/components) for new primitives if compatible w","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- MUST add an `aria-label` to icon-only buttons","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- MUST use an `AlertDialog` for destructive or irreversible actions","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- NEVER use `h-screen`, use `h-dvh`","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- MUST respect `safe-area-inset` for fixed elements","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- NEVER block paste in `input` or `textarea` elements","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- MUST animate only compositor props (`transform`, `opacity`)","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- NEVER animate layout properties (`width`, `height`, `top`, `left`, `margin`, `padding`)","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- SHOULD avoid animating paint properties (`background`, `color`) except for small, local UI (text, ","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- SHOULD use `ease-out` on entrance","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- NEVER exceed `200ms` for interaction feedback","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- SHOULD respect `prefers-reduced-motion`","category":"external_commands","line_end":55,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- MUST use `text-balance` for headings and `text-pretty` for body/paragraphs","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- MUST use `tabular-nums` for data","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- SHOULD use `truncate` or `line-clamp` for dense UI","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- NEVER modify `letter-spacing` (`tracking-*`) unless explicitly requested","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- MUST use a fixed `z-index` scale (no arbitrary `z-*`)","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- SHOULD use `size-*` for square elements instead of `w-*` + `h-*`","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- NEVER animate large `blur()` or `backdrop-filter` surfaces","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- NEVER apply `will-change` outside an active animation","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- NEVER use `useEffect` for anything that can be expressed as render logic","category":"external_commands","line_end":75,"severity":"medium","line_start":75},{"id":"network:SKILL.md:33:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- SHOULD prefer [`Base UI`](https://base-ui.com/react/components) for new primitives if compatible w","category":"network","line_end":33,"severity":"low","line_start":33},{"id":"blocker:SKILL.md:51:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- SHOULD avoid animating paint properties (`background`, `color`) except for small, local UI (text, ","category":"blocker","line_end":51,"severity":"low","line_start":51},{"id":"blocker:SKILL.md:57:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- SHOULD avoid animating large images or full-screen surfaces","category":"blocker","line_end":57,"severity":"low","line_start":57}],"finding_verdicts":[{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"The backticks format the slash command `/baseline-ui` as inline Markdown. They do not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The backticks format the documented `/baseline-ui <file>` command as inline Markdown. No executable shell construct is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The backticks identify JavaScript package names in prose. The line contains no command execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The backticks identify a Tailwind animation package in prose. They are Markdown formatting, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks identify utility and package names in a frontend rule. No command or runtime evaluation occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The backticks list accessible component libraries as inline code. The line is design guidance without command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The backticks style the Base UI link label in Markdown. They do not execute the linked text or any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The backticks format the HTML attribute name `aria-label`. No shell or Ruby expression is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The backticks format the component name `AlertDialog`. The line only recommends an accessible UI pattern.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The backticks distinguish two Tailwind height classes. This is styling guidance without executable commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The backticks format a CSS environment variable name. The line does not access the host environment or execute code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The backticks format HTML element names in an accessibility rule. They are not executable expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The backticks format CSS property names in animation guidance. No external process is started.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The backticks enumerate CSS layout properties. This line prohibits costly animation and contains no command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The backticks enumerate CSS paint properties. The content is UI performance guidance, not shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The backticks format the CSS easing value `ease-out`. No runtime command or interpolation exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The backticks format a duration value for interaction feedback. They do not indicate executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The backticks format a CSS media feature name. The line contains no command invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The backticks format Tailwind typography class names. This is frontend styling guidance without external execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The backticks format a Tailwind typography class. No executable statement appears on the line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The backticks format Tailwind text overflow utilities. They are referenced as design choices, not commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The backticks format a CSS property and Tailwind utility prefix. The line provides typography guidance only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The backticks format z-index terminology and a Tailwind class pattern. No external command is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The backticks compare Tailwind sizing utility patterns. They are Markdown code spans without execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The backticks format CSS filter function and property names. The line prohibits expensive animations and executes nothing.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The backticks format the CSS `will-change` property. This is a performance rule without a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The backticks format the React hook name `useEffect`. The line is implementation guidance and cannot start a process.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:33:hardcoded-url","reason":"The URL is a visible Markdown link to Base UI component documentation. The skill does not instruct an agent to fetch it or transmit data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:51:system-reconnaissance","reason":"The line discusses CSS paint properties for animation performance. It contains no host discovery, environment inspection, or reconnaissance instruction.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:57:system-reconnaissance","reason":"The phrase `full-screen surfaces` describes large UI animation areas. It does not request system information or perform reconnaissance.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"c43861a65bb95efcae259cd161c9d6f4dc7eec6f","subject_content_hash":"fea3322f36d58fdafafce2aef56e4556dd2ac7b20876b7dff7d8be7f25fa597f","subject_tree_hash":"24fbd798fb76c213e892689845fc32729ffc6641cd1ec3147c1179cf407f9f2f","subject_plugin_path":"skills/ibelick/baseline-ui","audit_payload_hash":"dbf80b71b433daa2479a2d4ee909211a","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"c43861a65bb95efcae259cd161c9d6f4dc7eec6f","contentHash":"fea3322f36d58fdafafce2aef56e4556dd2ac7b20876b7dff7d8be7f25fa597f","treeHash":"24fbd798fb76c213e892689845fc32729ffc6641cd1ec3147c1179cf407f9f2f","pluginPath":"skills/ibelick/baseline-ui","auditPayloadHash":"dbf80b71b433daa2479a2d4ee909211a"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/ibelick-baseline-ui/audits/6/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}