{"data":{"skill":{"slug":"inferen-sh-chat-ui","name":"chat-ui","icon":"📦","repo":"https://github.com/inferen-sh/skills/tree/main/ui/chat-ui/","status":"approved","author":"inferen-sh","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"889393bd-b4f1-46ec-9d77-f4abd633a521","skill_id":"b388cbe6-e751-4cc3-9ae6-7c3ef9287866","version":1,"content_hash":"cb34956472373de9ced38d635150cb64","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analyzer flagged 28 patterns that are all false positives. Markdown code block delimiters (```) were incorrectly detected as shell backtick execution. URLs are documentation links, not runtime network calls. No cryptographic code exists. This is a legitimate React UI component library documentation file with no security concerns.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":131,"line_start":14}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":139,"line_start":8}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"False Positive: Markdown Code Block Delimiters","locations":[{"file":"SKILL.md","line_end":131,"line_start":14}],"description":"Static analyzer detected 'Ruby/shell backtick execution' but these are Markdown code fence delimiters (```bash, ```tsx) used for documentation, not shell execution backticks. No command injection risk exists."}],"low_findings":[{"title":"False Positive: Documentation URLs","locations":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":139,"line_start":135}],"description":"Hardcoded URLs detected are documentation and CDN links in markdown content (ui.inference.sh, inference.sh). These are reference links for users, not runtime network requests made by code."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":141,"audit_model":"claude","audited_at":"2026-03-21T08:13:53.07+00:00","created_at":"2026-03-21T08:45:29.396255+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":2,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}