{"data":{"skill":{"slug":"internet-court-nansen-general-search","name":"nansen-general-search","icon":"📦","repo":"https://github.com/internet-court/internet-court-skill/tree/main/vendored/nansen/nansen-general-search","status":"approved","author":"internet-court","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"80321cd8-c978-429d-a7d1-6f59af7a0553","skill_id":"20aa9c4c-ed04-49a2-a8c9-64bb26259b09","version":2,"content_hash":"v3:3f6e026a3363e0954ede7bef0cfe88d4475de137:79a30407c906cf713de0889f67d680c426997ea7a5af6eccb6914df9842633f2:d4d427452c7c13518e15dcebf59d019efb024e7b99cf2022bafe9b3d76f7b331:736b696c6c732f696e7465726e65742d636f7572742f6e616e73656e2d67656e6572616c2d736561726368:623d31ce4881d3237889452f5dd99363","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All eight static findings are false positives. The six 'external_commands' hits are the static analyzer misclassifying Markdown code-fence markers and documentation table rows as Ruby/shell backtick execution; the two 'env_access' hits are declarative references to the NANSEN_API_KEY environment variable name in the skill's metadata (requires/primaryEnv), not code that reads or exfiltrates the secret. The skill only documents invocations of a first-party 'nansen' CLI with hardcoded subcommands and no command-injection vector. No prompt injection, data exfiltration, or business-logic abuse was found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":25,"line_start":21},{"file":"SKILL.md","line_end":29,"line_start":25},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":31,"line_start":30},{"file":"SKILL.md","line_end":32,"line_start":31},{"file":"SKILL.md","line_end":34,"line_start":32}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":11,"line_start":11}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":35,"audit_model":"claude","audited_at":"2026-07-21T03:25:54.386+00:00","created_at":"2026-07-21T03:31:19.301005+00:00","static_findings":[{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":25,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":29,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--type` | `token` or `entity` |","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--chain` | Filter by chain |","category":"external_commands","line_end":31,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--limit` | Number of results (default 25, max 50) |","category":"external_commands","line_end":32,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `--fields` | Select specific output fields |","category":"external_commands","line_end":34,"severity":"medium","line_start":32},{"id":"env_access:SKILL.md:8:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- NANSEN_API_KEY","category":"env_access","line_end":8,"severity":"high","line_start":8},{"id":"env_access:SKILL.md:11:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"primaryEnv: NANSEN_API_KEY","category":"env_access","line_end":11,"severity":"high","line_start":11}],"finding_verdicts":[{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"SKILL.md:21 is the opening of a Markdown ```bash code fence documenting example CLI usage, not backtick command execution. Fenced Markdown is inert documentation with no execution semantics.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"SKILL.md:25 is the closing ``` of the documentation code fence. It contains no command and cannot execute anything.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"SKILL.md:29 is a Markdown table row (`| --type | token or entity |`) documenting a CLI flag. The backticks are inline-code formatting for display, not shell execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"SKILL.md:30 is a Markdown table row documenting the `--chain` flag. Backticks are inline-code Markdown formatting, not command execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"SKILL.md:31 is a Markdown table row documenting the `--limit` flag. Backticks are inline-code formatting; no shell or Ruby evaluation occurs.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"SKILL.md:32 is a Markdown table row documenting the `--fields` flag. Backticks are inline-code formatting, not backtick command substitution.","verdict":"false_positive","confidence":0.95},{"id":"env_access:SKILL.md:8:generic-api-secret-keys","reason":"SKILL.md:8 declaratively lists NANSEN_API_KEY under metadata.requires.env to signal the required environment variable. It names the variable but contains no code that reads, prints, or transmits its value.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:11:generic-api-secret-keys","reason":"SKILL.md:11 is `primaryEnv: NANSEN_API_KEY`, a metadata declaration naming the primary credential the CLI expects. It is a variable-name reference for tooling, not access to or exfiltration of the secret value.","verdict":"false_positive","confidence":0.9}],"semantic_findings":[],"subject_marketplace_commit_sha":"3f6e026a3363e0954ede7bef0cfe88d4475de137","subject_content_hash":"79a30407c906cf713de0889f67d680c426997ea7a5af6eccb6914df9842633f2","subject_tree_hash":"d4d427452c7c13518e15dcebf59d019efb024e7b99cf2022bafe9b3d76f7b331","subject_plugin_path":"skills/internet-court/nansen-general-search","audit_payload_hash":"623d31ce4881d3237889452f5dd99363","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3f6e026a3363e0954ede7bef0cfe88d4475de137","contentHash":"79a30407c906cf713de0889f67d680c426997ea7a5af6eccb6914df9842633f2","treeHash":"d4d427452c7c13518e15dcebf59d019efb024e7b99cf2022bafe9b3d76f7b331","pluginPath":"skills/internet-court/nansen-general-search","auditPayloadHash":"623d31ce4881d3237889452f5dd99363"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"unavailable","url":null,"status":null},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"unavailable","verificationState":"not_verified"},"isLatest":true}}