{"data":{"skill":{"slug":"internet-court-okx-dapp-discovery","name":"okx-dapp-discovery","icon":"πŸ“¦","repo":"https://github.com/internet-court/internet-court-skill/tree/main/vendored/okx/okx-dapp-discovery","status":"approved","author":"internet-court","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"7cf9323c-9f8c-4aad-9986-0a5ef7fe6ce1","skill_id":"68f7fb95-cf57-46c6-b363-f02c3ab266aa","version":1,"content_hash":"ef4111f9b7539c88e14c29962ada2b74","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most static findings are false positives caused by Markdown backticks, DeFi protocol vocabulary, and /dev/null redirection. Real risks remain around package-manager plugin installation, outbound GitHub catalog probing, and downstream binary pre-flight installers that may place executables under hidden home-directory paths.","remediation":[{"issue":"Silent plugin installation expands the trust boundary to downstream plugins.","severity":"high","suggestion":"Require explicit user confirmation before every new plugin install, including the plugin ID, source package, and reason for routing."},{"issue":"Catalog probing uses shell commands and outbound GitHub API access during routing.","severity":"medium","suggestion":"Use a structured plugin registry API provided by the host when available, and avoid shell pipelines for user-derived DApp names."},{"issue":"Downstream plugins may request binary and script installation into hidden PATH locations.","severity":"high","suggestion":"Keep the binary consent gate mandatory, show checksums when available, and never run curl, chmod, ln, or mkdir from plugin pre-flight text without approval."},{"issue":"User-derived DApp names are used in regex-based catalog matching.","severity":"medium","suggestion":"Escape regex metacharacters or use exact structured comparisons after normalizing candidate plugin names."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":6,"line_start":6},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":74,"line_start":74},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":106,"line_start":106},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":123,"line_start":123},{"file":"SKILL.md","line_end":125,"line_start":125},{"file":"SKILL.md","line_end":130,"line_start":130},{"file":"SKILL.md","line_end":134,"line_start":134},{"file":"SKILL.md","line_end":135,"line_start":135},{"file":"SKILL.md","line_end":138,"line_start":138},{"file":"SKILL.md","line_end":163,"line_start":163},{"file":"SKILL.md","line_end":182,"line_start":167},{"file":"SKILL.md","line_end":186,"line_start":182},{"file":"SKILL.md","line_end":186,"line_start":186},{"file":"SKILL.md","line_end":193,"line_start":188},{"file":"SKILL.md","line_end":194,"line_start":193},{"file":"SKILL.md","line_end":196,"line_start":194},{"file":"SKILL.md","line_end":202,"line_start":196},{"file":"SKILL.md","line_end":202,"line_start":202},{"file":"SKILL.md","line_end":204,"line_start":204},{"file":"SKILL.md","line_end":206,"line_start":206},{"file":"SKILL.md","line_end":209,"line_start":209},{"file":"SKILL.md","line_end":211,"line_start":211},{"file":"SKILL.md","line_end":218,"line_start":217},{"file":"SKILL.md","line_end":218,"line_start":218},{"file":"SKILL.md","line_end":228,"line_start":224},{"file":"SKILL.md","line_end":229,"line_start":228},{"file":"SKILL.md","line_end":230,"line_start":229},{"file":"SKILL.md","line_end":231,"line_start":230},{"file":"SKILL.md","line_end":232,"line_start":231},{"file":"SKILL.md","line_end":233,"line_start":232},{"file":"SKILL.md","line_end":234,"line_start":233},{"file":"SKILL.md","line_end":235,"line_start":234},{"file":"SKILL.md","line_end":236,"line_start":235},{"file":"SKILL.md","line_end":237,"line_start":236},{"file":"SKILL.md","line_end":238,"line_start":237},{"file":"SKILL.md","line_end":239,"line_start":238},{"file":"SKILL.md","line_end":240,"line_start":239},{"file":"SKILL.md","line_end":240,"line_start":240}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":279,"line_start":279}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":202,"line_start":202},{"file":"SKILL.md","line_end":204,"line_start":204},{"file":"SKILL.md","line_end":209,"line_start":209},{"file":"SKILL.md","line_end":163,"line_start":163},{"file":"SKILL.md","line_end":195,"line_start":195},{"file":"SKILL.md","line_end":202,"line_start":202},{"file":"SKILL.md","line_end":204,"line_start":204},{"file":"SKILL.md","line_end":209,"line_start":209},{"file":"SKILL.md","line_end":168,"line_start":168},{"file":"SKILL.md","line_end":279,"line_start":279},{"file":"SKILL.md","line_end":280,"line_start":280},{"file":"SKILL.md","line_end":285,"line_start":285},{"file":"SKILL.md","line_end":296,"line_start":296},{"file":"SKILL.md","line_end":204,"line_start":204}]}],"critical_findings":[],"high_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":204,"line_start":204}],"confidence":0.79,"description":"**Step A β€” detect** any of: a `# BINARY_INSTALL:` marker; `curl ... github.com/.*/releases/`; downlo","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line enumerates curl downloads, chmod, launcher scripts, and PATH symlinks as binary installer indicators. It is framed as detection, but confirms a material downstream command-execution risk."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":209,"line_start":209}],"confidence":0.75,"description":"> Plugin: `` v`` Β· Binary: `` Β· Scripts: `launcher.sh`, `update-checker.","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The consent prompt includes release binaries and downloaded scripts that would be installed under the user profile. This is a real executable-content risk even with explicit approval."},{"title":"Hidden file in home directory","locations":[{"file":"SKILL.md","line_end":202,"line_start":202}],"confidence":0.7,"description":"Plugin SKILL.md files often include a \"Pre-flight Dependencies\" section that downloads pre-compiled ","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"This line states that downstream pre-flight installers may place binaries under a hidden path in the user profile. The consent gate mitigates silent execution, but the hidden binary install risk is real."},{"title":"Hidden file in home directory","locations":[{"file":"SKILL.md","line_end":204,"line_start":204}],"confidence":0.82,"description":"**Step A β€” detect** any of: a `# BINARY_INSTALL:` marker; `curl ... github.com/.*/releases/`; downlo","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"This line names hidden PATH installation and symlink indicators for downloaded binaries. It is detection-oriented, but confirms the workflow may encounter high-risk filesystem changes."},{"title":"Hidden file in home directory","locations":[{"file":"SKILL.md","line_end":209,"line_start":209}],"confidence":0.78,"description":"> Plugin: `` v`` Β· Binary: `` Β· Scripts: `launcher.sh`, `update-checker.","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"The consent text identifies installation into ~/.local/bin/.-core. Hidden executable placement under the home directory is a real risk even when disclosed."},{"title":"Symlink creation","locations":[{"file":"SKILL.md","line_end":204,"line_start":204}],"confidence":0.82,"description":"**Step A β€” detect** any of: a `# BINARY_INSTALL:` marker; `curl ... github.com/.*/releases/`; downlo","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"The line references ln -sf into ~/.local/bin or another PATH directory. Creating symlinks to downloaded executables in PATH is a real high-impact filesystem risk."},{"title":"Silent Third-Party Plugin Installation And Prompt Forwarding","locations":[{"file":"SKILL.md","line_end":198,"line_start":188},{"file":"SKILL.md","line_end":296,"line_start":275}],"confidence":0.86,"description":"The skill can install plugins from okx/plugin-store with --yes --global and then immediately forward the original user prompt into the newly loaded plugin. This expands the trust boundary from this router to downstream plugin code and instructions.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The install and forward flow is explicitly documented with npx skills add and immediate re-application of the user request. The catalog-probe fallback can install a discovered plugin without a separate trust review."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":130,"line_start":130}],"confidence":0.68,"description":"Set `TARGET_PLUGIN` from Β§5 and run Β§4 (installed-check β†’ install if needed β†’ read SKILL.md β†’ Binary","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This line directs the agent to run the installation workflow in section 4, which invokes package-manager commands. The exact command is elsewhere, but the routing intent creates a real external-command trust boundary."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":138,"line_start":138}],"confidence":0.74,"description":"Run Β§6 catalog probe (~0.1s). If `-plugin` exists β†’ install + forward. If not β†’ surface th","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This line tells the agent to run the catalog probe and install a matching plugin. That introduces network and package-manager execution beyond passive documentation."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":186,"line_start":186}],"confidence":0.7,"description":"`TARGET_PLUGIN` is set from Β§5. If already in `$INSTALLED_PLUGINS`, skip the installation; otherwise","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The surrounding install section says absent plugins are installed silently. This is a real external-command workflow even though the line itself is descriptive."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":202,"line_start":202}],"confidence":0.66,"description":"Plugin SKILL.md files often include a \"Pre-flight Dependencies\" section that downloads pre-compiled ","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line describes downstream pre-flight steps that download binaries and shell scripts. The later consent gate mitigates it, but the workflow still exposes users to external executable content."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":218,"line_start":218}],"confidence":0.62,"description":"- **Failure mode:** if `npx skills add` fails (network/registry), tell the user: \"I couldn't install","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The failure message instructs the user to run npx skills add manually. It is user-mediated, but still directs external package-manager execution."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":273,"line_start":273}],"confidence":0.72,"description":"Use **only** when the user named a DApp NOT in Β§5 (step 3). For table DApps, set `TARGET_PLUGIN` fro","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This line directs the agent to probe the GitHub Contents API and mentions command-line fallbacks. The workflow performs network access and local command execution."},{"title":"Shell command substitution","locations":[{"file":"SKILL.md","line_end":168,"line_start":168}],"confidence":0.86,"description":"SKILLS_LIST=$(npx skills list 2>/dev/null)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line executes npx through command substitution to list installed skills. It is a bounded command, but it still runs an external package-manager tool."},{"title":"Shell command substitution","locations":[{"file":"SKILL.md","line_end":277,"line_start":277}],"confidence":0.74,"description":"DAPP_LOWER=$(echo \"\" | tr 'A-Z' 'a-z' | tr -d '.')","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line uses shell command substitution to normalize a user-named DApp. It is quoted and simple, but it still executes shell utilities on user-derived text."},{"title":"Shell command substitution","locations":[{"file":"SKILL.md","line_end":280,"line_start":279}],"confidence":0.88,"description":"CATALOG=$(curl -fsSL --max-time 5 \"https://api.github.com/repos/okx/plugin-store/contents/skills\" 2>","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line executes curl and python3 in command substitution to fetch and parse a remote plugin catalog. This is clear network-backed command execution."},{"title":"Shell command substitution","locations":[{"file":"SKILL.md","line_end":284,"line_start":284}],"confidence":0.76,"description":"MATCHES=$(echo \"$CATALOG\" | grep -E \"^${DAPP_LOWER}(-|$)\" || true)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line runs grep against a user-derived plugin prefix. Quoting limits shell injection, but regex behavior can still affect catalog matching."},{"title":"Shell command substitution","locations":[{"file":"SKILL.md","line_end":285,"line_start":285}],"confidence":0.72,"description":"COUNT=$(echo \"$MATCHES\" | grep -c . 2>/dev/null || echo 0)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line executes grep and echo to count matches. It is low complexity, but it is still shell command substitution in the routing flow."},{"title":"Shell command substitution","locations":[{"file":"SKILL.md","line_end":288,"line_start":288}],"confidence":0.7,"description":"1) TARGET_PLUGIN=$(echo \"$MATCHES\" | head -1)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line executes head inside command substitution to choose a plugin match. The selected value later controls installation, so it remains a relevant external-command risk."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":279,"line_start":279}],"confidence":0.9,"description":"CATALOG=$(curl -fsSL --max-time 5 \"https://api.github.com/repos/okx/plugin-store/contents/skills\" 2>","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The catalog probe calls the GitHub API with curl. It does not appear to send secrets, but it is explicit outbound network access during routing."},{"title":"Hidden file access","locations":[{"file":"SKILL.md","line_end":202,"line_start":202}],"confidence":0.66,"description":"Plugin SKILL.md files often include a \"Pre-flight Dependencies\" section that downloads pre-compiled ","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The line describes downstream binary installers that write under hidden user-profile paths. Consent is required later, but the filesystem risk is still present."},{"title":"Hidden file access","locations":[{"file":"SKILL.md","line_end":204,"line_start":204}],"confidence":0.78,"description":"**Step A β€” detect** any of: a `# BINARY_INSTALL:` marker; `curl ... github.com/.*/releases/`; downlo","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The line explicitly references hidden PATH installation and symlink indicators. It is a guardrail, but it confirms sensitive filesystem operations may be part of downstream plugin setup."},{"title":"Hidden file access","locations":[{"file":"SKILL.md","line_end":209,"line_start":209}],"confidence":0.76,"description":"> Plugin: `` v`` Β· Binary: `` Β· Scripts: `launcher.sh`, `update-checker.","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The consent prompt includes the hidden install target ~/.local/bin/.-core. That is a real hidden-file access concern, although it is disclosed to the user."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":3,"total_lines":621,"audit_model":"codex","audited_at":"2026-07-10T00:12:29.471+00:00","created_at":"2026-07-10T07:43:54.312286+00:00","static_findings":[{"id":"blocker:references/keyword-glossary.md:40:system-reconnaissance","file":"references/keyword-glossary.md","pattern":"System reconnaissance","snippet":"| ζˆ‘ζƒ³δΉ°δΈ€δΊ› HYPE 代币 / δΉ° HYPE / δΉ°δΈ€δΊ› HYPE / 捒 HYPE / 把 USDC ε­˜θΏ› HLP / 存 HLP / HLP ζ”Άη›Š | Hyperliquid β†’ `hyper","category":"blocker","line_end":40,"severity":"low","line_start":40},{"id":"blocker:references/keyword-glossary.md:41:system-reconnaissance","file":"references/keyword-glossary.md","pattern":"System reconnaissance","snippet":"| εˆηΊ¦δΊ€ζ˜“ / 永续合约 (no Hyperliquid named) | clarify (50–74) β€” ask \"Are you looking to trade on Hyperliqui","category":"blocker","line_end":41,"severity":"low","line_start":41},{"id":"blocker:references/keyword-glossary.md:95:system-reconnaissance","file":"references/keyword-glossary.md","pattern":"System reconnaissance","snippet":"| 做倚 N倍 / 做空 N倍 / ζ°Έη»­ / 合约 | Hyperliquid |","category":"blocker","line_end":95,"severity":"low","line_start":95},{"id":"blocker:references/protocol-keywords.md:34:system-reconnaissance","file":"references/protocol-keywords.md","pattern":"System reconnaissance","snippet":"### Hyperliquid DEX β†’ `hyperliquid-plugin`","category":"blocker","line_end":34,"severity":"low","line_start":34},{"id":"blocker:references/protocol-keywords.md:127:system-reconnaissance","file":"references/protocol-keywords.md","pattern":"System reconnaissance","snippet":"**Do not install for:** generic \"Arbitrum perps\" / \"Avalanche perps\" (ZH: glossary Β§3) without GMX n","category":"blocker","line_end":127,"severity":"low","line_start":127},{"id":"blocker:references/protocol-keywords.md:145:system-reconnaissance","file":"references/protocol-keywords.md","pattern":"System reconnaissance","snippet":"**β‰₯ 75:** ether.fi, etherfi, eETH, weETH, ether.fi stake, ether.fi restake, ether.fi liquid staking,","category":"blocker","line_end":145,"severity":"low","line_start":145},{"id":"external_commands:SKILL.md:6:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Fires on: (1) named DApp + action verb (swap/deposit/stake/long/borrow/buy/sell/snipe/farm/claim, EN","category":"external_commands","line_end":6,"severity":"medium","line_start":6},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **References:** Β§2's native-token table is the routing-critical minimum β€” full per-protocol β‰₯75 / ","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Polymarket UpDown / prediction-market intent** β€” ` 5min updown`, `prediction market`, `pl","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **pump.fun WRITE intent** β€” buy/sell/snipe/ape/swap on a pump.fun token/address (ZH: glossary Β§5)","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **pump.fun READ intent** β€” dev history, bundle/sniper detection (the noun), who aped, similar toke","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Generic verbs alone** (deposit/stake/borrow/swap/yield/APY) **without** a DApp name **and withou","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Unnamed swap β†’ `okx-agentic-wallet`. Generic yield discovery β†’ `okx-defi`. Price/chart/PnL β†’ `okx-de","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Meteora DLMM, Meteora bin/vault/DAMM (`MET` alone too generic β€” needs \"Meteora\") | Meteora |","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Full per-protocol β‰₯75 / 50–74 / do-not-install keyword expansion: `references/protocol-keywords.md` ","category":"external_commands","line_end":84,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"EN: `what do you think`, `which is better`, `vs`, `compare`, `comparison`, `differences`, `tradeoffs","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **User-facing language β€” IMPORTANT.** Tiers, scores, \"confidence\", \"Top-5\", and this framework are","category":"external_commands","line_end":94,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Yes (123)** β†’ a named DApp / native token **beats every generic verb** (swap/stake/lend/borrow/d","category":"external_commands","line_end":104,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**(a) swap-pair carve-out** β€” when the verb is a market-side DEX verb (`swap`/`exchange`/`sell`; ZH:","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| β†’ `okx-agentic-wallet` (carve-out) | β†’ install the protocol (step 1) |","category":"external_commands","line_end":108,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"*Heuristic:* **acquiring** a native token via market (`swap ... for/to `) or **disposing** o","category":"external_commands","line_end":119,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**(c) pump.fun split** β€” READ/analytical intent β†’ `okx-dex` (stop); WRITE/trade intent β†’ `pump-fun-p","category":"external_commands","line_end":123,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**(d) out-of-scope variant guard** β€” if the matched DApp carries an out-of-scope signal per its Β§5 N","category":"external_commands","line_end":125,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Set `TARGET_PLUGIN` from Β§5 and run Β§4 (installed-check β†’ install if needed β†’ read SKILL.md β†’ Binary","category":"external_commands","line_end":130,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- An action verb (Β§2 / glossary Β§2/Β§6) clearly targets one DApp β†’ that DApp β†’ go to step 1. *(An act","category":"external_commands","line_end":134,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Only comparison/discussion, no action verb** β†’ do NOT install; ask one question: *\"Want me to se","category":"external_commands","line_end":135,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run Β§6 catalog probe (~0.1s). If `-plugin` exists β†’ install + forward. If not β†’ surface th","category":"external_commands","line_end":138,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Path note (once):** the `Read ... $HOME/.claude/skills/` paths below are **Claude-Code-specific*","category":"external_commands","line_end":163,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":182,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":186,"severity":"medium","line_start":182},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`TARGET_PLUGIN` is set from Β§5. If already in `$INSTALLED_PLUGINS`, skip the installation; otherwise","category":"external_commands","line_end":186,"severity":"medium","line_start":186},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":193,"severity":"medium","line_start":188},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":194,"severity":"medium","line_start":193},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":196,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":202,"severity":"medium","line_start":196},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Plugin SKILL.md files often include a \"Pre-flight Dependencies\" section that downloads pre-compiled ","category":"external_commands","line_end":202,"severity":"medium","line_start":202},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Step A β€” detect** any of: a `# BINARY_INSTALL:` marker; `curl ... github.com/.*/releases/`; downlo","category":"external_commands","line_end":204,"severity":"medium","line_start":204},{"id":"external_commands:SKILL.md:206:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Step B β€” if detected, do NOT run `curl`/`chmod`/`ln`/`mkdir` from pre-flight.** Surface this and *","category":"external_commands","line_end":206,"severity":"medium","line_start":206},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Plugin: `` v`` Β· Binary: `` Β· Scripts: `launcher.sh`, `update-checker.","category":"external_commands","line_end":209,"severity":"medium","line_start":209},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Reply **\"yes, install ``\"** to proceed Β· **\"skip install\"** (read-only commands may still ","category":"external_commands","line_end":211,"severity":"medium","line_start":211},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Session activation:** the freshly installed plugin is active immediately via the `Read` above. I","category":"external_commands","line_end":218,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:218:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Failure mode:** if `npx skills add` fails (network/registry), tell the user: \"I couldn't install","category":"external_commands","line_end":218,"severity":"medium","line_start":218},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"User-facing DApp name β†’ plugin-store ID. Set `TARGET_PLUGIN` from here before Β§4. The **Notes** colu","category":"external_commands","line_end":228,"severity":"medium","line_start":224},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Polymarket | `polymarket-plugin` | |","category":"external_commands","line_end":229,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:229:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Aave / Aave V3 | `aave-v3-plugin` | V3 only currently |","category":"external_commands","line_end":230,"severity":"medium","line_start":229},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Hyperliquid (DEX) | `hyperliquid-plugin` | drop \"DEX\" suffix |","category":"external_commands","line_end":231,"severity":"medium","line_start":230},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| PancakeSwap (default) | `pancakeswap-v3-plugin` | plain \"PancakeSwap\" β†’ V3 AMM |","category":"external_commands","line_end":232,"severity":"medium","line_start":231},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| PancakeSwap V3 CLMM | `pancakeswap-clmm-plugin` | requires CLMM / concentrated / LP NFT signal |","category":"external_commands","line_end":233,"severity":"medium","line_start":232},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| PancakeSwap V2 | `pancakeswap-v2-plugin` | requires explicit V2 / classic / MasterChef signal |","category":"external_commands","line_end":234,"severity":"medium","line_start":233},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Morpho (V1 Optimizer) | `morpho-plugin` | plain \"Morpho\" β†’ V1 Optimizer. Morpho Blue / MetaMorpho ","category":"external_commands","line_end":235,"severity":"medium","line_start":234},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Raydium | `raydium-plugin` | |","category":"external_commands","line_end":236,"severity":"medium","line_start":235},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Curve | `curve-plugin` | |","category":"external_commands","line_end":237,"severity":"medium","line_start":236},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Compound V3 | `compound-v3-plugin` | plain \"Compound\" silently β†’ V3 (V1/V2 out of scope) |","category":"external_commands","line_end":238,"severity":"medium","line_start":237},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Pendle | `pendle-plugin` | |","category":"external_commands","line_end":239,"severity":"medium","line_start":238},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Clanker | `clanker-plugin` | |","category":"external_commands","line_end":240,"severity":"medium","line_start":239},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| pump.fun (trade) | `pump-fun-plugin` | dot β†’ hyphen; analysis verbs β†’ `okx-dex` |","category":"external_commands","line_end":240,"severity":"medium","line_start":240},{"id":"external_commands:SKILL.md:241:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Lido | `lido-plugin` | |","category":"external_commands","line_end":242,"severity":"medium","line_start":241},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| GMX V2 | `gmx-v2-plugin` | plain \"GMX\" silently β†’ V2 (V1 out of scope) |","category":"external_commands","line_end":243,"severity":"medium","line_start":242},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| ether.fi (Stake) | `etherfi-plugin` | drop the dot |","category":"external_commands","line_end":244,"severity":"medium","line_start":243},{"id":"external_commands:SKILL.md:244:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Kamino Lend | `kamino-lend-plugin` | plain \"Kamino\" β†’ Lend |","category":"external_commands","line_end":245,"severity":"medium","line_start":244},{"id":"external_commands:SKILL.md:245:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Kamino Liquidity | `kamino-liquidity-plugin` | requires explicit \"Liquidity\" / \"DLMM\" / \"CLMM\" / \"","category":"external_commands","line_end":246,"severity":"medium","line_start":245},{"id":"external_commands:SKILL.md:246:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Orca | `orca-plugin` | |","category":"external_commands","line_end":247,"severity":"medium","line_start":246},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Meteora (DLMM) | `meteora-plugin` | |","category":"external_commands","line_end":249,"severity":"medium","line_start":247},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Fallthrough (DApp named but NOT in this table):** apply Β§6 (catalog probe). If a `-plugi","category":"external_commands","line_end":249,"severity":"medium","line_start":249},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> For best-yield-across-protocols, rebalancing, or claiming rewards, `okx-defi` (OKX-aggregated DeFi","category":"external_commands","line_end":267,"severity":"medium","line_start":267},{"id":"external_commands:SKILL.md:273:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use **only** when the user named a DApp NOT in Β§5 (step 3). For table DApps, set `TARGET_PLUGIN` fro","category":"external_commands","line_end":273,"severity":"medium","line_start":273},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":302,"severity":"medium","line_start":275},{"id":"external_commands:SKILL.md:302:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":304,"severity":"medium","line_start":302},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**On probe failure** (`TARGET_PLUGIN=\"\"`, count 0) β€” do NOT silently fall through. Surface clearly:","category":"external_commands","line_end":306,"severity":"medium","line_start":304},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Name the specific DApp and that no `-plugin` exists yet.","category":"external_commands","line_end":309,"severity":"medium","line_start":306},{"id":"external_commands:SKILL.md:309:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. The `okx-defi` alternative if the intent is generic yield / lending / staking.","category":"external_commands","line_end":312,"severity":"medium","line_start":309},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Example: \"I checked the plugin-store catalog and there's no `foo-plugin` yet. The closest supporte","category":"external_commands","line_end":312,"severity":"medium","line_start":312},{"id":"external_commands:SKILL.md:168:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"SKILLS_LIST=$(npx skills list 2>/dev/null)","category":"external_commands","line_end":168,"severity":"medium","line_start":168},{"id":"external_commands:SKILL.md:277:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"DAPP_LOWER=$(echo \"\" | tr 'A-Z' 'a-z' | tr -d '.')","category":"external_commands","line_end":277,"severity":"medium","line_start":277},{"id":"external_commands:SKILL.md:279:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"CATALOG=$(curl -fsSL --max-time 5 \"https://api.github.com/repos/okx/plugin-store/contents/skills\" 2>","category":"external_commands","line_end":280,"severity":"medium","line_start":279},{"id":"external_commands:SKILL.md:284:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"MATCHES=$(echo \"$CATALOG\" | grep -E \"^${DAPP_LOWER}(-|$)\" || true)","category":"external_commands","line_end":284,"severity":"medium","line_start":284},{"id":"external_commands:SKILL.md:285:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"COUNT=$(echo \"$MATCHES\" | grep -c . 2>/dev/null || echo 0)","category":"external_commands","line_end":285,"severity":"medium","line_start":285},{"id":"external_commands:SKILL.md:288:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"1) TARGET_PLUGIN=$(echo \"$MATCHES\" | head -1)","category":"external_commands","line_end":288,"severity":"medium","line_start":288},{"id":"external_commands:SKILL.md:167:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"```bash","category":"external_commands","line_end":182,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:275:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"```bash","category":"external_commands","line_end":302,"severity":"medium","line_start":275},{"id":"network:SKILL.md:11:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://web3.okx.com\"","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:SKILL.md:279:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"CATALOG=$(curl -fsSL --max-time 5 \"https://api.github.com/repos/okx/plugin-store/contents/skills\" 2>","category":"network","line_end":279,"severity":"low","line_start":279},{"id":"filesystem:SKILL.md:202:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"Plugin SKILL.md files often include a \"Pre-flight Dependencies\" section that downloads pre-compiled ","category":"filesystem","line_end":202,"severity":"high","line_start":202},{"id":"filesystem:SKILL.md:204:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"**Step A β€” detect** any of: a `# BINARY_INSTALL:` marker; `curl ... github.com/.*/releases/`; downlo","category":"filesystem","line_end":204,"severity":"high","line_start":204},{"id":"filesystem:SKILL.md:209:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"> Plugin: `` v`` Β· Binary: `` Β· Scripts: `launcher.sh`, `update-checker.","category":"filesystem","line_end":209,"severity":"high","line_start":209},{"id":"filesystem:SKILL.md:163:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"> **Path note (once):** the `Read ... $HOME/.claude/skills/` paths below are **Claude-Code-specific*","category":"filesystem","line_end":163,"severity":"medium","line_start":163},{"id":"filesystem:SKILL.md:195:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"Read file: $HOME/.claude/skills//SKILL.md","category":"filesystem","line_end":195,"severity":"medium","line_start":195},{"id":"filesystem:SKILL.md:202:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"Plugin SKILL.md files often include a \"Pre-flight Dependencies\" section that downloads pre-compiled ","category":"filesystem","line_end":202,"severity":"medium","line_start":202},{"id":"filesystem:SKILL.md:204:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"**Step A β€” detect** any of: a `# BINARY_INSTALL:` marker; `curl ... github.com/.*/releases/`; downlo","category":"filesystem","line_end":204,"severity":"medium","line_start":204},{"id":"filesystem:SKILL.md:209:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"> Plugin: `` v`` Β· Binary: `` Β· Scripts: `launcher.sh`, `update-checker.","category":"filesystem","line_end":209,"severity":"medium","line_start":209},{"id":"filesystem:SKILL.md:168:standard-device-file-access","file":"SKILL.md","pattern":"Standard device file access","snippet":"SKILLS_LIST=$(npx skills list 2>/dev/null)","category":"filesystem","line_end":168,"severity":"low","line_start":168},{"id":"filesystem:SKILL.md:279:standard-device-file-access","file":"SKILL.md","pattern":"Standard device file access","snippet":"CATALOG=$(curl -fsSL --max-time 5 \"https://api.github.com/repos/okx/plugin-store/contents/skills\" 2>","category":"filesystem","line_end":279,"severity":"low","line_start":279},{"id":"filesystem:SKILL.md:280:standard-device-file-access","file":"SKILL.md","pattern":"Standard device file access","snippet":"| python3 -c \"import sys,json; print('\\n'.join(p['name'] for p in json.load(sys.stdin)))\" 2>/dev/nul","category":"filesystem","line_end":280,"severity":"low","line_start":280},{"id":"filesystem:SKILL.md:285:standard-device-file-access","file":"SKILL.md","pattern":"Standard device file access","snippet":"COUNT=$(echo \"$MATCHES\" | grep -c . 2>/dev/null || echo 0)","category":"filesystem","line_end":285,"severity":"low","line_start":285},{"id":"filesystem:SKILL.md:296:standard-device-file-access","file":"SKILL.md","pattern":"Standard device file access","snippet":"if npx skills add okx/plugin-store --skill \"${DAPP_LOWER}-plugin\" --yes --global 2>/dev/null; then","category":"filesystem","line_end":296,"severity":"low","line_start":296},{"id":"filesystem:SKILL.md:204:symlink-creation","file":"SKILL.md","pattern":"Symlink creation","snippet":"**Step A β€” detect** any of: a `# BINARY_INSTALL:` marker; `curl ... github.com/.*/releases/`; downlo","category":"filesystem","line_end":204,"severity":"high","line_start":204},{"id":"blocker:SKILL.md:68:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| HYPE, HLP | Hyperliquid |","category":"blocker","line_end":68,"severity":"low","line_start":68},{"id":"blocker:SKILL.md:156:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Multiple matches** β†’ install the highest; tiebreaker order **Polymarket > Aave > Hyperliquid > P","category":"blocker","line_end":156,"severity":"low","line_start":156},{"id":"blocker:SKILL.md:157:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **0 matches** (action outside Top-5 coverage β€” Solana DEX, liquid staking, PT/YT, meme launchpad) ","category":"blocker","line_end":157,"severity":"low","line_start":157},{"id":"blocker:SKILL.md:230:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Hyperliquid (DEX) | `hyperliquid-plugin` | drop \"DEX\" suffix |","category":"blocker","line_end":230,"severity":"low","line_start":230},{"id":"blocker:SKILL.md:263:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"> | Liquid staking | **Lido**, **ether.fi** |","category":"blocker","line_end":263,"severity":"low","line_start":263},{"id":"blocker:SKILL.md:308:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"3. **Closest siblings by inferred category** β€” lending-shaped β†’ Aave V3 / Compound V3 / Morpho; Sola","category":"blocker","line_end":308,"severity":"low","line_start":308}],"finding_verdicts":[{"id":"blocker:references/keyword-glossary.md:40:system-reconnaissance","reason":"This is DeFi protocol, token, or routing vocabulary, not host or network reconnaissance. The text is used to choose a plugin and does not inspect the local system.","verdict":"false_positive","confidence":0.94},{"id":"blocker:references/keyword-glossary.md:41:system-reconnaissance","reason":"This is DeFi protocol, token, or routing vocabulary, not host or network reconnaissance. The text is used to choose a plugin and does not inspect the local system.","verdict":"false_positive","confidence":0.94},{"id":"blocker:references/keyword-glossary.md:95:system-reconnaissance","reason":"This is DeFi protocol, token, or routing vocabulary, not host or network reconnaissance. The text is used to choose a plugin and does not inspect the local system.","verdict":"false_positive","confidence":0.94},{"id":"blocker:references/protocol-keywords.md:34:system-reconnaissance","reason":"This is DeFi protocol, token, or routing vocabulary, not host or network reconnaissance. The text is used to choose a plugin and does not inspect the local system.","verdict":"false_positive","confidence":0.94},{"id":"blocker:references/protocol-keywords.md:127:system-reconnaissance","reason":"This is DeFi protocol, token, or routing vocabulary, not host or network reconnaissance. The text is used to choose a plugin and does not inspect the local system.","verdict":"false_positive","confidence":0.94},{"id":"blocker:references/protocol-keywords.md:145:system-reconnaissance","reason":"This is DeFi protocol, token, or routing vocabulary, not host or network reconnaissance. The text is used to choose a plugin and does not inspect the local system.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:6:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"This line directs the agent to run the installation workflow in section 4, which invokes package-manager commands. The exact command is elsewhere, but the routing intent creates a real external-command trust boundary.","verdict":"confirmed","severity":"medium","confidence":0.68},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"This line tells the agent to run the catalog probe and install a matching plugin. That introduces network and package-manager execution beyond passive documentation.","verdict":"confirmed","severity":"medium","confidence":0.74},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","reason":"The surrounding install section says absent plugins are installed silently. This is a real external-command workflow even though the line itself is descriptive.","verdict":"confirmed","severity":"medium","confidence":0.7},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","reason":"The line describes downstream pre-flight steps that download binaries and shell scripts. The later consent gate mitigates it, but the workflow still exposes users to external executable content.","verdict":"confirmed","severity":"medium","confidence":0.66},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","reason":"The line enumerates curl downloads, chmod, launcher scripts, and PATH symlinks as binary installer indicators. It is framed as detection, but confirms a material downstream command-execution risk.","verdict":"confirmed","severity":"high","confidence":0.79},{"id":"external_commands:SKILL.md:206:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","reason":"The consent prompt includes release binaries and downloaded scripts that would be installed under the user profile. This is a real executable-content risk even with explicit approval.","verdict":"confirmed","severity":"high","confidence":0.75},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:218:ruby-shell-backtick-execution","reason":"The failure message instructs the user to run npx skills add manually. It is user-mediated, but still directs external package-manager execution.","verdict":"confirmed","severity":"medium","confidence":0.62},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:229:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:241:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:244:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:245:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:246:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:273:ruby-shell-backtick-execution","reason":"This line directs the agent to probe the GitHub Contents API and mentions command-line fallbacks. The workflow performs network access and local command execution.","verdict":"confirmed","severity":"medium","confidence":0.72},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:302:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:309:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:168:shell-command-substitution","reason":"The line executes npx through command substitution to list installed skills. It is a bounded command, but it still runs an external package-manager tool.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"external_commands:SKILL.md:277:shell-command-substitution","reason":"The line uses shell command substitution to normalize a user-named DApp. It is quoted and simple, but it still executes shell utilities on user-derived text.","verdict":"confirmed","severity":"medium","confidence":0.74},{"id":"external_commands:SKILL.md:279:shell-command-substitution","reason":"The line executes curl and python3 in command substitution to fetch and parse a remote plugin catalog. This is clear network-backed command execution.","verdict":"confirmed","severity":"medium","confidence":0.88},{"id":"external_commands:SKILL.md:284:shell-command-substitution","reason":"The line runs grep against a user-derived plugin prefix. Quoting limits shell injection, but regex behavior can still affect catalog matching.","verdict":"confirmed","severity":"medium","confidence":0.76},{"id":"external_commands:SKILL.md:285:shell-command-substitution","reason":"The line executes grep and echo to count matches. It is low complexity, but it is still shell command substitution in the routing flow.","verdict":"confirmed","severity":"medium","confidence":0.72},{"id":"external_commands:SKILL.md:288:shell-command-substitution","reason":"The line executes head inside command substitution to choose a plugin match. The selected value later controls installation, so it remains a relevant external-command risk.","verdict":"confirmed","severity":"medium","confidence":0.7},{"id":"external_commands:SKILL.md:167:template-literal-with-command-substitution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:275:template-literal-with-command-substitution","reason":"The match is Markdown inline code, a code-fence marker, or a plugin name used as documentation. It is not executable shell syntax at this location.","verdict":"false_positive","confidence":0.91},{"id":"network:SKILL.md:11:hardcoded-url","reason":"This is a static homepage URL in metadata, not a runtime network request or data transfer.","verdict":"false_positive","confidence":0.95},{"id":"network:SKILL.md:279:hardcoded-url","reason":"The catalog probe calls the GitHub API with curl. It does not appear to send secrets, but it is explicit outbound network access during routing.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"filesystem:SKILL.md:202:hidden-file-in-home-directory","reason":"This line states that downstream pre-flight installers may place binaries under a hidden path in the user profile. The consent gate mitigates silent execution, but the hidden binary install risk is real.","verdict":"confirmed","severity":"high","confidence":0.7},{"id":"filesystem:SKILL.md:204:hidden-file-in-home-directory","reason":"This line names hidden PATH installation and symlink indicators for downloaded binaries. It is detection-oriented, but confirms the workflow may encounter high-risk filesystem changes.","verdict":"confirmed","severity":"high","confidence":0.82},{"id":"filesystem:SKILL.md:209:hidden-file-in-home-directory","reason":"The consent text identifies installation into ~/.local/bin/.-core. Hidden executable placement under the home directory is a real risk even when disclosed.","verdict":"confirmed","severity":"high","confidence":0.78},{"id":"filesystem:SKILL.md:163:hidden-file-access","reason":"This usage is either documentation for an agent skill path or stderr redirection to /dev/null. It does not read secrets, modify protected files, or create persistent artifacts.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:195:hidden-file-access","reason":"This usage is either documentation for an agent skill path or stderr redirection to /dev/null. It does not read secrets, modify protected files, or create persistent artifacts.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:202:hidden-file-access","reason":"The line describes downstream binary installers that write under hidden user-profile paths. Consent is required later, but the filesystem risk is still present.","verdict":"confirmed","severity":"medium","confidence":0.66},{"id":"filesystem:SKILL.md:204:hidden-file-access","reason":"The line explicitly references hidden PATH installation and symlink indicators. It is a guardrail, but it confirms sensitive filesystem operations may be part of downstream plugin setup.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"filesystem:SKILL.md:209:hidden-file-access","reason":"The consent prompt includes the hidden install target ~/.local/bin/.-core. That is a real hidden-file access concern, although it is disclosed to the user.","verdict":"confirmed","severity":"medium","confidence":0.76},{"id":"filesystem:SKILL.md:168:standard-device-file-access","reason":"This usage is either documentation for an agent skill path or stderr redirection to /dev/null. It does not read secrets, modify protected files, or create persistent artifacts.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:279:standard-device-file-access","reason":"This usage is either documentation for an agent skill path or stderr redirection to /dev/null. It does not read secrets, modify protected files, or create persistent artifacts.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:280:standard-device-file-access","reason":"This usage is either documentation for an agent skill path or stderr redirection to /dev/null. It does not read secrets, modify protected files, or create persistent artifacts.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:285:standard-device-file-access","reason":"This usage is either documentation for an agent skill path or stderr redirection to /dev/null. It does not read secrets, modify protected files, or create persistent artifacts.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:296:standard-device-file-access","reason":"This usage is either documentation for an agent skill path or stderr redirection to /dev/null. It does not read secrets, modify protected files, or create persistent artifacts.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:204:symlink-creation","reason":"The line references ln -sf into ~/.local/bin or another PATH directory. Creating symlinks to downloaded executables in PATH is a real high-impact filesystem risk.","verdict":"confirmed","severity":"high","confidence":0.82},{"id":"blocker:SKILL.md:68:system-reconnaissance","reason":"This is DeFi protocol, token, or routing vocabulary, not host or network reconnaissance. The text is used to choose a plugin and does not inspect the local system.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:156:system-reconnaissance","reason":"This is DeFi protocol, token, or routing vocabulary, not host or network reconnaissance. The text is used to choose a plugin and does not inspect the local system.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:157:system-reconnaissance","reason":"This is DeFi protocol, token, or routing vocabulary, not host or network reconnaissance. The text is used to choose a plugin and does not inspect the local system.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:230:system-reconnaissance","reason":"This is DeFi protocol, token, or routing vocabulary, not host or network reconnaissance. The text is used to choose a plugin and does not inspect the local system.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:263:system-reconnaissance","reason":"This is DeFi protocol, token, or routing vocabulary, not host or network reconnaissance. The text is used to choose a plugin and does not inspect the local system.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:308:system-reconnaissance","reason":"This is DeFi protocol, token, or routing vocabulary, not host or network reconnaissance. The text is used to choose a plugin and does not inspect the local system.","verdict":"false_positive","confidence":0.94}],"semantic_findings":[{"title":"Silent Third-Party Plugin Installation And Prompt Forwarding","severity":"high","locations":[{"file":"SKILL.md","line_end":198,"line_start":188},{"file":"SKILL.md","line_end":296,"line_start":275}],"confidence":0.86,"description":"The skill can install plugins from okx/plugin-store with --yes --global and then immediately forward the original user prompt into the newly loaded plugin. This expands the trust boundary from this router to downstream plugin code and instructions.","confidence_reasoning":"The install and forward flow is explicitly documented with npx skills add and immediate re-application of the user request. The catalog-probe fallback can install a discovered plugin without a separate trust review."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":22,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}