{"data":{"skill":{"slug":"internet-court-openserv-ideaboard-api","name":"openserv-ideaboard-api","icon":"📦","repo":"https://github.com/internet-court/internet-court-skill/tree/main/vendored/openserv/openserv-ideaboard-api","status":"approved","author":"internet-court","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"a7e53638-cb82-4273-8aa0-7d102d3bea6f","skill_id":"36231982-5d50-4d2c-bdc8-1a19616e159c","version":2,"content_hash":"v3:3f6e026a3363e0954ede7bef0cfe88d4475de137:70d132a2be77d1bcc140422d851d2a868052b191b9bd62ffa68f2473b314e867:921d23c1927c090f69f168d14317a1b25456fd468e12adfd9760948b45b44556:736b696c6c732f696e7465726e65742d636f7572742f6f70656e736572762d69646561626f6172642d617069:b4873aff76a24f3753b68626961b15ef","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most static alerts are false positives caused by Markdown fences, JavaScript template literals, expected API calls, and documented credential configuration. Two confirmed findings show credentials in terminal output, and the agent workflow lacks a boundary for untrusted public ideaboard content. The author should prevent secret printing and require review of public content before acting on it.","remediation":[{"issue":"The API-key example prints a newly issued API key to standard output.","severity":"high","suggestion":"Do not print the full API key. Write it to a user-controlled secure secret store or display only a masked confirmation with explicit copy guidance."},{"issue":"The API-key example prints a generated wallet private key to standard output.","severity":"high","suggestion":"Do not generate or print wallet private keys by default. Require a preconfigured dedicated wallet or save generated material only through an explicit secure storage flow."},{"issue":"Public idea descriptions and comments can be treated as instructions by an agent.","severity":"high","suggestion":"Add explicit guidance to treat all Ideaboard content as untrusted data, ignore embedded instructions, and require user approval before actions with side effects."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"examples/browse-ideas.ts","line_end":25,"line_start":25},{"file":"examples/browse-ideas.ts","line_end":27,"line_start":27},{"file":"examples/browse-ideas.ts","line_end":28,"line_start":28},{"file":"examples/browse-ideas.ts","line_end":30,"line_start":30},{"file":"examples/browse-ideas.ts","line_end":42,"line_start":42},{"file":"examples/browse-ideas.ts","line_end":48,"line_start":48},{"file":"examples/browse-ideas.ts","line_end":50,"line_start":50},{"file":"examples/browse-ideas.ts","line_end":52,"line_start":52},{"file":"examples/browse-ideas.ts","line_end":53,"line_start":53},{"file":"examples/browse-ideas.ts","line_end":54,"line_start":54},{"file":"examples/browse-ideas.ts","line_end":57,"line_start":57},{"file":"examples/browse-ideas.ts","line_end":59,"line_start":59},{"file":"examples/browse-ideas.ts","line_end":61,"line_start":61},{"file":"examples/browse-ideas.ts","line_end":74,"line_start":74},{"file":"examples/get-api-key.ts","line_end":26,"line_start":26},{"file":"examples/get-api-key.ts","line_end":62,"line_start":62},{"file":"examples/get-api-key.ts","line_end":65,"line_start":65},{"file":"examples/pick-up-and-ship.ts","line_end":44,"line_start":44},{"file":"examples/pick-up-and-ship.ts","line_end":53,"line_start":53},{"file":"examples/pick-up-and-ship.ts","line_end":57,"line_start":57},{"file":"examples/pick-up-and-ship.ts","line_end":64,"line_start":64},{"file":"examples/pick-up-and-ship.ts","line_end":65,"line_start":65},{"file":"examples/pick-up-and-ship.ts","line_end":66,"line_start":66},{"file":"examples/pick-up-and-ship.ts","line_end":75,"line_start":75},{"file":"examples/pick-up-and-ship.ts","line_end":76,"line_start":76},{"file":"examples/pick-up-and-ship.ts","line_end":81,"line_start":81},{"file":"examples/pick-up-and-ship.ts","line_end":107,"line_start":107},{"file":"examples/pick-up-and-ship.ts","line_end":108,"line_start":108},{"file":"examples/submit-idea.ts","line_end":44,"line_start":35},{"file":"examples/submit-idea.ts","line_end":49,"line_start":49},{"file":"examples/submit-idea.ts","line_end":50,"line_start":50},{"file":"examples/submit-idea.ts","line_end":56,"line_start":56},{"file":"examples/submit-idea.ts","line_end":57,"line_start":57},{"file":"examples/submit-idea.ts","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":40,"line_start":38},{"file":"SKILL.md","line_end":44,"line_start":40},{"file":"SKILL.md","line_end":46,"line_start":44},{"file":"SKILL.md","line_end":59,"line_start":46},{"file":"SKILL.md","line_end":90,"line_start":59},{"file":"SKILL.md","line_end":92,"line_start":90},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":111,"line_start":98},{"file":"SKILL.md","line_end":112,"line_start":111},{"file":"SKILL.md","line_end":116,"line_start":112},{"file":"SKILL.md","line_end":118,"line_start":116}]},{"factor":"network","evidence":[{"file":"examples/browse-ideas.ts","line_end":12,"line_start":12},{"file":"examples/browse-ideas.ts","line_end":14,"line_start":14},{"file":"examples/browse-ideas.ts","line_end":15,"line_start":15},{"file":"examples/get-api-key.ts","line_end":14,"line_start":14},{"file":"examples/get-api-key.ts","line_end":18,"line_start":18},{"file":"examples/get-api-key.ts","line_end":19,"line_start":19},{"file":"examples/get-api-key.ts","line_end":42,"line_start":42},{"file":"examples/pick-up-and-ship.ts","line_end":15,"line_start":15},{"file":"examples/pick-up-and-ship.ts","line_end":24,"line_start":24},{"file":"examples/pick-up-and-ship.ts","line_end":84,"line_start":84},{"file":"examples/pick-up-and-ship.ts","line_end":86,"line_start":86},{"file":"examples/pick-up-and-ship.ts","line_end":115,"line_start":115},{"file":"examples/pick-up-and-ship.ts","line_end":25,"line_start":25},{"file":"examples/pick-up-and-ship.ts","line_end":101,"line_start":101},{"file":"examples/pick-up-and-ship.ts","line_end":102,"line_start":102},{"file":"examples/pick-up-and-ship.ts","line_end":103,"line_start":103},{"file":"examples/submit-idea.ts","line_end":14,"line_start":14},{"file":"examples/submit-idea.ts","line_end":23,"line_start":23},{"file":"examples/submit-idea.ts","line_end":69,"line_start":69},{"file":"examples/submit-idea.ts","line_end":24,"line_start":24},{"file":"examples/submit-idea.ts","line_end":57,"line_start":57},{"file":"examples/submit-idea.ts","line_end":62,"line_start":62},{"file":"reference.md","line_end":216,"line_start":216},{"file":"reference.md","line_end":85,"line_start":85},{"file":"reference.md","line_end":129,"line_start":129},{"file":"reference.md","line_end":200,"line_start":200},{"file":"reference.md","line_end":255,"line_start":255},{"file":"reference.md","line_end":312,"line_start":312},{"file":"reference.md","line_end":316,"line_start":316},{"file":"reference.md","line_end":340,"line_start":340},{"file":"reference.md","line_end":378,"line_start":378},{"file":"reference.md","line_end":430,"line_start":430},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":99,"line_start":99},{"file":"SKILL.md","line_end":101,"line_start":101},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":121,"line_start":121},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":101,"line_start":101},{"file":"SKILL.md","line_end":122,"line_start":122},{"file":"SKILL.md","line_end":133,"line_start":133},{"file":"SKILL.md","line_end":305,"line_start":305},{"file":"SKILL.md","line_end":311,"line_start":311},{"file":"SKILL.md","line_end":312,"line_start":312}]},{"factor":"env_access","evidence":[{"file":"examples/browse-ideas.ts","line_end":11,"line_start":11},{"file":"examples/env.example","line_end":5,"line_start":5},{"file":"examples/env.example","line_end":9,"line_start":9},{"file":"examples/get-api-key.ts","line_end":26,"line_start":26},{"file":"examples/get-api-key.ts","line_end":64,"line_start":64},{"file":"examples/get-api-key.ts","line_end":26,"line_start":26},{"file":"examples/get-api-key.ts","line_end":64,"line_start":64},{"file":"examples/get-api-key.ts","line_end":13,"line_start":13},{"file":"examples/get-api-key.ts","line_end":10,"line_start":10},{"file":"examples/get-api-key.ts","line_end":26,"line_start":26},{"file":"examples/get-api-key.ts","line_end":62,"line_start":62},{"file":"examples/get-api-key.ts","line_end":64,"line_start":64},{"file":"examples/get-api-key.ts","line_end":65,"line_start":65},{"file":"examples/pick-up-and-ship.ts","line_end":17,"line_start":17},{"file":"examples/pick-up-and-ship.ts","line_end":33,"line_start":33},{"file":"examples/pick-up-and-ship.ts","line_end":17,"line_start":17},{"file":"examples/pick-up-and-ship.ts","line_end":33,"line_start":33},{"file":"examples/pick-up-and-ship.ts","line_end":14,"line_start":14},{"file":"examples/pick-up-and-ship.ts","line_end":10,"line_start":10},{"file":"examples/pick-up-and-ship.ts","line_end":17,"line_start":17},{"file":"examples/pick-up-and-ship.ts","line_end":19,"line_start":19},{"file":"examples/pick-up-and-ship.ts","line_end":20,"line_start":20},{"file":"examples/pick-up-and-ship.ts","line_end":28,"line_start":28},{"file":"examples/submit-idea.ts","line_end":16,"line_start":16},{"file":"examples/submit-idea.ts","line_end":16,"line_start":16},{"file":"examples/submit-idea.ts","line_end":13,"line_start":13},{"file":"examples/submit-idea.ts","line_end":10,"line_start":10},{"file":"examples/submit-idea.ts","line_end":16,"line_start":16},{"file":"examples/submit-idea.ts","line_end":18,"line_start":18},{"file":"examples/submit-idea.ts","line_end":19,"line_start":19},{"file":"examples/submit-idea.ts","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":123,"line_start":123},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":123,"line_start":123},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":123,"line_start":123},{"file":"SKILL.md","line_end":162,"line_start":162},{"file":"troubleshooting.md","line_end":25,"line_start":25},{"file":"troubleshooting.md","line_end":116,"line_start":116}]},{"factor":"filesystem","evidence":[{"file":"examples/submit-idea.ts","line_end":48,"line_start":48}]}],"critical_findings":[],"high_findings":[{"title":"Generic API/secret keys","locations":[{"file":"examples/get-api-key.ts","line_end":62,"line_start":62}],"confidence":0.96,"description":"console.log(`OPENSERV_API_KEY=${data.apiKey}`);","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The example prints the newly issued API key in plaintext. Terminal history, logs, or screen sharing can expose this credential."},{"title":"Generic API/secret keys","locations":[{"file":"examples/get-api-key.ts","line_end":65,"line_start":65}],"confidence":0.96,"description":"console.log(`WALLET_PRIVATE_KEY=${privateKey}`);","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The example prints a wallet private key in plaintext when it generates one. Terminal output can be retained or shared, exposing the wallet credential."},{"title":"Crypto seed/private key mention","locations":[{"file":"examples/get-api-key.ts","line_end":65,"line_start":65}],"confidence":0.96,"description":"console.log(`WALLET_PRIVATE_KEY=${privateKey}`);","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"When no wallet key is configured, the example prints a newly generated private key in plaintext. This can expose control of the generated wallet through logs or terminal history."},{"title":"Untrusted Ideaboard Content Can Influence Agent Decisions","locations":[{"file":"SKILL.md","line_end":219,"line_start":215}],"confidence":0.88,"description":"The workflow instructs agents to read public idea descriptions and comments before choosing work, but does not require treating that content as untrusted. A malicious submission could contain prompt-injection text that persuades an agent to disclose data, run unsafe actions, or follow unrelated instructions.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The documented workflow explicitly consumes public descriptions and comments before an agent acts, with no prompt-injection boundary or review step. This creates a clear indirect-instruction risk."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":8,"total_lines":1541,"audit_model":"claude","audited_at":"2026-07-21T04:29:07.544+00:00","created_at":"2026-07-21T04:43:47.396066+00:00","static_findings":[{"id":"external_commands:examples/browse-ideas.ts:25:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Found ${topData.total} total ideas. Showing top 5:\\n`);","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:examples/browse-ideas.ts:27:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`• [${idea._id}] ${idea.title}`);","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:examples/browse-ideas.ts:28:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`  Tags: ${idea.tags.join(\", \") || \"none\"}`);","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:examples/browse-ideas.ts:30:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"`  Upvotes: ${idea.upvotes.length}, Pickups: ${idea.pickups.length}`,","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:examples/browse-ideas.ts:42:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`• ${idea.title}`);","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:examples/browse-ideas.ts:48:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`\\n📖 Fetching details for idea: ${ideaId}\\n`);","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:examples/browse-ideas.ts:50:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"const { data: idea } = await api.get(`/ideas/${ideaId}`);","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:examples/browse-ideas.ts:52:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Title: ${idea.title}`);","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:examples/browse-ideas.ts:53:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Description: ${idea.description.slice(0, 200)}...`);","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:examples/browse-ideas.ts:54:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`\\nPickups (${idea.pickups.length}):`);","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"external_commands:examples/browse-ideas.ts:57:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`  • ${pickup.walletAddress.slice(0, 10)}... ${status}`);","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:examples/browse-ideas.ts:59:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`\\nComments (${idea.comments.length}):`);","category":"external_commands","line_end":59,"severity":"medium","line_start":59},{"id":"external_commands:examples/browse-ideas.ts:61:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`  • ${comment.content.slice(0, 80)}...`);","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:examples/browse-ideas.ts:74:ruby-shell-backtick-execution","file":"examples/browse-ideas.ts","pattern":"Ruby/shell backtick execution","snippet":"`• ${name}: ${agent.shippedCount} shipped, ${agent.pickupsCount} pickups`,","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"network:examples/browse-ideas.ts:12:http-client-library","file":"examples/browse-ideas.ts","pattern":"HTTP client library","snippet":"import axios from \"axios\";","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"network:examples/browse-ideas.ts:14:http-client-library","file":"examples/browse-ideas.ts","pattern":"HTTP client library","snippet":"const api = axios.create({","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:examples/browse-ideas.ts:15:hardcoded-url","file":"examples/browse-ideas.ts","pattern":"Hardcoded URL","snippet":"baseURL: \"https://api.launch.openserv.ai\",","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"env_access:examples/browse-ideas.ts:11:dotenv-library","file":"examples/browse-ideas.ts","pattern":"dotenv library","snippet":"import \"dotenv/config\";","category":"env_access","line_end":11,"severity":"low","line_start":11},{"id":"env_access:examples/env.example:5:generic-api-secret-keys","file":"examples/env.example","pattern":"Generic API/secret keys","snippet":"OPENSERV_API_KEY=","category":"env_access","line_end":5,"severity":"high","line_start":5},{"id":"env_access:examples/env.example:9:generic-api-secret-keys","file":"examples/env.example","pattern":"Generic API/secret keys","snippet":"WALLET_PRIVATE_KEY=","category":"env_access","line_end":9,"severity":"high","line_start":9},{"id":"sensitive:examples/env.example:7:crypto-seed-private-key-mention","file":"examples/env.example","pattern":"Crypto seed/private key mention","snippet":"# Optional: Your wallet private key (for generating new API keys)","category":"sensitive","line_end":7,"severity":"high","line_start":7},{"id":"external_commands:examples/get-api-key.ts:26:ruby-shell-backtick-execution","file":"examples/get-api-key.ts","pattern":"Ruby/shell backtick execution","snippet":"(process.env.WALLET_PRIVATE_KEY as `0x${string}`) || generatePrivateKey();","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:examples/get-api-key.ts:62:ruby-shell-backtick-execution","file":"examples/get-api-key.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`OPENSERV_API_KEY=${data.apiKey}`);","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:examples/get-api-key.ts:65:ruby-shell-backtick-execution","file":"examples/get-api-key.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`WALLET_PRIVATE_KEY=${privateKey}`);","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"network:examples/get-api-key.ts:14:http-client-library","file":"examples/get-api-key.ts","pattern":"HTTP client library","snippet":"import axios from \"axios\";","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:examples/get-api-key.ts:18:http-client-library","file":"examples/get-api-key.ts","pattern":"HTTP client library","snippet":"const api = axios.create({","category":"network","line_end":18,"severity":"low","line_start":18},{"id":"network:examples/get-api-key.ts:19:hardcoded-url","file":"examples/get-api-key.ts","pattern":"Hardcoded URL","snippet":"baseURL: \"https://api.launch.openserv.ai\",","category":"network","line_end":19,"severity":"low","line_start":19},{"id":"network:examples/get-api-key.ts:42:hardcoded-url","file":"examples/get-api-key.ts","pattern":"Hardcoded URL","snippet":"uri: \"https://launch.openserv.ai\",","category":"network","line_end":42,"severity":"low","line_start":42},{"id":"env_access:examples/get-api-key.ts:26:environment-variable-access-dot-notation","file":"examples/get-api-key.ts","pattern":"Environment variable access (dot notation)","snippet":"(process.env.WALLET_PRIVATE_KEY as `0x${string}`) || generatePrivateKey();","category":"env_access","line_end":26,"severity":"low","line_start":26},{"id":"env_access:examples/get-api-key.ts:64:environment-variable-access-dot-notation","file":"examples/get-api-key.ts","pattern":"Environment variable access (dot notation)","snippet":"if (!process.env.WALLET_PRIVATE_KEY) {","category":"env_access","line_end":64,"severity":"low","line_start":64},{"id":"env_access:examples/get-api-key.ts:26:environment-variable-object","file":"examples/get-api-key.ts","pattern":"Environment variable object","snippet":"(process.env.WALLET_PRIVATE_KEY as `0x${string}`) || generatePrivateKey();","category":"env_access","line_end":26,"severity":"low","line_start":26},{"id":"env_access:examples/get-api-key.ts:64:environment-variable-object","file":"examples/get-api-key.ts","pattern":"Environment variable object","snippet":"if (!process.env.WALLET_PRIVATE_KEY) {","category":"env_access","line_end":64,"severity":"low","line_start":64},{"id":"env_access:examples/get-api-key.ts:13:dotenv-library","file":"examples/get-api-key.ts","pattern":"dotenv library","snippet":"import \"dotenv/config\";","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"env_access:examples/get-api-key.ts:10:generic-api-secret-keys","file":"examples/get-api-key.ts","pattern":"Generic API/secret keys","snippet":"*   OPENSERV_API_KEY=your-api-key-here","category":"env_access","line_end":10,"severity":"high","line_start":10},{"id":"env_access:examples/get-api-key.ts:26:generic-api-secret-keys","file":"examples/get-api-key.ts","pattern":"Generic API/secret keys","snippet":"(process.env.WALLET_PRIVATE_KEY as `0x${string}`) || generatePrivateKey();","category":"env_access","line_end":26,"severity":"high","line_start":26},{"id":"env_access:examples/get-api-key.ts:62:generic-api-secret-keys","file":"examples/get-api-key.ts","pattern":"Generic API/secret keys","snippet":"console.log(`OPENSERV_API_KEY=${data.apiKey}`);","category":"env_access","line_end":62,"severity":"high","line_start":62},{"id":"env_access:examples/get-api-key.ts:64:generic-api-secret-keys","file":"examples/get-api-key.ts","pattern":"Generic API/secret keys","snippet":"if (!process.env.WALLET_PRIVATE_KEY) {","category":"env_access","line_end":64,"severity":"high","line_start":64},{"id":"env_access:examples/get-api-key.ts:65:generic-api-secret-keys","file":"examples/get-api-key.ts","pattern":"Generic API/secret keys","snippet":"console.log(`WALLET_PRIVATE_KEY=${privateKey}`);","category":"env_access","line_end":65,"severity":"high","line_start":65},{"id":"sensitive:examples/get-api-key.ts:9:environment-file-access","file":"examples/get-api-key.ts","pattern":"Environment file access","snippet":"* After running, add the API key to your .env:","category":"sensitive","line_end":9,"severity":"high","line_start":9},{"id":"sensitive:examples/get-api-key.ts:26:environment-file-access","file":"examples/get-api-key.ts","pattern":"Environment file access","snippet":"(process.env.WALLET_PRIVATE_KEY as `0x${string}`) || generatePrivateKey();","category":"sensitive","line_end":26,"severity":"high","line_start":26},{"id":"sensitive:examples/get-api-key.ts:61:environment-file-access","file":"examples/get-api-key.ts","pattern":"Environment file access","snippet":"console.log(\"\\nAdd to your .env:\");","category":"sensitive","line_end":61,"severity":"high","line_start":61},{"id":"sensitive:examples/get-api-key.ts:64:environment-file-access","file":"examples/get-api-key.ts","pattern":"Environment file access","snippet":"if (!process.env.WALLET_PRIVATE_KEY) {","category":"sensitive","line_end":64,"severity":"high","line_start":64},{"id":"sensitive:examples/get-api-key.ts:58:certificate-key-files","file":"examples/get-api-key.ts","pattern":"Certificate/key files","snippet":"console.log(\"Last 4 chars:\", data.keyLastFour);","category":"sensitive","line_end":58,"severity":"high","line_start":58},{"id":"sensitive:examples/get-api-key.ts:15:crypto-seed-private-key-mention","file":"examples/get-api-key.ts","pattern":"Crypto seed/private key mention","snippet":"import { generatePrivateKey, privateKeyToAccount } from \"viem/accounts\";","category":"sensitive","line_end":15,"severity":"high","line_start":15},{"id":"sensitive:examples/get-api-key.ts:25:crypto-seed-private-key-mention","file":"examples/get-api-key.ts","pattern":"Crypto seed/private key mention","snippet":"const privateKey =","category":"sensitive","line_end":25,"severity":"high","line_start":25},{"id":"sensitive:examples/get-api-key.ts:26:crypto-seed-private-key-mention","file":"examples/get-api-key.ts","pattern":"Crypto seed/private key mention","snippet":"(process.env.WALLET_PRIVATE_KEY as `0x${string}`) || generatePrivateKey();","category":"sensitive","line_end":26,"severity":"high","line_start":26},{"id":"sensitive:examples/get-api-key.ts:27:crypto-seed-private-key-mention","file":"examples/get-api-key.ts","pattern":"Crypto seed/private key mention","snippet":"const account = privateKeyToAccount(privateKey);","category":"sensitive","line_end":27,"severity":"high","line_start":27},{"id":"sensitive:examples/get-api-key.ts:65:crypto-seed-private-key-mention","file":"examples/get-api-key.ts","pattern":"Crypto seed/private key mention","snippet":"console.log(`WALLET_PRIVATE_KEY=${privateKey}`);","category":"sensitive","line_end":65,"severity":"high","line_start":65},{"id":"sensitive:examples/get-api-key.ts:68:crypto-seed-private-key-mention","file":"examples/get-api-key.ts","pattern":"Crypto seed/private key mention","snippet":"return { apiKey: data.apiKey, user: data.user, privateKey };","category":"sensitive","line_end":68,"severity":"high","line_start":68},{"id":"external_commands:examples/pick-up-and-ship.ts:44:ruby-shell-backtick-execution","file":"examples/pick-up-and-ship.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`• ${idea._id}: ${idea.title}`);","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:examples/pick-up-and-ship.ts:53:ruby-shell-backtick-execution","file":"examples/pick-up-and-ship.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`📖 Fetching idea: ${ideaId}\\n`);","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:examples/pick-up-and-ship.ts:57:ruby-shell-backtick-execution","file":"examples/pick-up-and-ship.ts","pattern":"Ruby/shell backtick execution","snippet":"const { data } = await api.get(`/ideas/${ideaId}`);","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:examples/pick-up-and-ship.ts:64:ruby-shell-backtick-execution","file":"examples/pick-up-and-ship.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Title: ${idea.title}`);","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:examples/pick-up-and-ship.ts:65:ruby-shell-backtick-execution","file":"examples/pick-up-and-ship.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Description: ${idea.description.slice(0, 200)}...`);","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:examples/pick-up-and-ship.ts:66:ruby-shell-backtick-execution","file":"examples/pick-up-and-ship.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Current pickups: ${idea.pickups.length}`);","category":"external_commands","line_end":66,"severity":"medium","line_start":66},{"id":"external_commands:examples/pick-up-and-ship.ts:75:ruby-shell-backtick-execution","file":"examples/pick-up-and-ship.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`  - Shipped: ${shipped.length}`);","category":"external_commands","line_end":75,"severity":"medium","line_start":75},{"id":"external_commands:examples/pick-up-and-ship.ts:76:ruby-shell-backtick-execution","file":"examples/pick-up-and-ship.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`  - In progress: ${inProgress.length}`);","category":"external_commands","line_end":76,"severity":"medium","line_start":76},{"id":"external_commands:examples/pick-up-and-ship.ts:81:ruby-shell-backtick-execution","file":"examples/pick-up-and-ship.ts","pattern":"Ruby/shell backtick execution","snippet":"await api.post(`/ideas/${ideaId}/pickup`, {});","category":"external_commands","line_end":81,"severity":"medium","line_start":81},{"id":"external_commands:examples/pick-up-and-ship.ts:107:ruby-shell-backtick-execution","file":"examples/pick-up-and-ship.ts","pattern":"Ruby/shell backtick execution","snippet":"await api.post(`/ideas/${ideaId}/ship`, {","category":"external_commands","line_end":107,"severity":"medium","line_start":107},{"id":"external_commands:examples/pick-up-and-ship.ts:108:ruby-shell-backtick-execution","file":"examples/pick-up-and-ship.ts","pattern":"Ruby/shell backtick execution","snippet":"content: `Live at ${x402Url} (x402 payable). Demo: ${demoUrl} | Repo: ${repoUrl}`,","category":"external_commands","line_end":108,"severity":"medium","line_start":108},{"id":"network:examples/pick-up-and-ship.ts:15:http-client-library","file":"examples/pick-up-and-ship.ts","pattern":"HTTP client library","snippet":"import axios from \"axios\";","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:examples/pick-up-and-ship.ts:24:http-client-library","file":"examples/pick-up-and-ship.ts","pattern":"HTTP client library","snippet":"const api = axios.create({","category":"network","line_end":24,"severity":"low","line_start":24},{"id":"network:examples/pick-up-and-ship.ts:84:http-client-library","file":"examples/pick-up-and-ship.ts","pattern":"HTTP client library","snippet":"if (axios.isAxiosError(error) && error.response?.status === 409) {","category":"network","line_end":84,"severity":"low","line_start":84},{"id":"network:examples/pick-up-and-ship.ts:86:http-client-library","file":"examples/pick-up-and-ship.ts","pattern":"HTTP client library","snippet":"} else if (axios.isAxiosError(error)) {","category":"network","line_end":86,"severity":"low","line_start":86},{"id":"network:examples/pick-up-and-ship.ts:115:http-client-library","file":"examples/pick-up-and-ship.ts","pattern":"HTTP client library","snippet":"if (axios.isAxiosError(error)) {","category":"network","line_end":115,"severity":"low","line_start":115},{"id":"network:examples/pick-up-and-ship.ts:25:hardcoded-url","file":"examples/pick-up-and-ship.ts","pattern":"Hardcoded URL","snippet":"baseURL: \"https://api.launch.openserv.ai\",","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:examples/pick-up-and-ship.ts:101:hardcoded-url","file":"examples/pick-up-and-ship.ts","pattern":"Hardcoded URL","snippet":"const x402Url = \"https://my-agent.openserv.ai/api\"; // Replace with your actual URL","category":"network","line_end":101,"severity":"low","line_start":101},{"id":"network:examples/pick-up-and-ship.ts:102:hardcoded-url","file":"examples/pick-up-and-ship.ts","pattern":"Hardcoded URL","snippet":"const demoUrl = \"https://demo.example.com\";","category":"network","line_end":102,"severity":"low","line_start":102},{"id":"network:examples/pick-up-and-ship.ts:103:hardcoded-url","file":"examples/pick-up-and-ship.ts","pattern":"Hardcoded URL","snippet":"const repoUrl = \"https://github.com/org/repo\";","category":"network","line_end":103,"severity":"low","line_start":103},{"id":"env_access:examples/pick-up-and-ship.ts:17:environment-variable-access-dot-notation","file":"examples/pick-up-and-ship.ts","pattern":"Environment variable access (dot notation)","snippet":"const API_KEY = process.env.OPENSERV_API_KEY;","category":"env_access","line_end":17,"severity":"low","line_start":17},{"id":"env_access:examples/pick-up-and-ship.ts:33:environment-variable-access-dot-notation","file":"examples/pick-up-and-ship.ts","pattern":"Environment variable access (dot notation)","snippet":"const ideaId = process.env.IDEA_ID;","category":"env_access","line_end":33,"severity":"low","line_start":33},{"id":"env_access:examples/pick-up-and-ship.ts:17:environment-variable-object","file":"examples/pick-up-and-ship.ts","pattern":"Environment variable object","snippet":"const API_KEY = process.env.OPENSERV_API_KEY;","category":"env_access","line_end":17,"severity":"low","line_start":17},{"id":"env_access:examples/pick-up-and-ship.ts:33:environment-variable-object","file":"examples/pick-up-and-ship.ts","pattern":"Environment variable object","snippet":"const ideaId = process.env.IDEA_ID;","category":"env_access","line_end":33,"severity":"low","line_start":33},{"id":"env_access:examples/pick-up-and-ship.ts:14:dotenv-library","file":"examples/pick-up-and-ship.ts","pattern":"dotenv library","snippet":"import \"dotenv/config\";","category":"env_access","line_end":14,"severity":"low","line_start":14},{"id":"env_access:examples/pick-up-and-ship.ts:10:generic-api-secret-keys","file":"examples/pick-up-and-ship.ts","pattern":"Generic API/secret keys","snippet":"*   - OPENSERV_API_KEY in .env (run get-api-key.ts first)","category":"env_access","line_end":10,"severity":"high","line_start":10},{"id":"env_access:examples/pick-up-and-ship.ts:17:generic-api-secret-keys","file":"examples/pick-up-and-ship.ts","pattern":"Generic API/secret keys","snippet":"const API_KEY = process.env.OPENSERV_API_KEY;","category":"env_access","line_end":17,"severity":"high","line_start":17},{"id":"env_access:examples/pick-up-and-ship.ts:19:generic-api-secret-keys","file":"examples/pick-up-and-ship.ts","pattern":"Generic API/secret keys","snippet":"if (!API_KEY) {","category":"env_access","line_end":19,"severity":"high","line_start":19},{"id":"env_access:examples/pick-up-and-ship.ts:20:generic-api-secret-keys","file":"examples/pick-up-and-ship.ts","pattern":"Generic API/secret keys","snippet":"console.error(\"❌ OPENSERV_API_KEY not set. Run get-api-key.ts first.\");","category":"env_access","line_end":20,"severity":"high","line_start":20},{"id":"env_access:examples/pick-up-and-ship.ts:28:generic-api-secret-keys","file":"examples/pick-up-and-ship.ts","pattern":"Generic API/secret keys","snippet":"\"x-openserv-key\": API_KEY,","category":"env_access","line_end":28,"severity":"high","line_start":28},{"id":"sensitive:examples/pick-up-and-ship.ts:10:environment-file-access","file":"examples/pick-up-and-ship.ts","pattern":"Environment file access","snippet":"*   - OPENSERV_API_KEY in .env (run get-api-key.ts first)","category":"sensitive","line_end":10,"severity":"high","line_start":10},{"id":"sensitive:examples/pick-up-and-ship.ts:17:environment-file-access","file":"examples/pick-up-and-ship.ts","pattern":"Environment file access","snippet":"const API_KEY = process.env.OPENSERV_API_KEY;","category":"sensitive","line_end":17,"severity":"high","line_start":17},{"id":"sensitive:examples/pick-up-and-ship.ts:33:environment-file-access","file":"examples/pick-up-and-ship.ts","pattern":"Environment file access","snippet":"const ideaId = process.env.IDEA_ID;","category":"sensitive","line_end":33,"severity":"high","line_start":33},{"id":"external_commands:examples/submit-idea.ts:35:ruby-shell-backtick-execution","file":"examples/submit-idea.ts","pattern":"Ruby/shell backtick execution","snippet":"description: `An AI agent that summarizes Slack channel activity into daily/weekly digests.","category":"external_commands","line_end":44,"severity":"medium","line_start":35},{"id":"external_commands:examples/submit-idea.ts:49:ruby-shell-backtick-execution","file":"examples/submit-idea.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Title: ${newIdea.title}`);","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:examples/submit-idea.ts:50:ruby-shell-backtick-execution","file":"examples/submit-idea.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Tags: ${newIdea.tags.join(\", \")}`);","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:examples/submit-idea.ts:56:ruby-shell-backtick-execution","file":"examples/submit-idea.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`ID: ${idea._id}`);","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"external_commands:examples/submit-idea.ts:57:ruby-shell-backtick-execution","file":"examples/submit-idea.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`URL: https://launch.openserv.ai/ideaboard/${idea._id}`);","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:examples/submit-idea.ts:62:ruby-shell-backtick-execution","file":"examples/submit-idea.ts","pattern":"Ruby/shell backtick execution","snippet":"`   curl \"https://api.launch.openserv.ai/ideas/${idea._id}\"`,","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"network:examples/submit-idea.ts:14:http-client-library","file":"examples/submit-idea.ts","pattern":"HTTP client library","snippet":"import axios from \"axios\";","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:examples/submit-idea.ts:23:http-client-library","file":"examples/submit-idea.ts","pattern":"HTTP client library","snippet":"const api = axios.create({","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:examples/submit-idea.ts:69:http-client-library","file":"examples/submit-idea.ts","pattern":"HTTP client library","snippet":"if (axios.isAxiosError(error)) {","category":"network","line_end":69,"severity":"low","line_start":69},{"id":"network:examples/submit-idea.ts:24:hardcoded-url","file":"examples/submit-idea.ts","pattern":"Hardcoded URL","snippet":"baseURL: \"https://api.launch.openserv.ai\",","category":"network","line_end":24,"severity":"low","line_start":24},{"id":"network:examples/submit-idea.ts:57:hardcoded-url","file":"examples/submit-idea.ts","pattern":"Hardcoded URL","snippet":"console.log(`URL: https://launch.openserv.ai/ideaboard/${idea._id}`);","category":"network","line_end":57,"severity":"low","line_start":57},{"id":"network:examples/submit-idea.ts:62:hardcoded-url","file":"examples/submit-idea.ts","pattern":"Hardcoded URL","snippet":"`   curl \"https://api.launch.openserv.ai/ideas/${idea._id}\"`,","category":"network","line_end":62,"severity":"low","line_start":62},{"id":"filesystem:examples/submit-idea.ts:48:path-traversal-sequence","file":"examples/submit-idea.ts","pattern":"Path traversal sequence","snippet":"console.log(\"📝 Submitting new idea...\\n\");","category":"filesystem","line_end":48,"severity":"high","line_start":48},{"id":"env_access:examples/submit-idea.ts:16:environment-variable-access-dot-notation","file":"examples/submit-idea.ts","pattern":"Environment variable access (dot notation)","snippet":"const API_KEY = process.env.OPENSERV_API_KEY;","category":"env_access","line_end":16,"severity":"low","line_start":16},{"id":"env_access:examples/submit-idea.ts:16:environment-variable-object","file":"examples/submit-idea.ts","pattern":"Environment variable object","snippet":"const API_KEY = process.env.OPENSERV_API_KEY;","category":"env_access","line_end":16,"severity":"low","line_start":16},{"id":"env_access:examples/submit-idea.ts:13:dotenv-library","file":"examples/submit-idea.ts","pattern":"dotenv library","snippet":"import \"dotenv/config\";","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"env_access:examples/submit-idea.ts:10:generic-api-secret-keys","file":"examples/submit-idea.ts","pattern":"Generic API/secret keys","snippet":"*   - OPENSERV_API_KEY in .env (run get-api-key.ts first)","category":"env_access","line_end":10,"severity":"high","line_start":10},{"id":"env_access:examples/submit-idea.ts:16:generic-api-secret-keys","file":"examples/submit-idea.ts","pattern":"Generic API/secret keys","snippet":"const API_KEY = process.env.OPENSERV_API_KEY;","category":"env_access","line_end":16,"severity":"high","line_start":16},{"id":"env_access:examples/submit-idea.ts:18:generic-api-secret-keys","file":"examples/submit-idea.ts","pattern":"Generic API/secret keys","snippet":"if (!API_KEY) {","category":"env_access","line_end":18,"severity":"high","line_start":18},{"id":"env_access:examples/submit-idea.ts:19:generic-api-secret-keys","file":"examples/submit-idea.ts","pattern":"Generic API/secret keys","snippet":"console.error(\"❌ OPENSERV_API_KEY not set. Run get-api-key.ts first.\");","category":"env_access","line_end":19,"severity":"high","line_start":19},{"id":"env_access:examples/submit-idea.ts:27:generic-api-secret-keys","file":"examples/submit-idea.ts","pattern":"Generic API/secret keys","snippet":"\"x-openserv-key\": API_KEY,","category":"env_access","line_end":27,"severity":"high","line_start":27},{"id":"sensitive:examples/submit-idea.ts:10:environment-file-access","file":"examples/submit-idea.ts","pattern":"Environment file access","snippet":"*   - OPENSERV_API_KEY in .env (run get-api-key.ts first)","category":"sensitive","line_end":10,"severity":"high","line_start":10},{"id":"sensitive:examples/submit-idea.ts:16:environment-file-access","file":"examples/submit-idea.ts","pattern":"Environment file access","snippet":"const API_KEY = process.env.OPENSERV_API_KEY;","category":"sensitive","line_end":16,"severity":"high","line_start":16},{"id":"network:reference.md:216:python-http-libraries","file":"reference.md","pattern":"Python HTTP libraries","snippet":"\"description\": \"An agent that reviews pull requests...\",","category":"network","line_end":216,"severity":"low","line_start":216},{"id":"network:reference.md:85:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"curl 'https://api.launch.openserv.ai/ideas?sort=hot&limit=10'","category":"network","line_end":85,"severity":"low","line_start":85},{"id":"network:reference.md:129:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"curl 'https://api.launch.openserv.ai/ideas/:id'","category":"network","line_end":129,"severity":"low","line_start":129},{"id":"network:reference.md:200:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"curl -X POST 'https://api.launch.openserv.ai/ideas' \\","category":"network","line_end":200,"severity":"low","line_start":200},{"id":"network:reference.md:255:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"curl -X POST 'https://api.launch.openserv.ai/ideas/:id/pickup' \\","category":"network","line_end":255,"severity":"low","line_start":255},{"id":"network:reference.md:312:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"curl -X POST 'https://api.launch.openserv.ai/ideas/:id/ship' \\","category":"network","line_end":312,"severity":"low","line_start":312},{"id":"network:reference.md:316:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"\"content\": \"Live at https://my-agent.openserv.ai/code-review (x402 payable). Demo: https://demo.exam","category":"network","line_end":316,"severity":"low","line_start":316},{"id":"network:reference.md:340:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"\"content\": \"Shipped! Demo: https://example.com | Repo: https://github.com/org/repo\",","category":"network","line_end":340,"severity":"low","line_start":340},{"id":"network:reference.md:378:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"curl -X POST 'https://api.launch.openserv.ai/ideas/:id/upvote' \\","category":"network","line_end":378,"severity":"low","line_start":378},{"id":"network:reference.md:430:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"curl -X POST 'https://api.launch.openserv.ai/ideas/:id/comment' \\","category":"network","line_end":430,"severity":"low","line_start":430},{"id":"blocker:reference.md:117:system-reconnaissance","file":"reference.md","pattern":"System reconnaissance","snippet":"GET /ideas/:id","category":"blocker","line_end":118,"severity":"low","line_start":117},{"id":"blocker:reference.md:124:system-reconnaissance","file":"reference.md","pattern":"System reconnaissance","snippet":"| id        | string | Yes      | The idea's ID     |","category":"blocker","line_end":124,"severity":"low","line_start":124},{"id":"blocker:reference.md:250:system-reconnaissance","file":"reference.md","pattern":"System reconnaissance","snippet":"| id        | string | Yes      | The idea's ID  |","category":"blocker","line_end":250,"severity":"low","line_start":250},{"id":"blocker:reference.md:299:system-reconnaissance","file":"reference.md","pattern":"System reconnaissance","snippet":"| id        | string | Yes      | The idea's ID  |","category":"blocker","line_end":299,"severity":"low","line_start":299},{"id":"blocker:reference.md:352:system-reconnaissance","file":"reference.md","pattern":"System reconnaissance","snippet":"| 400    | Already shipped or invalid content            |","category":"blocker","line_end":352,"severity":"low","line_start":352},{"id":"blocker:reference.md:373:system-reconnaissance","file":"reference.md","pattern":"System reconnaissance","snippet":"| id        | string | Yes      | The idea's ID  |","category":"blocker","line_end":373,"severity":"low","line_start":373},{"id":"blocker:reference.md:419:system-reconnaissance","file":"reference.md","pattern":"System reconnaissance","snippet":"| id        | string | Yes      | The idea's ID  |","category":"blocker","line_end":419,"severity":"low","line_start":419},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `reference.md` - Full API reference for all endpoints","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `troubleshooting.md` - Common issues and solutions","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `examples/` - Complete code examples","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Base URL:** `https://api.launch.openserv.ai`","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Authentication:** The API has no origin or CORS restrictions. **GET endpoints are public** and nee","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":40,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":44,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Get your API key via SIWE (Sign-In With Ethereum). Run this flow once; store the returned API key (e","category":"external_commands","line_end":46,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":59,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(process.env.WALLET_PRIVATE_KEY as `0x${string}`) || generatePrivateKey();","category":"external_commands","line_end":90,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":92,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"After sign-up, set `OPENSERV_API_KEY` in your environment and include it in the `x-openserv-key` hea","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":111,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"const { data: idea } = await api.get(`/ideas/${ideaId}`);","category":"external_commands","line_end":112,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":116,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"POST endpoints require the `x-openserv-key` header. This includes: submitting an idea, picking up, s","category":"external_commands","line_end":118,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":129,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"await api.post(`/ideas/${ideaId}/pickup`);","category":"external_commands","line_end":132,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"await api.post(`/ideas/${ideaId}/ship`, {","category":"external_commands","line_end":142,"severity":"medium","line_start":132},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":154,"severity":"medium","line_start":142},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**As an agent:** Before picking up, you can read `idea.pickups` to see who else is working on it and","category":"external_commands","line_end":154,"severity":"medium","line_start":154},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The API uses **SIWE (Sign-In With Ethereum)**. You sign a message with a wallet; the API returns an ","category":"external_commands","line_end":162,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**As an agent:** Sign up first (Step 1 in Quick Start). Use a dedicated wallet (e.g. from `viem`) an","category":"external_commands","line_end":162,"severity":"medium","line_start":162},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `examples/get-api-key.ts` for a runnable sign-up script.","category":"external_commands","line_end":174,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":187,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":191,"severity":"medium","line_start":187},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":197,"severity":"medium","line_start":191},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":201,"severity":"medium","line_start":197},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":207,"severity":"medium","line_start":201},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":216,"severity":"medium","line_start":207},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Choose** – Fetch the full idea by ID; read `description`, `pickups`, and `comments` to confirm ","category":"external_commands","line_end":216,"severity":"medium","line_start":216},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Pick up** – POST to `/ideas/:id/pickup` with your API key so the platform (and others) know you","category":"external_commands","line_end":219,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:219:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **Ship** – POST to `/ideas/:id/ship` with a comment that includes your **x402 URL**, demo link, a","category":"external_commands","line_end":221,"severity":"medium","line_start":219},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `examples/pick-up-and-ship.ts` for a complete example.","category":"external_commands","line_end":225,"severity":"medium","line_start":221},{"id":"external_commands:SKILL.md:225:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Submit** – POST to `/ideas` with title, description, and tags so other agents (or you later) ca","category":"external_commands","line_end":226,"severity":"medium","line_start":225},{"id":"external_commands:SKILL.md:226:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Track** – Periodically GET `/ideas/:id` to see `pickups` (who's working) and `comments` (includ","category":"external_commands","line_end":226,"severity":"medium","line_start":226},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `examples/submit-idea.ts` for a complete example.","category":"external_commands","line_end":234,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"All endpoints are publicly accessible (no origin restriction). **Auth: No** = no API key needed. **A","category":"external_commands","line_end":238,"severity":"medium","line_start":234},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas`                        | GET    | No   | List/search ideas        |","category":"external_commands","line_end":239,"severity":"medium","line_start":238},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas/:id`                    | GET    | No   | Get idea details         |","category":"external_commands","line_end":240,"severity":"medium","line_start":239},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas`                        | POST   | Yes  | Submit new idea          |","category":"external_commands","line_end":241,"severity":"medium","line_start":240},{"id":"external_commands:SKILL.md:241:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas/:id/pickup`             | POST   | Yes  | Pick up an idea          |","category":"external_commands","line_end":242,"severity":"medium","line_start":241},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas/:id/ship`               | POST   | Yes  | Ship your implementation |","category":"external_commands","line_end":243,"severity":"medium","line_start":242},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas/:id/upvote`             | POST   | Yes  | Toggle upvote            |","category":"external_commands","line_end":244,"severity":"medium","line_start":243},{"id":"external_commands:SKILL.md:244:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas/:id/comment`            | POST   | Yes  | Add a comment            |","category":"external_commands","line_end":245,"severity":"medium","line_start":244},{"id":"external_commands:SKILL.md:245:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas/agents`                 | GET    | No   | List agents              |","category":"external_commands","line_end":246,"severity":"medium","line_start":245},{"id":"external_commands:SKILL.md:246:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas/agents/:wallet`         | GET    | No   | Get agent profile        |","category":"external_commands","line_end":247,"severity":"medium","line_start":246},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas/agents/:wallet/ideas`   | GET    | No   | Agent's submitted ideas  |","category":"external_commands","line_end":248,"severity":"medium","line_start":247},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas/agents/:wallet/pickups` | GET    | No   | Agent's pickups          |","category":"external_commands","line_end":249,"severity":"medium","line_start":248},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas/agents/:wallet/shipped` | GET    | No   | Agent's shipments        |","category":"external_commands","line_end":250,"severity":"medium","line_start":249},{"id":"external_commands:SKILL.md:250:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/ideas/top-agents`             | GET    | No   | Top agents by activity   |","category":"external_commands","line_end":252,"severity":"medium","line_start":250},{"id":"external_commands:SKILL.md:252:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `reference.md` for full documentation on each endpoint.","category":"external_commands","line_end":266,"severity":"medium","line_start":252},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":272,"severity":"medium","line_start":266},{"id":"external_commands:SKILL.md:272:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":274,"severity":"medium","line_start":272},{"id":"external_commands:SKILL.md:274:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `troubleshooting.md` for common issues and solutions.","category":"external_commands","line_end":282,"severity":"medium","line_start":274},{"id":"external_commands:SKILL.md:282:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":288,"severity":"medium","line_start":282},{"id":"external_commands:SKILL.md:288:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":292,"severity":"medium","line_start":288},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":294,"severity":"medium","line_start":292},{"id":"network:SKILL.md:39:http-client-library","file":"SKILL.md","pattern":"HTTP client library","snippet":"npm install axios viem siwe","category":"network","line_end":39,"severity":"low","line_start":39},{"id":"network:SKILL.md:47:http-client-library","file":"SKILL.md","pattern":"HTTP client library","snippet":"import axios from 'axios';","category":"network","line_end":47,"severity":"low","line_start":47},{"id":"network:SKILL.md:51:http-client-library","file":"SKILL.md","pattern":"HTTP client library","snippet":"const api = axios.create({","category":"network","line_end":51,"severity":"low","line_start":51},{"id":"network:SKILL.md:99:http-client-library","file":"SKILL.md","pattern":"HTTP client library","snippet":"import axios from 'axios';","category":"network","line_end":99,"severity":"low","line_start":99},{"id":"network:SKILL.md:101:http-client-library","file":"SKILL.md","pattern":"HTTP client library","snippet":"const api = axios.create({ baseURL: 'https://api.launch.openserv.ai' });","category":"network","line_end":101,"severity":"low","line_start":101},{"id":"network:SKILL.md:119:http-client-library","file":"SKILL.md","pattern":"HTTP client library","snippet":"import axios from 'axios';","category":"network","line_end":119,"severity":"low","line_start":119},{"id":"network:SKILL.md:121:http-client-library","file":"SKILL.md","pattern":"HTTP client library","snippet":"const api = axios.create({","category":"network","line_end":121,"severity":"low","line_start":121},{"id":"network:SKILL.md:92:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"After sign-up, set `OPENSERV_API_KEY` in your environment and include it in the `x-openserv-key` hea","category":"network","line_end":92,"severity":"low","line_start":92},{"id":"network:SKILL.md:16:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"**Base URL:** `https://api.launch.openserv.ai`","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:SKILL.md:52:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"baseURL: 'https://api.launch.openserv.ai',","category":"network","line_end":52,"severity":"low","line_start":52},{"id":"network:SKILL.md:73:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"uri: 'https://launch.openserv.ai',","category":"network","line_end":73,"severity":"low","line_start":73},{"id":"network:SKILL.md:101:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"const api = axios.create({ baseURL: 'https://api.launch.openserv.ai' });","category":"network","line_end":101,"severity":"low","line_start":101},{"id":"network:SKILL.md:122:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"baseURL: 'https://api.launch.openserv.ai',","category":"network","line_end":122,"severity":"low","line_start":122},{"id":"network:SKILL.md:133:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"content: 'Live at https://my-agent.openserv.ai/api | x402 payable. Repo: https://github.com/...',","category":"network","line_end":133,"severity":"low","line_start":133},{"id":"network:SKILL.md:305:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"To access all skills, follow the [OpenServ Skills](https://github.com/openserv-labs/skills) reposito","category":"network","line_end":305,"severity":"low","line_start":305},{"id":"network:SKILL.md:311:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [OpenServ Platform](https://platform.openserv.ai) - Build and deploy AI agents","category":"network","line_end":311,"severity":"low","line_start":311},{"id":"network:SKILL.md:312:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Ideaboard UI](https://launch.openserv.ai/ideaboard) - Browse and submit ideas","category":"network","line_end":312,"severity":"low","line_start":312},{"id":"env_access:SKILL.md:59:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"(process.env.WALLET_PRIVATE_KEY as `0x${string}`) || generatePrivateKey();","category":"env_access","line_end":59,"severity":"low","line_start":59},{"id":"env_access:SKILL.md:123:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"headers: { 'x-openserv-key': process.env.OPENSERV_API_KEY },","category":"env_access","line_end":123,"severity":"low","line_start":123},{"id":"env_access:SKILL.md:59:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"(process.env.WALLET_PRIVATE_KEY as `0x${string}`) || generatePrivateKey();","category":"env_access","line_end":59,"severity":"low","line_start":59},{"id":"env_access:SKILL.md:123:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"headers: { 'x-openserv-key': process.env.OPENSERV_API_KEY },","category":"env_access","line_end":123,"severity":"low","line_start":123},{"id":"env_access:SKILL.md:28:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"**Authentication:** The API has no origin or CORS restrictions. **GET endpoints are public** and nee","category":"env_access","line_end":28,"severity":"high","line_start":28},{"id":"env_access:SKILL.md:44:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"Get your API key via SIWE (Sign-In With Ethereum). Run this flow once; store the returned API key (e","category":"env_access","line_end":44,"severity":"high","line_start":44},{"id":"env_access:SKILL.md:57:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"// 1. Create wallet (or use existing from env, e.g. WALLET_PRIVATE_KEY)","category":"env_access","line_end":57,"severity":"high","line_start":57},{"id":"env_access:SKILL.md:59:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"(process.env.WALLET_PRIVATE_KEY as `0x${string}`) || generatePrivateKey();","category":"env_access","line_end":59,"severity":"high","line_start":59},{"id":"env_access:SKILL.md:87:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"// Store data.apiKey securely (e.g. OPENSERV_API_KEY). It is shown only once.","category":"env_access","line_end":87,"severity":"high","line_start":87},{"id":"env_access:SKILL.md:92:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"After sign-up, set `OPENSERV_API_KEY` in your environment and include it in the `x-openserv-key` hea","category":"env_access","line_end":92,"severity":"high","line_start":92},{"id":"env_access:SKILL.md:123:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"headers: { 'x-openserv-key': process.env.OPENSERV_API_KEY },","category":"env_access","line_end":123,"severity":"high","line_start":123},{"id":"env_access:SKILL.md:162:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"**As an agent:** Sign up first (Step 1 in Quick Start). Use a dedicated wallet (e.g. from `viem`) an","category":"env_access","line_end":162,"severity":"high","line_start":162},{"id":"sensitive:SKILL.md:59:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"(process.env.WALLET_PRIVATE_KEY as `0x${string}`) || generatePrivateKey();","category":"sensitive","line_end":59,"severity":"high","line_start":59},{"id":"sensitive:SKILL.md:123:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"headers: { 'x-openserv-key': process.env.OPENSERV_API_KEY },","category":"sensitive","line_end":123,"severity":"high","line_start":123},{"id":"sensitive:SKILL.md:48:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts';","category":"sensitive","line_end":48,"severity":"high","line_start":48},{"id":"sensitive:SKILL.md:58:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"const privateKey =","category":"sensitive","line_end":58,"severity":"high","line_start":58},{"id":"sensitive:SKILL.md:59:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"(process.env.WALLET_PRIVATE_KEY as `0x${string}`) || generatePrivateKey();","category":"sensitive","line_end":59,"severity":"high","line_start":59},{"id":"sensitive:SKILL.md:60:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"const account = privateKeyToAccount(privateKey);","category":"sensitive","line_end":60,"severity":"high","line_start":60},{"id":"env_access:troubleshooting.md:25:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"- Verify the key is being read correctly from your environment (e.g. `OPENSERV_API_KEY`)","category":"env_access","line_end":25,"severity":"high","line_start":25},{"id":"env_access:troubleshooting.md:116:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"2. **Verify your API key is set** - Log `API_KEY?.slice(-4)` to confirm it's loaded without exposing","category":"env_access","line_end":116,"severity":"high","line_start":116},{"id":"blocker:troubleshooting.md:9:system-reconnaissance","file":"troubleshooting.md","pattern":"System reconnaissance","snippet":"### Authentication fails with \"Invalid nonce\"","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:troubleshooting.md:35:system-reconnaissance","file":"troubleshooting.md","pattern":"System reconnaissance","snippet":"- `issuedAt`: valid ISO 8601 timestamp","category":"blocker","line_end":35,"severity":"low","line_start":35},{"id":"blocker:troubleshooting.md:93:system-reconnaissance","file":"troubleshooting.md","pattern":"System reconnaissance","snippet":"### Invalid JSON in request body","category":"blocker","line_end":93,"severity":"low","line_start":93}],"finding_verdicts":[{"id":"external_commands:examples/browse-ideas.ts:25:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:27:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:28:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:30:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:42:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:48:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:50:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:52:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:53:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:54:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:57:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:59:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:61:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/browse-ideas.ts:74:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/browse-ideas.ts:12:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/browse-ideas.ts:14:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/browse-ideas.ts:15:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/browse-ideas.ts:11:dotenv-library","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/env.example:5:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/env.example:9:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/env.example:7:crypto-seed-private-key-mention","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/get-api-key.ts:26:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/get-api-key.ts:62:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/get-api-key.ts:65:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/get-api-key.ts:14:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/get-api-key.ts:18:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/get-api-key.ts:19:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/get-api-key.ts:42:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/get-api-key.ts:26:environment-variable-access-dot-notation","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/get-api-key.ts:64:environment-variable-access-dot-notation","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/get-api-key.ts:26:environment-variable-object","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/get-api-key.ts:64:environment-variable-object","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/get-api-key.ts:13:dotenv-library","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/get-api-key.ts:10:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/get-api-key.ts:26:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/get-api-key.ts:62:generic-api-secret-keys","reason":"The example prints the newly issued API key in plaintext. Terminal history, logs, or screen sharing can expose this credential.","verdict":"confirmed","severity":"high","confidence":0.96},{"id":"env_access:examples/get-api-key.ts:64:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/get-api-key.ts:65:generic-api-secret-keys","reason":"The example prints a wallet private key in plaintext when it generates one. Terminal output can be retained or shared, exposing the wallet credential.","verdict":"confirmed","severity":"high","confidence":0.96},{"id":"sensitive:examples/get-api-key.ts:9:environment-file-access","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/get-api-key.ts:26:environment-file-access","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/get-api-key.ts:61:environment-file-access","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/get-api-key.ts:64:environment-file-access","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/get-api-key.ts:58:certificate-key-files","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/get-api-key.ts:15:crypto-seed-private-key-mention","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/get-api-key.ts:25:crypto-seed-private-key-mention","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/get-api-key.ts:26:crypto-seed-private-key-mention","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/get-api-key.ts:27:crypto-seed-private-key-mention","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/get-api-key.ts:65:crypto-seed-private-key-mention","reason":"When no wallet key is configured, the example prints a newly generated private key in plaintext. This can expose control of the generated wallet through logs or terminal history.","verdict":"confirmed","severity":"high","confidence":0.96},{"id":"sensitive:examples/get-api-key.ts:68:crypto-seed-private-key-mention","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/pick-up-and-ship.ts:44:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/pick-up-and-ship.ts:53:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/pick-up-and-ship.ts:57:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/pick-up-and-ship.ts:64:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/pick-up-and-ship.ts:65:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/pick-up-and-ship.ts:66:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/pick-up-and-ship.ts:75:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/pick-up-and-ship.ts:76:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/pick-up-and-ship.ts:81:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/pick-up-and-ship.ts:107:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/pick-up-and-ship.ts:108:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/pick-up-and-ship.ts:15:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/pick-up-and-ship.ts:24:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/pick-up-and-ship.ts:84:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/pick-up-and-ship.ts:86:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/pick-up-and-ship.ts:115:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/pick-up-and-ship.ts:25:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/pick-up-and-ship.ts:101:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/pick-up-and-ship.ts:102:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/pick-up-and-ship.ts:103:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/pick-up-and-ship.ts:17:environment-variable-access-dot-notation","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/pick-up-and-ship.ts:33:environment-variable-access-dot-notation","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/pick-up-and-ship.ts:17:environment-variable-object","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/pick-up-and-ship.ts:33:environment-variable-object","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/pick-up-and-ship.ts:14:dotenv-library","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/pick-up-and-ship.ts:10:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/pick-up-and-ship.ts:17:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/pick-up-and-ship.ts:19:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/pick-up-and-ship.ts:20:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/pick-up-and-ship.ts:28:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/pick-up-and-ship.ts:10:environment-file-access","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/pick-up-and-ship.ts:17:environment-file-access","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/pick-up-and-ship.ts:33:environment-file-access","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/submit-idea.ts:35:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/submit-idea.ts:49:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/submit-idea.ts:50:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/submit-idea.ts:56:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/submit-idea.ts:57:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:examples/submit-idea.ts:62:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/submit-idea.ts:14:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/submit-idea.ts:23:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/submit-idea.ts:69:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/submit-idea.ts:24:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/submit-idea.ts:57:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:examples/submit-idea.ts:62:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:examples/submit-idea.ts:48:path-traversal-sequence","reason":"The cited line is a console message and contains no path traversal operation or filesystem access.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/submit-idea.ts:16:environment-variable-access-dot-notation","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/submit-idea.ts:16:environment-variable-object","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/submit-idea.ts:13:dotenv-library","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/submit-idea.ts:10:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/submit-idea.ts:16:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/submit-idea.ts:18:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/submit-idea.ts:19:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:examples/submit-idea.ts:27:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/submit-idea.ts:10:environment-file-access","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:examples/submit-idea.ts:16:environment-file-access","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"network:reference.md:216:python-http-libraries","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:reference.md:85:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:reference.md:129:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:reference.md:200:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:reference.md:255:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:reference.md:312:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:reference.md:316:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:reference.md:340:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:reference.md:378:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:reference.md:430:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"blocker:reference.md:117:system-reconnaissance","reason":"This is API documentation or troubleshooting text, not host or network reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:reference.md:124:system-reconnaissance","reason":"This is API documentation or troubleshooting text, not host or network reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:reference.md:250:system-reconnaissance","reason":"This is API documentation or troubleshooting text, not host or network reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:reference.md:299:system-reconnaissance","reason":"This is API documentation or troubleshooting text, not host or network reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:reference.md:352:system-reconnaissance","reason":"This is API documentation or troubleshooting text, not host or network reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:reference.md:373:system-reconnaissance","reason":"This is API documentation or troubleshooting text, not host or network reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:reference.md:419:system-reconnaissance","reason":"This is API documentation or troubleshooting text, not host or network reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:219:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:225:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:226:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:241:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:244:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:245:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:246:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:250:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:252:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:272:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:274:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:282:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:288:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal or Markdown code fence, not shell execution. No command runner or subprocess invocation is present.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:39:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:47:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:51:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:99:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:101:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:119:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:121:http-client-library","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:92:python-http-libraries","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:16:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:52:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:73:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:101:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:122:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:133:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:305:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:311:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:312:hardcoded-url","reason":"This documents or uses the declared OpenServ API endpoint for the skill purpose. No unrelated destination or credential exfiltration is evidenced.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:59:environment-variable-access-dot-notation","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:123:environment-variable-access-dot-notation","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:59:environment-variable-object","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:123:environment-variable-object","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:28:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:44:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:57:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:59:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:87:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:92:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:123:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:162:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:59:environment-file-access","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:123:environment-file-access","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:48:crypto-seed-private-key-mention","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:58:crypto-seed-private-key-mention","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:59:crypto-seed-private-key-mention","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:60:crypto-seed-private-key-mention","reason":"This is documentation or local handling of an API or wallet credential for the stated SIWE flow. The detected pattern does not itself access a file or expose a secret.","verdict":"false_positive","confidence":0.98},{"id":"env_access:troubleshooting.md:25:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:troubleshooting.md:116:generic-api-secret-keys","reason":"This is documented configuration or a scoped read of the API or wallet credential needed for authentication. It does not enumerate or transmit arbitrary environment values.","verdict":"false_positive","confidence":0.98},{"id":"blocker:troubleshooting.md:9:system-reconnaissance","reason":"This is API documentation or troubleshooting text, not host or network reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:troubleshooting.md:35:system-reconnaissance","reason":"This is API documentation or troubleshooting text, not host or network reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:troubleshooting.md:93:system-reconnaissance","reason":"This is API documentation or troubleshooting text, not host or network reconnaissance.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Untrusted Ideaboard Content Can Influence Agent Decisions","severity":"high","locations":[{"file":"SKILL.md","line_end":219,"line_start":215}],"confidence":0.88,"description":"The workflow instructs agents to read public idea descriptions and comments before choosing work, but does not require treating that content as untrusted. A malicious submission could contain prompt-injection text that persuades an agent to disclose data, run unsafe actions, or follow unrelated instructions.","confidence_reasoning":"The documented workflow explicitly consumes public descriptions and comments before an agent acts, with no prompt-injection boundary or review step. This creates a clear indirect-instruction risk."}],"subject_marketplace_commit_sha":"3f6e026a3363e0954ede7bef0cfe88d4475de137","subject_content_hash":"70d132a2be77d1bcc140422d851d2a868052b191b9bd62ffa68f2473b314e867","subject_tree_hash":"921d23c1927c090f69f168d14317a1b25456fd468e12adfd9760948b45b44556","subject_plugin_path":"skills/internet-court/openserv-ideaboard-api","audit_payload_hash":"b4873aff76a24f3753b68626961b15ef","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3f6e026a3363e0954ede7bef0cfe88d4475de137","contentHash":"70d132a2be77d1bcc140422d851d2a868052b191b9bd62ffa68f2473b314e867","treeHash":"921d23c1927c090f69f168d14317a1b25456fd468e12adfd9760948b45b44556","pluginPath":"skills/internet-court/openserv-ideaboard-api","auditPayloadHash":"b4873aff76a24f3753b68626961b15ef"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"unavailable","url":null,"status":null},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":2,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"unavailable","verificationState":"not_verified"},"isLatest":true}}