{"data":{"skill":{"slug":"jeffallan-golang-pro","name":"golang-pro","icon":"📦","repo":"https://github.com/jeffallan/claude-skills/tree/main/skills/golang-pro/","status":"approved","author":"jeffallan","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"584963f6-3b49-411b-8345-8eba256bdb03","skill_id":"d0096a31-c425-4d9f-bd15-2b4ae43fcfdd","version":1,"content_hash":"f342f2b3b6d224b9bf1cb9dfc4adc8d4","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Documentation skill with legitimate Go programming patterns. All 195 static findings are false positives triggered by code examples in markdown files. No malicious intent detected.","remediation":[],"risk_factor_evidence":[],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Documentation Code Examples Detected as Shell Commands","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":51,"line_start":47},{"file":"references/concurrency.md","line_end":285,"line_start":5},{"file":"references/generics.md","line_end":441,"line_start":5},{"file":"references/interfaces.md","line_end":374,"line_start":5},{"file":"references/project-structure.md","line_end":476,"line_start":5},{"file":"references/testing.md","line_end":450,"line_start":5}],"confidence":0.95,"description":"Static analyzer flagged shell command syntax in markdown documentation as 'Ruby/shell backtick execution'. These are legitimate Go build commands and tooling examples (e.g., go mod init, go build) within code blocks, not executable malicious code.","confidence_reasoning":"All flagged patterns are Go code examples within markdown documentation blocks. No actual shell execution occurs - these are instructional examples for Go tooling."},{"title":"Dynamic Import Patterns in Documentation","verdict":"FALSE_POSITIVE","locations":[{"file":"references/concurrency.md","line_end":13,"line_start":8},{"file":"references/interfaces.md","line_end":82,"line_start":79},{"file":"references/project-structure.md","line_end":429,"line_start":135},{"file":"references/testing.md","line_end":380,"line_start":339}],"confidence":0.95,"description":"Static analyzer detected 'Dynamic import() expression' patterns in documentation files. These are TypeScript/JavaScript code examples within markdown documentation, not actual executable code.","confidence_reasoning":"Patterns are code examples within markdown documentation blocks, not actual dynamic imports in executable code."},{"title":"Network Patterns in Documentation","verdict":"FALSE_POSITIVE","locations":[{"file":"references/interfaces.md","line_end":270,"line_start":270},{"file":"references/project-structure.md","line_end":438,"line_start":438},{"file":"SKILL.md","line_end":6,"line_start":6}],"confidence":0.95,"description":"Static analyzer detected hardcoded IP addresses and network patterns. These are network configuration examples in documentation, not actual network code.","confidence_reasoning":"Hardcoded IPs are example values in documentation, not actual network code or credential exfiltration."},{"title":"Filesystem Patterns in Documentation","verdict":"FALSE_POSITIVE","locations":[{"file":"references/project-structure.md","line_end":58,"line_start":58},{"file":"references/project-structure.md","line_end":392,"line_start":392}],"confidence":0.95,"description":"Static analyzer detected path traversal sequences and filesystem access patterns. These are file path examples and project structure documentation, not actual path traversal exploits.","confidence_reasoning":"Path patterns are legitimate project structure examples showing directory layouts, not exploitable path traversal."},{"title":"Environment Access Patterns in Documentation","verdict":"FALSE_POSITIVE","locations":[{"file":"references/project-structure.md","line_end":445,"line_start":445}],"confidence":0.95,"description":"Static analyzer detected database connection string patterns. These are configuration examples showing best practices for environment-based configuration.","confidence_reasoning":"Database configuration examples demonstrate proper secret management practices using environment variables."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":6,"total_lines":2221,"audit_model":"claude","audited_at":"2026-02-07T08:45:00+00:00","created_at":"2026-02-07T10:28:31.558997+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":5,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}