{"data":{"skill":{"slug":"jeffallan-golang-pro","name":"golang-pro","icon":"📦","repo":"https://github.com/jeffallan/claude-skills/tree/main/skills/golang-pro/","status":"approved","author":"jeffallan","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"70282dd9-ec94-420b-b4c2-bac3a24d0da2","skill_id":"d0096a31-c425-4d9f-bd15-2b4ae43fcfdd","version":3,"content_hash":"v2:a06681402992ceae98ba04d54cfd4ab004862696:9c8e58d97db92101899b47e2561c69feb78c98888f5967a0d2f984bdf971509d:cc3b4a2167ba6140f5702a77482ea37152e459d2fe8f104170858ddf7a350855:942389983f9c82f6f6ac29861a3aec96","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All static findings are false positives caused by Go, Makefile, and Markdown examples in reference documentation. I found no prompt injection, credential exfiltration intent, hidden command execution, or malicious network behavior.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"references/concurrency.md","line_end":13,"line_start":8},{"file":"references/interfaces.md","line_end":82,"line_start":79},{"file":"references/project-structure.md","line_end":138,"line_start":135},{"file":"references/project-structure.md","line_end":409,"line_start":406},{"file":"references/project-structure.md","line_end":429,"line_start":424},{"file":"references/project-structure.md","line_end":46,"line_start":45},{"file":"references/project-structure.md","line_end":52,"line_start":51},{"file":"references/testing.md","line_end":343,"line_start":339},{"file":"references/testing.md","line_end":380,"line_start":377}]},{"factor":"network","evidence":[{"file":"references/interfaces.md","line_end":270,"line_start":270},{"file":"references/project-structure.md","line_end":438,"line_start":438},{"file":"SKILL.md","line_end":6,"line_start":6}]},{"factor":"external_commands","evidence":[{"file":"references/project-structure.md","line_end":439,"line_start":438},{"file":"references/project-structure.md","line_end":440,"line_start":439},{"file":"references/project-structure.md","line_end":441,"line_start":440},{"file":"references/project-structure.md","line_end":445,"line_start":441},{"file":"references/project-structure.md","line_end":446,"line_start":445},{"file":"references/project-structure.md","line_end":447,"line_start":446},{"file":"references/project-structure.md","line_end":451,"line_start":447},{"file":"references/project-structure.md","line_end":452,"line_start":451},{"file":"references/project-structure.md","line_end":453,"line_start":452},{"file":"references/project-structure.md","line_end":464,"line_start":453},{"file":"references/project-structure.md","line_end":255,"line_start":255},{"file":"references/project-structure.md","line_end":259,"line_start":259},{"file":"references/project-structure.md","line_end":263,"line_start":263},{"file":"references/project-structure.md","line_end":271,"line_start":271},{"file":"references/project-structure.md","line_end":276,"line_start":276},{"file":"references/project-structure.md","line_end":280,"line_start":280},{"file":"references/project-structure.md","line_end":285,"line_start":285},{"file":"references/project-structure.md","line_end":286,"line_start":286},{"file":"references/project-structure.md","line_end":290,"line_start":290},{"file":"references/project-structure.md","line_end":291,"line_start":291},{"file":"references/project-structure.md","line_end":292,"line_start":292},{"file":"references/project-structure.md","line_end":296,"line_start":296},{"file":"references/project-structure.md","line_end":300,"line_start":300},{"file":"references/project-structure.md","line_end":304,"line_start":304},{"file":"references/project-structure.md","line_end":384,"line_start":384},{"file":"references/project-structure.md","line_end":385,"line_start":385},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":61,"line_start":61}]},{"factor":"filesystem","evidence":[{"file":"references/project-structure.md","line_end":58,"line_start":58},{"file":"references/project-structure.md","line_end":392,"line_start":392}]},{"factor":"env_access","evidence":[{"file":"references/project-structure.md","line_end":445,"line_start":445}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":6,"total_lines":2221,"audit_model":"codex","audited_at":"2026-07-06T14:49:35.211+00:00","created_at":"2026-07-06T17:32:44.890005+00:00","static_findings":[{"id":"scripts:references/concurrency.md:8:dynamic-import-expression","file":"references/concurrency.md","pattern":"Dynamic import() expression","snippet":"import (","category":"scripts","line_end":13,"severity":"medium","line_start":8},{"id":"scripts:references/interfaces.md:79:dynamic-import-expression","file":"references/interfaces.md","pattern":"Dynamic import() expression","snippet":"import (","category":"scripts","line_end":82,"severity":"medium","line_start":79},{"id":"network:references/interfaces.md:270:hardcoded-ip-address","file":"references/interfaces.md","pattern":"Hardcoded IP address","snippet":"//     WithHost(\"0.0.0.0\"),","category":"network","line_end":270,"severity":"medium","line_start":270},{"id":"blocker:references/interfaces.md:283:system-reconnaissance","file":"references/interfaces.md","pattern":"System reconnaissance","snippet":"Read(id string) (Item, error)","category":"blocker","line_end":283,"severity":"low","line_start":283},{"id":"blocker:references/interfaces.md:285:system-reconnaissance","file":"references/interfaces.md","pattern":"System reconnaissance","snippet":"Delete(id string) error","category":"blocker","line_end":285,"severity":"low","line_start":285},{"id":"blocker:references/interfaces.md:297:system-reconnaissance","file":"references/interfaces.md","pattern":"System reconnaissance","snippet":"Read(id string) (Item, error)","category":"blocker","line_end":297,"severity":"low","line_start":297},{"id":"blocker:references/interfaces.md:305:system-reconnaissance","file":"references/interfaces.md","pattern":"System reconnaissance","snippet":"Delete(id string) error","category":"blocker","line_end":305,"severity":"low","line_start":305},{"id":"blocker:references/interfaces.md:381:system-reconnaissance","file":"references/interfaces.md","pattern":"System reconnaissance","snippet":"GetUser(ctx context.Context, id string) (*User, error)","category":"blocker","line_end":381,"severity":"low","line_start":381},{"id":"blocker:references/interfaces.md:413:system-reconnaissance","file":"references/interfaces.md","pattern":"System reconnaissance","snippet":"func (m *MockUserRepository) GetUser(ctx context.Context, id string) (*User, error) {","category":"blocker","line_end":413,"severity":"low","line_start":413},{"id":"scripts:references/project-structure.md:135:dynamic-import-expression","file":"references/project-structure.md","pattern":"Dynamic import() expression","snippet":"import (","category":"scripts","line_end":138,"severity":"medium","line_start":135},{"id":"scripts:references/project-structure.md:406:dynamic-import-expression","file":"references/project-structure.md","pattern":"Dynamic import() expression","snippet":"import (","category":"scripts","line_end":409,"severity":"medium","line_start":406},{"id":"scripts:references/project-structure.md:424:dynamic-import-expression","file":"references/project-structure.md","pattern":"Dynamic import() expression","snippet":"import (","category":"scripts","line_end":429,"severity":"medium","line_start":424},{"id":"scripts:references/project-structure.md:45:dynamic-require-with-variable","file":"references/project-structure.md","pattern":"Dynamic require with variable","snippet":"require (","category":"scripts","line_end":46,"severity":"medium","line_start":45},{"id":"scripts:references/project-structure.md:51:dynamic-require-with-variable","file":"references/project-structure.md","pattern":"Dynamic require with variable","snippet":"require (","category":"scripts","line_end":52,"severity":"medium","line_start":51},{"id":"external_commands:references/project-structure.md:438:ruby-shell-backtick-execution","file":"references/project-structure.md","pattern":"Ruby/shell backtick execution","snippet":"Host         string        `envconfig:\"SERVER_HOST\" default:\"0.0.0.0\"`","category":"external_commands","line_end":439,"severity":"medium","line_start":438},{"id":"external_commands:references/project-structure.md:439:ruby-shell-backtick-execution","file":"references/project-structure.md","pattern":"Ruby/shell backtick execution","snippet":"Port         int           `envconfig:\"SERVER_PORT\" default:\"8080\"`","category":"external_commands","line_end":440,"severity":"medium","line_start":439},{"id":"external_commands:references/project-structure.md:440:ruby-shell-backtick-execution","file":"references/project-structure.md","pattern":"Ruby/shell backtick execution","snippet":"ReadTimeout  time.Duration `envconfig:\"SERVER_READ_TIMEOUT\" default:\"10s\"`","category":"external_commands","line_end":441,"severity":"medium","line_start":440},{"id":"external_commands:references/project-structure.md:441:ruby-shell-backtick-execution","file":"references/project-structure.md","pattern":"Ruby/shell backtick execution","snippet":"WriteTimeout time.Duration `envconfig:\"SERVER_WRITE_TIMEOUT\" default:\"10s\"`","category":"external_commands","line_end":445,"severity":"medium","line_start":441},{"id":"external_commands:references/project-structure.md:445:ruby-shell-backtick-execution","file":"references/project-structure.md","pattern":"Ruby/shell backtick execution","snippet":"URL          string `envconfig:\"DATABASE_URL\" required:\"true\"`","category":"external_commands","line_end":446,"severity":"medium","line_start":445},{"id":"external_commands:references/project-structure.md:446:ruby-shell-backtick-execution","file":"references/project-structure.md","pattern":"Ruby/shell backtick execution","snippet":"MaxOpenConns int    `envconfig:\"DB_MAX_OPEN_CONNS\" default:\"25\"`","category":"external_commands","line_end":447,"severity":"medium","line_start":446},{"id":"external_commands:references/project-structure.md:447:ruby-shell-backtick-execution","file":"references/project-structure.md","pattern":"Ruby/shell backtick execution","snippet":"MaxIdleConns int    `envconfig:\"DB_MAX_IDLE_CONNS\" default:\"5\"`","category":"external_commands","line_end":451,"severity":"medium","line_start":447},{"id":"external_commands:references/project-structure.md:451:ruby-shell-backtick-execution","file":"references/project-structure.md","pattern":"Ruby/shell backtick execution","snippet":"Addr     string `envconfig:\"REDIS_ADDR\" default:\"localhost:6379\"`","category":"external_commands","line_end":452,"severity":"medium","line_start":451},{"id":"external_commands:references/project-structure.md:452:ruby-shell-backtick-execution","file":"references/project-structure.md","pattern":"Ruby/shell backtick execution","snippet":"Password string `envconfig:\"REDIS_PASSWORD\"`","category":"external_commands","line_end":453,"severity":"medium","line_start":452},{"id":"external_commands:references/project-structure.md:453:ruby-shell-backtick-execution","file":"references/project-structure.md","pattern":"Ruby/shell backtick execution","snippet":"DB       int    `envconfig:\"REDIS_DB\" default:\"0\"`","category":"external_commands","line_end":464,"severity":"medium","line_start":453},{"id":"external_commands:references/project-structure.md:255:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"$(GO) build $(GOFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME) ./cmd/server","category":"external_commands","line_end":255,"severity":"medium","line_start":255},{"id":"external_commands:references/project-structure.md:259:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"$(GO) test -v -race -coverprofile=coverage.out ./...","category":"external_commands","line_end":259,"severity":"medium","line_start":259},{"id":"external_commands:references/project-structure.md:263:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"$(GO) tool cover -html=coverage.out","category":"external_commands","line_end":263,"severity":"medium","line_start":263},{"id":"external_commands:references/project-structure.md:271:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"$(GO) fmt ./...","category":"external_commands","line_end":271,"severity":"medium","line_start":271},{"id":"external_commands:references/project-structure.md:276:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"$(GO) run ./cmd/server","category":"external_commands","line_end":276,"severity":"medium","line_start":276},{"id":"external_commands:references/project-structure.md:280:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"rm -rf $(BUILD_DIR)","category":"external_commands","line_end":280,"severity":"medium","line_start":280},{"id":"external_commands:references/project-structure.md:285:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"$(GO) mod download","category":"external_commands","line_end":285,"severity":"medium","line_start":285},{"id":"external_commands:references/project-structure.md:286:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"$(GO) mod tidy","category":"external_commands","line_end":286,"severity":"medium","line_start":286},{"id":"external_commands:references/project-structure.md:290:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"GOOS=linux GOARCH=amd64 $(GO) build -o $(BUILD_DIR)/$(BINARY_NAME)-linux-amd64 ./cmd/server","category":"external_commands","line_end":290,"severity":"medium","line_start":290},{"id":"external_commands:references/project-structure.md:291:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"GOOS=darwin GOARCH=amd64 $(GO) build -o $(BUILD_DIR)/$(BINARY_NAME)-darwin-amd64 ./cmd/server","category":"external_commands","line_end":291,"severity":"medium","line_start":291},{"id":"external_commands:references/project-structure.md:292:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"GOOS=windows GOARCH=amd64 $(GO) build -o $(BUILD_DIR)/$(BINARY_NAME)-windows-amd64.exe ./cmd/server","category":"external_commands","line_end":292,"severity":"medium","line_start":292},{"id":"external_commands:references/project-structure.md:296:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"$(GO) run -race ./cmd/server","category":"external_commands","line_end":296,"severity":"medium","line_start":296},{"id":"external_commands:references/project-structure.md:300:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"$(GO) generate ./...","category":"external_commands","line_end":300,"severity":"medium","line_start":300},{"id":"external_commands:references/project-structure.md:304:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"docker build -t $(BINARY_NAME):latest .","category":"external_commands","line_end":304,"severity":"medium","line_start":304},{"id":"external_commands:references/project-structure.md:384:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"//   -X github.com/user/project/version.GitCommit=$(git rev-parse HEAD) \\","category":"external_commands","line_end":384,"severity":"medium","line_start":384},{"id":"external_commands:references/project-structure.md:385:shell-command-substitution","file":"references/project-structure.md","pattern":"Shell command substitution","snippet":"//   -X github.com/user/project/version.BuildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)\"","category":"external_commands","line_end":385,"severity":"medium","line_start":385},{"id":"network:references/project-structure.md:438:hardcoded-ip-address","file":"references/project-structure.md","pattern":"Hardcoded IP address","snippet":"Host         string        `envconfig:\"SERVER_HOST\" default:\"0.0.0.0\"`","category":"network","line_end":438,"severity":"medium","line_start":438},{"id":"filesystem:references/project-structure.md:58:path-traversal-sequence","file":"references/project-structure.md","pattern":"Path traversal sequence","snippet":"replace github.com/user/mylib => ../mylib","category":"filesystem","line_end":58,"severity":"high","line_start":58},{"id":"filesystem:references/project-structure.md:392:path-traversal-sequence","file":"references/project-structure.md","pattern":"Path traversal sequence","snippet":"//go:generate mockgen -source=user.go -destination=../mocks/user_mock.go -package=mocks","category":"filesystem","line_end":392,"severity":"high","line_start":392},{"id":"env_access:references/project-structure.md:445:database-connection-strings","file":"references/project-structure.md","pattern":"Database connection strings","snippet":"URL          string `envconfig:\"DATABASE_URL\" required:\"true\"`","category":"env_access","line_end":445,"severity":"high","line_start":445},{"id":"blocker:references/project-structure.md:150:system-reconnaissance","file":"references/project-structure.md","pattern":"System reconnaissance","snippet":"GetByID(ctx context.Context, id string) (*User, error)","category":"blocker","line_end":150,"severity":"low","line_start":150},{"id":"blocker:references/project-structure.md:152:system-reconnaissance","file":"references/project-structure.md","pattern":"System reconnaissance","snippet":"Delete(ctx context.Context, id string) error","category":"blocker","line_end":152,"severity":"low","line_start":152},{"id":"blocker:references/project-structure.md:397:system-reconnaissance","file":"references/project-structure.md","pattern":"System reconnaissance","snippet":"GetUser(id string) (*User, error)","category":"blocker","line_end":397,"severity":"low","line_start":397},{"id":"scripts:references/testing.md:339:dynamic-import-expression","file":"references/testing.md","pattern":"Dynamic import() expression","snippet":"import (","category":"scripts","line_end":343,"severity":"medium","line_start":339},{"id":"scripts:references/testing.md:377:dynamic-import-expression","file":"references/testing.md","pattern":"Dynamic import() expression","snippet":"import (","category":"scripts","line_end":380,"severity":"medium","line_start":377},{"id":"blocker:references/testing.md:78:system-reconnaissance","file":"references/testing.md","pattern":"System reconnaissance","snippet":"{\"valid user\", User{Name: \"John\", Email: \"john@example.com\"}},","category":"blocker","line_end":78,"severity":"low","line_start":78},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Concurrency | `references/concurrency.md` | Goroutines, channels, select, sync primitives |","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Interfaces | `references/interfaces.md` | Interface design, io.Reader/Writer, composition |","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Generics | `references/generics.md` | Type parameters, constraints, generic patterns |","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Testing | `references/testing.md` | Table-driven tests, benchmarks, fuzzing |","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Project Structure | `references/project-structure.md` | Module layout, internal packages, go.mod |","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `X | Y` union constraints for generics (Go 1.18+)","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"network:SKILL.md:6:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"author: https://github.com/Jeffallan","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"blocker:SKILL.md:66:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Ignore errors (avoid _ assignment without justification)","category":"blocker","line_end":66,"severity":"low","line_start":66}],"finding_verdicts":[{"id":"scripts:references/concurrency.md:8:dynamic-import-expression","reason":"The snippet is a Go import block inside a fenced documentation example, not a JavaScript dynamic import. It does not execute code or load remote modules.","verdict":"false_positive","confidence":0.95},{"id":"scripts:references/interfaces.md:79:dynamic-import-expression","reason":"The snippet is a Go import block inside a fenced documentation example, not a JavaScript dynamic import. It does not execute code or load remote modules.","verdict":"false_positive","confidence":0.95},{"id":"network:references/interfaces.md:270:hardcoded-ip-address","reason":"The address appears in a commented functional-options usage example for a server host. It is documentation context and does not initiate network access.","verdict":"false_positive","confidence":0.9},{"id":"blocker:references/interfaces.md:283:system-reconnaissance","reason":"The line is a Go interface method or mock method in documentation. It names CRUD behavior but performs no system reconnaissance.","verdict":"false_positive","confidence":0.93},{"id":"blocker:references/interfaces.md:285:system-reconnaissance","reason":"The line is a Go interface method or mock method in documentation. It names CRUD behavior but performs no system reconnaissance.","verdict":"false_positive","confidence":0.93},{"id":"blocker:references/interfaces.md:297:system-reconnaissance","reason":"The line is a Go interface method or mock method in documentation. It names CRUD behavior but performs no system reconnaissance.","verdict":"false_positive","confidence":0.93},{"id":"blocker:references/interfaces.md:305:system-reconnaissance","reason":"The line is a Go interface method or mock method in documentation. It names CRUD behavior but performs no system reconnaissance.","verdict":"false_positive","confidence":0.93},{"id":"blocker:references/interfaces.md:381:system-reconnaissance","reason":"The line is a Go interface method or mock method in documentation. It names CRUD behavior but performs no system reconnaissance.","verdict":"false_positive","confidence":0.93},{"id":"blocker:references/interfaces.md:413:system-reconnaissance","reason":"The line is a Go interface method or mock method in documentation. It names CRUD behavior but performs no system reconnaissance.","verdict":"false_positive","confidence":0.93},{"id":"scripts:references/project-structure.md:135:dynamic-import-expression","reason":"The snippet is a Go import block inside a fenced documentation example, not a JavaScript dynamic import. It does not execute code or load remote modules.","verdict":"false_positive","confidence":0.95},{"id":"scripts:references/project-structure.md:406:dynamic-import-expression","reason":"The snippet is a Go import block inside a fenced documentation example, not a JavaScript dynamic import. It does not execute code or load remote modules.","verdict":"false_positive","confidence":0.95},{"id":"scripts:references/project-structure.md:424:dynamic-import-expression","reason":"The snippet is a Go import block inside a fenced documentation example, not a JavaScript dynamic import. It does not execute code or load remote modules.","verdict":"false_positive","confidence":0.95},{"id":"scripts:references/project-structure.md:45:dynamic-require-with-variable","reason":"The snippet is a go.mod require block showing Go dependencies. It is not a Node require call and contains no dynamic runtime loading.","verdict":"false_positive","confidence":0.95},{"id":"scripts:references/project-structure.md:51:dynamic-require-with-variable","reason":"The snippet is a go.mod require block showing Go dependencies. It is not a Node require call and contains no dynamic runtime loading.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/project-structure.md:438:ruby-shell-backtick-execution","reason":"The backticks are Go struct tags for envconfig fields in a configuration example. They are not shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/project-structure.md:439:ruby-shell-backtick-execution","reason":"The backticks are Go struct tags for envconfig fields in a configuration example. They are not shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/project-structure.md:440:ruby-shell-backtick-execution","reason":"The backticks are Go struct tags for envconfig fields in a configuration example. They are not shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/project-structure.md:441:ruby-shell-backtick-execution","reason":"The backticks are Go struct tags for envconfig fields in a configuration example. They are not shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/project-structure.md:445:ruby-shell-backtick-execution","reason":"The backticks are Go struct tags for envconfig fields in a configuration example. They are not shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/project-structure.md:446:ruby-shell-backtick-execution","reason":"The backticks are Go struct tags for envconfig fields in a configuration example. They are not shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/project-structure.md:447:ruby-shell-backtick-execution","reason":"The backticks are Go struct tags for envconfig fields in a configuration example. They are not shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/project-structure.md:451:ruby-shell-backtick-execution","reason":"The backticks are Go struct tags for envconfig fields in a configuration example. They are not shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/project-structure.md:452:ruby-shell-backtick-execution","reason":"The backticks are Go struct tags for envconfig fields in a configuration example. They are not shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/project-structure.md:453:ruby-shell-backtick-execution","reason":"The backticks are Go struct tags for envconfig fields in a configuration example. They are not shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/project-structure.md:255:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:259:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:263:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:271:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:276:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:280:shell-command-substitution","reason":"The command appears in a documented Makefile clean target scoped to a local build directory variable. It is an example, not autonomous destructive execution.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:references/project-structure.md:285:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:286:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:290:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:291:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:292:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:296:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:300:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:304:shell-command-substitution","reason":"The line is a Makefile example for common Go build, test, format, dependency, or Docker tasks. It documents project scaffolding and is not hidden execution by the skill.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:references/project-structure.md:384:shell-command-substitution","reason":"The command substitution appears in a commented go build metadata example. It records git or date values and is not executed by the skill content.","verdict":"false_positive","confidence":0.87},{"id":"external_commands:references/project-structure.md:385:shell-command-substitution","reason":"The command substitution appears in a commented go build metadata example. It records git or date values and is not executed by the skill content.","verdict":"false_positive","confidence":0.87},{"id":"network:references/project-structure.md:438:hardcoded-ip-address","reason":"The address is a default value in a configuration struct example. It does not open sockets or transmit data from the skill.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:references/project-structure.md:58:path-traversal-sequence","reason":"The path traversal sequence is a go.mod replace directive pointing to a local development module. It is documentation, not file access by the skill.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:references/project-structure.md:392:path-traversal-sequence","reason":"The relative path is a mockgen destination inside a go:generate example. It writes generated mocks relative to the sample project, not arbitrary paths.","verdict":"false_positive","confidence":0.86},{"id":"env_access:references/project-structure.md:445:database-connection-strings","reason":"DATABASE_URL is an envconfig field in a configuration example. It references environment configuration but does not read, print, or transmit secrets by itself.","verdict":"false_positive","confidence":0.85},{"id":"blocker:references/project-structure.md:150:system-reconnaissance","reason":"The line is a Go interface method or mock method in documentation. It names CRUD behavior but performs no system reconnaissance.","verdict":"false_positive","confidence":0.93},{"id":"blocker:references/project-structure.md:152:system-reconnaissance","reason":"The line is a Go interface method or mock method in documentation. It names CRUD behavior but performs no system reconnaissance.","verdict":"false_positive","confidence":0.93},{"id":"blocker:references/project-structure.md:397:system-reconnaissance","reason":"The line is a Go interface method or mock method in documentation. It names CRUD behavior but performs no system reconnaissance.","verdict":"false_positive","confidence":0.93},{"id":"scripts:references/testing.md:339:dynamic-import-expression","reason":"The snippet is a Go import block inside a fenced documentation example, not a JavaScript dynamic import. It does not execute code or load remote modules.","verdict":"false_positive","confidence":0.95},{"id":"scripts:references/testing.md:377:dynamic-import-expression","reason":"The snippet is a Go import block inside a fenced documentation example, not a JavaScript dynamic import. It does not execute code or load remote modules.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/testing.md:78:system-reconnaissance","reason":"The line is test fixture data in a Go testing example. It is not reconnaissance or a request to collect host information.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The backticks format Markdown table links to local reference files. They are not shell execution syntax or commands.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The backticks format Markdown table links to local reference files. They are not shell execution syntax or commands.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The backticks format Markdown table links to local reference files. They are not shell execution syntax or commands.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The backticks format Markdown table links to local reference files. They are not shell execution syntax or commands.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The backticks format Markdown table links to local reference files. They are not shell execution syntax or commands.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The backticks format a Go generic union constraint in prose. It is not shell execution syntax or a command.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:6:hardcoded-url","reason":"The URL is author metadata pointing to a GitHub profile. It is not an instruction to contact a service or exfiltrate data.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:66:system-reconnaissance","reason":"The line is a coding anti-pattern warning in SKILL.md. It tells users not to ignore errors and does not request system discovery.","verdict":"false_positive","confidence":0.96}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}