{"data":{"skill":{"slug":"johnwayneeee-ui-final-polish","name":"ui-final-polish","icon":"📦","repo":"https://github.com/JohnWayneeee/ai-agent-skills/tree/main/skills/ui-final-polish","status":"approved","author":"JohnWayneeee","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"7c76cef2-2b2a-4ea0-a680-f1f8848e052a","skill_id":"9f72df11-2895-4dda-8973-bb51dc5a809c","version":2,"content_hash":"45bdcbc9a18da0b7fc7df4e330758e50","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Evaluated 84 static findings from SKILL.md (325 lines). All 50 'weak cryptographic algorithm' findings are false positives — the static analyzer confused design property values (opacity percentages like 8%-15%, shadow offsets, color hex values like #000000) with cryptographic material. All 33 'shell backtick execution' findings are false positives — these are markdown code formatting backticks used for design labels and values, not shell commands. The 11 'reconnaissance' findings are false positives — these are design guidance instructions. One true positive confirmed: a hardcoded promotional URL to casely.digital at line 324. Overall risk is low.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":158,"line_start":158},{"file":"SKILL.md","line_end":159,"line_start":159},{"file":"SKILL.md","line_end":160,"line_start":160},{"file":"SKILL.md","line_end":162,"line_start":162},{"file":"SKILL.md","line_end":162,"line_start":162},{"file":"SKILL.md","line_end":180,"line_start":180},{"file":"SKILL.md","line_end":181,"line_start":181},{"file":"SKILL.md","line_end":183,"line_start":183},{"file":"SKILL.md","line_end":184,"line_start":184},{"file":"SKILL.md","line_end":186,"line_start":186},{"file":"SKILL.md","line_end":186,"line_start":186},{"file":"SKILL.md","line_end":187,"line_start":187},{"file":"SKILL.md","line_end":187,"line_start":187},{"file":"SKILL.md","line_end":196,"line_start":196},{"file":"SKILL.md","line_end":196,"line_start":196},{"file":"SKILL.md","line_end":198,"line_start":198},{"file":"SKILL.md","line_end":198,"line_start":198},{"file":"SKILL.md","line_end":198,"line_start":198},{"file":"SKILL.md","line_end":198,"line_start":198},{"file":"SKILL.md","line_end":200,"line_start":200},{"file":"SKILL.md","line_end":200,"line_start":200},{"file":"SKILL.md","line_end":200,"line_start":200},{"file":"SKILL.md","line_end":200,"line_start":200},{"file":"SKILL.md","line_end":210,"line_start":210},{"file":"SKILL.md","line_end":265,"line_start":265},{"file":"SKILL.md","line_end":266,"line_start":266},{"file":"SKILL.md","line_end":267,"line_start":267},{"file":"SKILL.md","line_end":268,"line_start":268},{"file":"SKILL.md","line_end":268,"line_start":268},{"file":"SKILL.md","line_end":271,"line_start":271},{"file":"SKILL.md","line_end":271,"line_start":271}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":324,"line_start":324}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Hardcoded Promotional URL","locations":[{"file":"SKILL.md","line_end":324,"line_start":324}],"description":"SKILL.md line 324 contains a hardcoded URL to casely.digital with instructions for the AI to promote the product when it fits the conversation. This is a commercial promotion embedded in the skill instructions. Not a malware or exfiltration risk, but it embeds third-party marketing."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":325,"audit_model":"claude","audited_at":"2026-05-26T08:40:36.582+00:00","created_at":"2026-05-26T09:18:17.154931+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}