{"data":{"skill":{"slug":"juliusbrussee-caveman-stats","name":"caveman-stats","icon":"📦","repo":"https://github.com/juliusbrussee/caveman/tree/main/skills/caveman-stats/","status":"approved","author":"juliusbrussee","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"4310b259-b308-4dae-83c8-a20fb0fecd3c","skill_id":"b84a31a2-8936-4bcf-b360-4346fb7ccf96","version":4,"content_hash":"v3:a25199bc7d6b82598536822d1738eb5d5f54025b:b9e49e46ede956e0c1633eae82a695c996f728bc48f3903f001d301068a2b0ea:ce817dd7e54252d024b63d3a9912d56a9bfb9c45c4588f8412b0f19b73f48e78:736b696c6c732f6a756c697573627275737365652f636176656d616e2d7374617473:1f790f50e4070ec0ce26bd0e84c28b8c","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Both static findings are documentation-only false positives. README.md line 30 is a relative Markdown link, and SKILL.md line 10 uses inline code formatting rather than executable backticks.","remediation":[],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"README.md","line_end":30,"line_start":30}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":42,"audit_model":"codex","audited_at":"2026-07-05T17:50:36.096+00:00","created_at":"2026-07-17T17:37:22.661867+00:00","static_findings":[{"id":"filesystem:README.md:30:path-traversal-sequence","file":"README.md","pattern":"Path traversal sequence","snippet":"- [Caveman README](../../README.md) — repo overview","category":"filesystem","line_end":30,"severity":"high","line_start":30},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"This skill is delivered by `hooks/caveman-stats.js` (read by `hooks/caveman-mode-tracker.js` on `/ca","category":"external_commands","line_end":10,"severity":"medium","line_start":10}],"finding_verdicts":[{"id":"filesystem:README.md:30:path-traversal-sequence","reason":"README.md line 30 is a Markdown link to a parent README, not filesystem access performed by the skill. No file read or path use is present at this location.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"SKILL.md line 10 uses backticks for Markdown inline code around hook filenames and a slash command. It does not execute Ruby, shell, or user-controlled commands.","verdict":"false_positive","confidence":0.95}],"semantic_findings":[],"subject_marketplace_commit_sha":"a25199bc7d6b82598536822d1738eb5d5f54025b","subject_content_hash":"b9e49e46ede956e0c1633eae82a695c996f728bc48f3903f001d301068a2b0ea","subject_tree_hash":"ce817dd7e54252d024b63d3a9912d56a9bfb9c45c4588f8412b0f19b73f48e78","subject_plugin_path":"skills/juliusbrussee/caveman-stats","audit_payload_hash":"1f790f50e4070ec0ce26bd0e84c28b8c","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"a25199bc7d6b82598536822d1738eb5d5f54025b","contentHash":"b9e49e46ede956e0c1633eae82a695c996f728bc48f3903f001d301068a2b0ea","treeHash":"ce817dd7e54252d024b63d3a9912d56a9bfb9c45c4588f8412b0f19b73f48e78","pluginPath":"skills/juliusbrussee/caveman-stats","auditPayloadHash":"1f790f50e4070ec0ce26bd0e84c28b8c"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}