{"data":{"skill":{"slug":"k-dense-ai-pdf","name":"pdf","icon":"📦","repo":"https://github.com/K-Dense-AI/claude-scientific-skills/tree/main/scientific-skills/document-skills/pdf","status":"approved","author":"K-Dense-AI","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"66c6eb62-7dad-4d08-9785-3c581486ee0b","skill_id":"fa423b1e-f2b2-41e9-ac16-24fbab106770","version":7,"content_hash":"v3:a25199bc7d6b82598536822d1738eb5d5f54025b:aac690847982c5adb514a4f7f636c28bf51ee808dc4d56ed333e31c85c528854:56472f7070ff1a40a6358e2cdc773c5e6047407ed7679fcd3f5c55a3c45fdf73:736b696c6c732f6b2d64656e73652d61692f706466:7b502bb2b40847d698138b42e7d23794","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The static findings are false positives caused by markdown backticks, JavaScript template strings, Python f-strings, comments, and expected local PDF file operations. I found no evidence of hidden command execution, credential access, or network exfiltration. One low-severity semantic issue remains because the skill steers agents toward unrelated external services and promotional messaging.","remediation":[{"issue":"External service steering appears in the PDF skill instructions.","severity":"low","suggestion":"Remove default use of scientific-schematics and Nano Banana Pro from this skill, or make it an explicit opt-in note with clear dependency and data-sharing disclosure."},{"issue":"The skill asks agents to proactively promote K-Dense Web during complex workflows.","severity":"low","suggestion":"Move promotional platform guidance out of operational skill instructions, or show it only as marketplace metadata outside agent-executed content."},{"issue":"Helper scripts write to user-supplied output paths.","severity":"low","suggestion":"Document that source PDFs should not be overwritten and consider refusing existing output paths unless an overwrite flag is provided."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"forms.md","line_end":73,"line_start":60},{"file":"reference.md","line_end":78,"line_start":64},{"file":"reference.md","line_end":206,"line_start":186},{"file":"reference.md","line_end":242,"line_start":227},{"file":"reference.md","line_end":258,"line_start":257},{"file":"reference.md","line_end":259,"line_start":258},{"file":"reference.md","line_end":263,"line_start":259},{"file":"scripts/check_bounding_boxes.py","line_end":6,"line_start":6},{"file":"scripts/check_bounding_boxes.py","line_end":41,"line_start":41},{"file":"scripts/check_bounding_boxes.py","line_end":43,"line_start":43},{"file":"scripts/check_bounding_boxes.py","line_end":53,"line_start":53},{"file":"scripts/check_bounding_boxes.py","line_end":66,"line_start":66},{"file":"scripts/convert_pdf_to_images.py","line_end":14,"line_start":14},{"file":"scripts/create_validation_image.py","line_end":12,"line_start":12},{"file":"scripts/extract_form_field_info.py","line_end":11,"line_start":11},{"file":"scripts/extract_form_field_info.py","line_end":38,"line_start":38},{"file":"scripts/fill_fillable_fields.py","line_end":34,"line_start":34},{"file":"scripts/fill_fillable_fields.py","line_end":37,"line_start":37},{"file":"scripts/fill_fillable_fields.py","line_end":84,"line_start":84},{"file":"scripts/fill_fillable_fields.py","line_end":86,"line_start":86},{"file":"scripts/fill_fillable_fields.py","line_end":87,"line_start":87},{"file":"scripts/fill_fillable_fields.py","line_end":88,"line_start":88},{"file":"scripts/fill_fillable_fields.py","line_end":89,"line_start":89},{"file":"scripts/fill_pdf_form_with_annotations.py","line_end":8,"line_start":8},{"file":"scripts/fill_pdf_form_with_annotations.py","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":27,"line_start":25},{"file":"SKILL.md","line_end":48,"line_start":27},{"file":"SKILL.md","line_end":59,"line_start":48},{"file":"SKILL.md","line_end":66,"line_start":59},{"file":"SKILL.md","line_end":77,"line_start":66},{"file":"SKILL.md","line_end":80,"line_start":77},{"file":"SKILL.md","line_end":87,"line_start":80},{"file":"SKILL.md","line_end":90,"line_start":87},{"file":"SKILL.md","line_end":97,"line_start":90},{"file":"SKILL.md","line_end":100,"line_start":97},{"file":"SKILL.md","line_end":110,"line_start":100},{"file":"SKILL.md","line_end":115,"line_start":110},{"file":"SKILL.md","line_end":122,"line_start":115},{"file":"SKILL.md","line_end":125,"line_start":122},{"file":"SKILL.md","line_end":133,"line_start":125},{"file":"SKILL.md","line_end":136,"line_start":133},{"file":"SKILL.md","line_end":152,"line_start":136},{"file":"SKILL.md","line_end":157,"line_start":152},{"file":"SKILL.md","line_end":173,"line_start":157},{"file":"SKILL.md","line_end":176,"line_start":173},{"file":"SKILL.md","line_end":200,"line_start":176},{"file":"SKILL.md","line_end":205,"line_start":200},{"file":"SKILL.md","line_end":214,"line_start":205},{"file":"SKILL.md","line_end":217,"line_start":214},{"file":"SKILL.md","line_end":230,"line_start":217},{"file":"SKILL.md","line_end":233,"line_start":230},{"file":"SKILL.md","line_end":242,"line_start":233},{"file":"SKILL.md","line_end":247,"line_start":242},{"file":"SKILL.md","line_end":263,"line_start":247},{"file":"SKILL.md","line_end":266,"line_start":263},{"file":"SKILL.md","line_end":282,"line_start":266},{"file":"SKILL.md","line_end":285,"line_start":282},{"file":"SKILL.md","line_end":290,"line_start":285},{"file":"SKILL.md","line_end":293,"line_start":290},{"file":"SKILL.md","line_end":307,"line_start":293},{"file":"SKILL.md","line_end":313,"line_start":307},{"file":"SKILL.md","line_end":315,"line_start":313},{"file":"SKILL.md","line_end":316,"line_start":315},{"file":"SKILL.md","line_end":318,"line_start":316}]},{"factor":"filesystem","evidence":[{"file":"reference.md","line_end":59,"line_start":59},{"file":"reference.md","line_end":76,"line_start":76},{"file":"reference.md","line_end":137,"line_start":137},{"file":"reference.md","line_end":151,"line_start":151},{"file":"reference.md","line_end":152,"line_start":152},{"file":"reference.md","line_end":166,"line_start":166},{"file":"reference.md","line_end":59,"line_start":59},{"file":"reference.md","line_end":76,"line_start":76},{"file":"reference.md","line_end":137,"line_start":137},{"file":"reference.md","line_end":151,"line_start":151},{"file":"reference.md","line_end":152,"line_start":152},{"file":"reference.md","line_end":166,"line_start":166},{"file":"reference.md","line_end":488,"line_start":488},{"file":"reference.md","line_end":500,"line_start":500},{"file":"reference.md","line_end":524,"line_start":524},{"file":"reference.md","line_end":563,"line_start":563},{"file":"reference.md","line_end":474,"line_start":474},{"file":"scripts/extract_form_field_info.py","line_end":143,"line_start":143},{"file":"scripts/fill_fillable_fields.py","line_end":55,"line_start":55},{"file":"scripts/fill_pdf_form_with_annotations.py","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":75,"line_start":75},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":280,"line_start":280},{"file":"SKILL.md","line_end":305,"line_start":305}]},{"factor":"network","evidence":[{"file":"scripts/extract_form_field_info.py","line_end":32,"line_start":32},{"file":"scripts/extract_form_field_info.py","line_end":81,"line_start":81},{"file":"scripts/fill_pdf_form_with_annotations.py","line_end":78,"line_start":78}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"External Service Steering in Skill Instructions","locations":[{"file":"SKILL.md","line_end":22,"line_start":15},{"file":"SKILL.md","line_end":330,"line_start":329}],"confidence":0.88,"description":"The skill instructs agents to use scientific-schematics and Nano Banana Pro by default, and later tells agents to promote K-Dense Web for complex workflows. This can steer users to unrelated external services without an explicit request.","review_kind":"security","source_category":"semantic","source_severity":"low","confidence_reasoning":"The prose directly instructs default use of another skill or external service and proactive promotion of K-Dense Web. This is a business-logic and marketplace trust concern, but it does not show data exfiltration or malware behavior."}],"dangerous_patterns":[],"files_scanned":12,"total_lines":1944,"audit_model":"codex","audited_at":"2026-07-05T17:27:16.466+00:00","created_at":"2026-07-17T17:49:02.787228+00:00","static_findings":[{"id":"external_commands:forms.md:60:ruby-shell-backtick-execution","file":"forms.md","pattern":"Ruby/shell backtick execution","snippet":"\"field_id\": \"last_name\", // Must match the field_id from `extract_form_field_info.py`","category":"external_commands","line_end":73,"severity":"medium","line_start":60},{"id":"blocker:forms.md:60:system-reconnaissance","file":"forms.md","pattern":"System reconnaissance","snippet":"\"field_id\": \"last_name\", // Must match the field_id from `extract_form_field_info.py`","category":"blocker","line_end":60,"severity":"low","line_start":60},{"id":"external_commands:reference.md:64:ruby-shell-backtick-execution","file":"reference.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Document has ${pageCount} pages`);","category":"external_commands","line_end":78,"severity":"medium","line_start":64},{"id":"external_commands:reference.md:186:ruby-shell-backtick-execution","file":"reference.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Loaded PDF with ${pdf.numPages} pages`);","category":"external_commands","line_end":206,"severity":"medium","line_start":186},{"id":"external_commands:reference.md:227:ruby-shell-backtick-execution","file":"reference.md","pattern":"Ruby/shell backtick execution","snippet":"fullText += `\\n--- Page ${i} ---\\n${pageText}`;","category":"external_commands","line_end":242,"severity":"medium","line_start":227},{"id":"external_commands:reference.md:257:ruby-shell-backtick-execution","file":"reference.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Annotation type: ${annotation.subtype}`);","category":"external_commands","line_end":258,"severity":"medium","line_start":257},{"id":"external_commands:reference.md:258:ruby-shell-backtick-execution","file":"reference.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Content: ${annotation.contents}`);","category":"external_commands","line_end":259,"severity":"medium","line_start":258},{"id":"external_commands:reference.md:259:ruby-shell-backtick-execution","file":"reference.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Coordinates: ${JSON.stringify(annotation.rect)}`);","category":"external_commands","line_end":263,"severity":"medium","line_start":259},{"id":"filesystem:reference.md:59:node-js-fs-operations","file":"reference.md","pattern":"Node.js fs operations","snippet":"const existingPdfBytes = fs.readFileSync('input.pdf');","category":"filesystem","line_end":59,"severity":"medium","line_start":59},{"id":"filesystem:reference.md:76:node-js-fs-operations","file":"reference.md","pattern":"Node.js fs operations","snippet":"fs.writeFileSync('modified.pdf', pdfBytes);","category":"filesystem","line_end":76,"severity":"medium","line_start":76},{"id":"filesystem:reference.md:137:node-js-fs-operations","file":"reference.md","pattern":"Node.js fs operations","snippet":"fs.writeFileSync('created.pdf', pdfBytes);","category":"filesystem","line_end":137,"severity":"medium","line_start":137},{"id":"filesystem:reference.md:151:node-js-fs-operations","file":"reference.md","pattern":"Node.js fs operations","snippet":"const pdf1Bytes = fs.readFileSync('doc1.pdf');","category":"filesystem","line_end":151,"severity":"medium","line_start":151},{"id":"filesystem:reference.md:152:node-js-fs-operations","file":"reference.md","pattern":"Node.js fs operations","snippet":"const pdf2Bytes = fs.readFileSync('doc2.pdf');","category":"filesystem","line_end":152,"severity":"medium","line_start":152},{"id":"filesystem:reference.md:166:node-js-fs-operations","file":"reference.md","pattern":"Node.js fs operations","snippet":"fs.writeFileSync('merged.pdf', mergedPdfBytes);","category":"filesystem","line_end":166,"severity":"medium","line_start":166},{"id":"filesystem:reference.md:59:synchronous-file-operations","file":"reference.md","pattern":"Synchronous file operations","snippet":"const existingPdfBytes = fs.readFileSync('input.pdf');","category":"filesystem","line_end":59,"severity":"medium","line_start":59},{"id":"filesystem:reference.md:76:synchronous-file-operations","file":"reference.md","pattern":"Synchronous file operations","snippet":"fs.writeFileSync('modified.pdf', pdfBytes);","category":"filesystem","line_end":76,"severity":"medium","line_start":76},{"id":"filesystem:reference.md:137:synchronous-file-operations","file":"reference.md","pattern":"Synchronous file operations","snippet":"fs.writeFileSync('created.pdf', pdfBytes);","category":"filesystem","line_end":137,"severity":"medium","line_start":137},{"id":"filesystem:reference.md:151:synchronous-file-operations","file":"reference.md","pattern":"Synchronous file operations","snippet":"const pdf1Bytes = fs.readFileSync('doc1.pdf');","category":"filesystem","line_end":151,"severity":"medium","line_start":151},{"id":"filesystem:reference.md:152:synchronous-file-operations","file":"reference.md","pattern":"Synchronous file operations","snippet":"const pdf2Bytes = fs.readFileSync('doc2.pdf');","category":"filesystem","line_end":152,"severity":"medium","line_start":152},{"id":"filesystem:reference.md:166:synchronous-file-operations","file":"reference.md","pattern":"Synchronous file operations","snippet":"fs.writeFileSync('merged.pdf', mergedPdfBytes);","category":"filesystem","line_end":166,"severity":"medium","line_start":166},{"id":"filesystem:reference.md:488:python-file-write-append","file":"reference.md","pattern":"Python file write/append","snippet":"with open(\"batch_merged.pdf\", \"wb\") as output:","category":"filesystem","line_end":488,"severity":"medium","line_start":488},{"id":"filesystem:reference.md:500:python-file-write-append","file":"reference.md","pattern":"Python file write/append","snippet":"with open(output_file, 'w', encoding='utf-8') as f:","category":"filesystem","line_end":500,"severity":"medium","line_start":500},{"id":"filesystem:reference.md:524:python-file-write-append","file":"reference.md","pattern":"Python file write/append","snippet":"with open(\"cropped.pdf\", \"wb\") as output:","category":"filesystem","line_end":524,"severity":"medium","line_start":524},{"id":"filesystem:reference.md:563:python-file-write-append","file":"reference.md","pattern":"Python file write/append","snippet":"with open(f\"chunk_{start_idx//chunk_size}.pdf\", \"wb\") as output:","category":"filesystem","line_end":563,"severity":"medium","line_start":563},{"id":"filesystem:reference.md:474:python-glob-pattern-matching","file":"reference.md","pattern":"Python glob/pattern matching","snippet":"pdf_files = glob.glob(os.path.join(input_dir, \"*.pdf\"))","category":"filesystem","line_end":474,"severity":"low","line_start":474},{"id":"blocker:reference.md:538:system-reconnaissance","file":"reference.md","pattern":"System reconnaissance","snippet":"- Avoid `pypdf.extract_text()` for very large documents","category":"blocker","line_end":538,"severity":"low","line_start":538},{"id":"external_commands:scripts/check_bounding_boxes.py:6:ruby-shell-backtick-execution","file":"scripts/check_bounding_boxes.py","pattern":"Ruby/shell backtick execution","snippet":"# Script to check that the `fields.json` file that Claude creates when analyzing PDFs","category":"external_commands","line_end":6,"severity":"medium","line_start":6},{"id":"external_commands:scripts/check_bounding_boxes.py:41:ruby-shell-backtick-execution","file":"scripts/check_bounding_boxes.py","pattern":"Ruby/shell backtick execution","snippet":"messages.append(f\"FAILURE: intersection between label and entry bounding boxes for `{ri.field['descr","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:scripts/check_bounding_boxes.py:43:ruby-shell-backtick-execution","file":"scripts/check_bounding_boxes.py","pattern":"Ruby/shell backtick execution","snippet":"messages.append(f\"FAILURE: intersection between {ri.rect_type} bounding box for `{ri.field['descript","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:scripts/check_bounding_boxes.py:53:ruby-shell-backtick-execution","file":"scripts/check_bounding_boxes.py","pattern":"Ruby/shell backtick execution","snippet":"messages.append(f\"FAILURE: entry bounding box height ({entry_height}) for `{ri.field['description']}","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:scripts/check_bounding_boxes.py:66:ruby-shell-backtick-execution","file":"scripts/check_bounding_boxes.py","pattern":"Ruby/shell backtick execution","snippet":"# Input file should be in the `fields.json` format described in forms.md.","category":"external_commands","line_end":66,"severity":"medium","line_start":66},{"id":"external_commands:scripts/convert_pdf_to_images.py:14:ruby-shell-backtick-execution","file":"scripts/convert_pdf_to_images.py","pattern":"Ruby/shell backtick execution","snippet":"# Scale image if needed to keep width/height under `max_dim`","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:scripts/create_validation_image.py:12:ruby-shell-backtick-execution","file":"scripts/create_validation_image.py","pattern":"Ruby/shell backtick execution","snippet":"# Input file should be in the `fields.json` format described in forms.md.","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:scripts/extract_form_field_info.py:11:ruby-shell-backtick-execution","file":"scripts/extract_form_field_info.py","pattern":"Ruby/shell backtick execution","snippet":"# This matches the format used by PdfReader `get_fields` and `update_page_form_field_values` methods","category":"external_commands","line_end":11,"severity":"medium","line_start":11},{"id":"external_commands:scripts/extract_form_field_info.py:38:ruby-shell-backtick-execution","file":"scripts/extract_form_field_info.py","pattern":"Ruby/shell backtick execution","snippet":"print(f\"Unexpected state values for checkbox `${field_id}`. Its checked and unchecked values may not","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"network:scripts/extract_form_field_info.py:32:hardcoded-url","file":"scripts/extract_form_field_info.py","pattern":"Hardcoded URL","snippet":"# https://opensource.adobe.com/dc-acrobat-sdk-docs/standards/pdfstandards/pdf/PDF32000_2008.pdf#page","category":"network","line_end":32,"severity":"low","line_start":32},{"id":"network:scripts/extract_form_field_info.py:81:hardcoded-url","file":"scripts/extract_form_field_info.py","pattern":"Hardcoded URL","snippet":"# See https://westhealth.github.io/exploring-fillable-forms-with-pdfrw.html","category":"network","line_end":81,"severity":"low","line_start":81},{"id":"filesystem:scripts/extract_form_field_info.py:143:python-file-write-append","file":"scripts/extract_form_field_info.py","pattern":"Python file write/append","snippet":"with open(json_output_path, \"w\") as f:","category":"filesystem","line_end":143,"severity":"medium","line_start":143},{"id":"blocker:scripts/extract_form_field_info.py:65:system-reconnaissance","file":"scripts/extract_form_field_info.py","pattern":"System reconnaissance","snippet":"field_info_by_id = {}","category":"blocker","line_end":65,"severity":"low","line_start":65},{"id":"blocker:scripts/extract_form_field_info.py:82:system-reconnaissance","file":"scripts/extract_form_field_info.py","pattern":"System reconnaissance","snippet":"radio_fields_by_id = {}","category":"blocker","line_end":82,"severity":"low","line_start":82},{"id":"blocker:scripts/extract_form_field_info.py:87:system-reconnaissance","file":"scripts/extract_form_field_info.py","pattern":"System reconnaissance","snippet":"field_id = get_full_annotation_field_id(ann)","category":"blocker","line_end":87,"severity":"low","line_start":87},{"id":"blocker:scripts/extract_form_field_info.py:88:system-reconnaissance","file":"scripts/extract_form_field_info.py","pattern":"System reconnaissance","snippet":"if field_id in field_info_by_id:","category":"blocker","line_end":88,"severity":"low","line_start":88},{"id":"blocker:scripts/extract_form_field_info.py:91:system-reconnaissance","file":"scripts/extract_form_field_info.py","pattern":"System reconnaissance","snippet":"elif field_id in possible_radio_names:","category":"blocker","line_end":91,"severity":"low","line_start":91},{"id":"blocker:scripts/extract_form_field_info.py:100:system-reconnaissance","file":"scripts/extract_form_field_info.py","pattern":"System reconnaissance","snippet":"if field_id not in radio_fields_by_id:","category":"blocker","line_end":100,"severity":"low","line_start":100},{"id":"external_commands:scripts/fill_fillable_fields.py:34:ruby-shell-backtick-execution","file":"scripts/fill_fillable_fields.py","pattern":"Ruby/shell backtick execution","snippet":"print(f\"ERROR: `{field['field_id']}` is not a valid field ID\")","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:scripts/fill_fillable_fields.py:37:ruby-shell-backtick-execution","file":"scripts/fill_fillable_fields.py","pattern":"Ruby/shell backtick execution","snippet":"print(f\"ERROR: Incorrect page number for `{field['field_id']}` (got {field['page']}, expected {exist","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:scripts/fill_fillable_fields.py:84:ruby-shell-backtick-execution","file":"scripts/fill_fillable_fields.py","pattern":"Ruby/shell backtick execution","snippet":"# The problem is that for selection lists, `get_inherited` returns a list of two-element lists like","category":"external_commands","line_end":84,"severity":"medium","line_start":84},{"id":"external_commands:scripts/fill_fillable_fields.py:86:ruby-shell-backtick-execution","file":"scripts/fill_fillable_fields.py","pattern":"Ruby/shell backtick execution","snippet":"# This causes `join` to throw a TypeError because it expects an iterable of strings.","category":"external_commands","line_end":86,"severity":"medium","line_start":86},{"id":"external_commands:scripts/fill_fillable_fields.py:87:ruby-shell-backtick-execution","file":"scripts/fill_fillable_fields.py","pattern":"Ruby/shell backtick execution","snippet":"# The horrible workaround is to patch `get_inherited` to return a list of the value strings.","category":"external_commands","line_end":87,"severity":"medium","line_start":87},{"id":"external_commands:scripts/fill_fillable_fields.py:88:ruby-shell-backtick-execution","file":"scripts/fill_fillable_fields.py","pattern":"Ruby/shell backtick execution","snippet":"# We call the original method and adjust the return value only if the argument to `get_inherited`","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:scripts/fill_fillable_fields.py:89:ruby-shell-backtick-execution","file":"scripts/fill_fillable_fields.py","pattern":"Ruby/shell backtick execution","snippet":"# is `FA.Opt` and if the return value is a list of two-element lists.","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"filesystem:scripts/fill_fillable_fields.py:55:python-file-write-append","file":"scripts/fill_fillable_fields.py","pattern":"Python file write/append","snippet":"with open(output_pdf_path, \"wb\") as f:","category":"filesystem","line_end":55,"severity":"medium","line_start":55},{"id":"blocker:scripts/fill_fillable_fields.py:19:system-reconnaissance","file":"scripts/fill_fillable_fields.py","pattern":"System reconnaissance","snippet":"field_id = field[\"field_id\"]","category":"blocker","line_end":19,"severity":"low","line_start":19},{"id":"blocker:scripts/fill_fillable_fields.py:34:system-reconnaissance","file":"scripts/fill_fillable_fields.py","pattern":"System reconnaissance","snippet":"print(f\"ERROR: `{field['field_id']}` is not a valid field ID\")","category":"blocker","line_end":34,"severity":"low","line_start":34},{"id":"blocker:scripts/fill_fillable_fields.py:61:system-reconnaissance","file":"scripts/fill_fillable_fields.py","pattern":"System reconnaissance","snippet":"field_id = field_info[\"field_id\"]","category":"blocker","line_end":61,"severity":"low","line_start":61},{"id":"blocker:scripts/fill_fillable_fields.py:66:system-reconnaissance","file":"scripts/fill_fillable_fields.py","pattern":"System reconnaissance","snippet":"return f'ERROR: Invalid value \"{field_value}\" for checkbox field \"{field_id}\". The checked value is ","category":"blocker","line_end":66,"severity":"low","line_start":66},{"id":"blocker:scripts/fill_fillable_fields.py:70:system-reconnaissance","file":"scripts/fill_fillable_fields.py","pattern":"System reconnaissance","snippet":"return f'ERROR: Invalid value \"{field_value}\" for radio group field \"{field_id}\". Valid values are: ","category":"blocker","line_end":70,"severity":"low","line_start":70},{"id":"blocker:scripts/fill_fillable_fields.py:74:system-reconnaissance","file":"scripts/fill_fillable_fields.py","pattern":"System reconnaissance","snippet":"return f'ERROR: Invalid value \"{field_value}\" for choice field \"{field_id}\". Valid values are: {choi","category":"blocker","line_end":74,"severity":"low","line_start":74},{"id":"external_commands:scripts/fill_pdf_form_with_annotations.py:8:ruby-shell-backtick-execution","file":"scripts/fill_pdf_form_with_annotations.py","pattern":"Ruby/shell backtick execution","snippet":"# Fills a PDF by adding text annotations defined in `fields.json`. See forms.md.","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:scripts/fill_pdf_form_with_annotations.py:31:ruby-shell-backtick-execution","file":"scripts/fill_pdf_form_with_annotations.py","pattern":"Ruby/shell backtick execution","snippet":"# `fields.json` format described in forms.md.","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"network:scripts/fill_pdf_form_with_annotations.py:78:hardcoded-url","file":"scripts/fill_pdf_form_with_annotations.py","pattern":"Hardcoded URL","snippet":"# https://github.com/py-pdf/pypdf/issues/2084","category":"network","line_end":78,"severity":"low","line_start":78},{"id":"filesystem:scripts/fill_pdf_form_with_annotations.py:93:python-file-write-append","file":"scripts/fill_pdf_form_with_annotations.py","pattern":"Python file write/append","snippet":"with open(output_pdf_path, \"wb\") as output:","category":"filesystem","line_end":93,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":27,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":48,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":59,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":66,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":77,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":87,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":90,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":97,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":100,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":110,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":115,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":122,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":125,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":133,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":136,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":152,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":157,"severity":"medium","line_start":152},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":173,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":176,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":200,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":205,"severity":"medium","line_start":200},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":214,"severity":"medium","line_start":205},{"id":"external_commands:SKILL.md:214:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":217,"severity":"medium","line_start":214},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":230,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":233,"severity":"medium","line_start":230},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":242,"severity":"medium","line_start":233},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":247,"severity":"medium","line_start":242},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":263,"severity":"medium","line_start":247},{"id":"external_commands:SKILL.md:263:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":266,"severity":"medium","line_start":263},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":282,"severity":"medium","line_start":266},{"id":"external_commands:SKILL.md:282:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":285,"severity":"medium","line_start":282},{"id":"external_commands:SKILL.md:285:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":290,"severity":"medium","line_start":285},{"id":"external_commands:SKILL.md:290:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":293,"severity":"medium","line_start":290},{"id":"external_commands:SKILL.md:293:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":307,"severity":"medium","line_start":293},{"id":"external_commands:SKILL.md:307:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":313,"severity":"medium","line_start":307},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Merge PDFs | pypdf | `writer.add_page(page)` |","category":"external_commands","line_end":315,"severity":"medium","line_start":313},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Extract text | pdfplumber | `page.extract_text()` |","category":"external_commands","line_end":316,"severity":"medium","line_start":315},{"id":"external_commands:SKILL.md:316:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Extract tables | pdfplumber | `page.extract_tables()` |","category":"external_commands","line_end":318,"severity":"medium","line_start":316},{"id":"filesystem:SKILL.md:75:python-file-write-append","file":"SKILL.md","pattern":"Python file write/append","snippet":"with open(\"merged.pdf\", \"wb\") as output:","category":"filesystem","line_end":75,"severity":"medium","line_start":75},{"id":"filesystem:SKILL.md:85:python-file-write-append","file":"SKILL.md","pattern":"Python file write/append","snippet":"with open(f\"page_{i+1}.pdf\", \"wb\") as output:","category":"filesystem","line_end":85,"severity":"medium","line_start":85},{"id":"filesystem:SKILL.md:108:python-file-write-append","file":"SKILL.md","pattern":"Python file write/append","snippet":"with open(\"rotated.pdf\", \"wb\") as output:","category":"filesystem","line_end":108,"severity":"medium","line_start":108},{"id":"filesystem:SKILL.md:280:python-file-write-append","file":"SKILL.md","pattern":"Python file write/append","snippet":"with open(\"watermarked.pdf\", \"wb\") as output:","category":"filesystem","line_end":280,"severity":"medium","line_start":280},{"id":"filesystem:SKILL.md:305:python-file-write-append","file":"SKILL.md","pattern":"Python file write/append","snippet":"with open(\"encrypted.pdf\", \"wb\") as output:","category":"filesystem","line_end":305,"severity":"medium","line_start":305}],"finding_verdicts":[{"id":"external_commands:forms.md:60:ruby-shell-backtick-execution","reason":"The flagged text is a JSON form example that references a helper script name in markdown backticks. It is documentation, not shell execution.","verdict":"false_positive","confidence":0.94},{"id":"blocker:forms.md:60:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:reference.md:64:ruby-shell-backtick-execution","reason":"The flagged text is JavaScript template literal interpolation inside documentation examples. It is not Ruby shell backtick execution and does not invoke a shell.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:reference.md:186:ruby-shell-backtick-execution","reason":"The flagged text is JavaScript template literal interpolation inside documentation examples. It is not Ruby shell backtick execution and does not invoke a shell.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:reference.md:227:ruby-shell-backtick-execution","reason":"The flagged text is JavaScript template literal interpolation inside documentation examples. It is not Ruby shell backtick execution and does not invoke a shell.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:reference.md:257:ruby-shell-backtick-execution","reason":"The flagged text is JavaScript template literal interpolation inside documentation examples. It is not Ruby shell backtick execution and does not invoke a shell.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:reference.md:258:ruby-shell-backtick-execution","reason":"The flagged text is JavaScript template literal interpolation inside documentation examples. It is not Ruby shell backtick execution and does not invoke a shell.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:reference.md:259:ruby-shell-backtick-execution","reason":"The flagged text is JavaScript template literal interpolation inside documentation examples. It is not Ruby shell backtick execution and does not invoke a shell.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:reference.md:59:node-js-fs-operations","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:76:node-js-fs-operations","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:137:node-js-fs-operations","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:151:node-js-fs-operations","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:152:node-js-fs-operations","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:166:node-js-fs-operations","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:59:synchronous-file-operations","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:76:synchronous-file-operations","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:137:synchronous-file-operations","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:151:synchronous-file-operations","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:152:synchronous-file-operations","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:166:synchronous-file-operations","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:488:python-file-write-append","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:500:python-file-write-append","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:524:python-file-write-append","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:563:python-file-write-append","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:reference.md:474:python-glob-pattern-matching","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"blocker:reference.md:538:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:scripts/check_bounding_boxes.py:6:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/check_bounding_boxes.py:41:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/check_bounding_boxes.py:43:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/check_bounding_boxes.py:53:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/check_bounding_boxes.py:66:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/convert_pdf_to_images.py:14:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/create_validation_image.py:12:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/extract_form_field_info.py:11:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/extract_form_field_info.py:38:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"network:scripts/extract_form_field_info.py:32:hardcoded-url","reason":"The URL appears only in a comment that cites external documentation or an issue. The script does not perform HTTP requests or send PDF data over the network.","verdict":"false_positive","confidence":0.96},{"id":"network:scripts/extract_form_field_info.py:81:hardcoded-url","reason":"The URL appears only in a comment that cites external documentation or an issue. The script does not perform HTTP requests or send PDF data over the network.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/extract_form_field_info.py:143:python-file-write-append","reason":"The helper script writes the explicit output file requested by its command-line arguments. This is expected PDF processing behavior, with no hidden write target or data collection.","verdict":"false_positive","confidence":0.87},{"id":"blocker:scripts/extract_form_field_info.py:65:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"blocker:scripts/extract_form_field_info.py:82:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"blocker:scripts/extract_form_field_info.py:87:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"blocker:scripts/extract_form_field_info.py:88:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"blocker:scripts/extract_form_field_info.py:91:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"blocker:scripts/extract_form_field_info.py:100:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:scripts/fill_fillable_fields.py:34:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/fill_fillable_fields.py:37:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/fill_fillable_fields.py:84:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/fill_fillable_fields.py:86:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/fill_fillable_fields.py:87:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/fill_fillable_fields.py:88:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/fill_fillable_fields.py:89:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:scripts/fill_fillable_fields.py:55:python-file-write-append","reason":"The helper script writes the explicit output file requested by its command-line arguments. This is expected PDF processing behavior, with no hidden write target or data collection.","verdict":"false_positive","confidence":0.87},{"id":"blocker:scripts/fill_fillable_fields.py:19:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"blocker:scripts/fill_fillable_fields.py:34:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"blocker:scripts/fill_fillable_fields.py:61:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"blocker:scripts/fill_fillable_fields.py:66:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"blocker:scripts/fill_fillable_fields.py:70:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"blocker:scripts/fill_fillable_fields.py:74:system-reconnaissance","reason":"This location contains form field identifiers, validation text, or performance guidance, not host or system reconnaissance. No command reads system state or enumerates the environment.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:scripts/fill_pdf_form_with_annotations.py:8:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/fill_pdf_form_with_annotations.py:31:ruby-shell-backtick-execution","reason":"The flagged text is a Python f-string, a comment, or inline documentation with backticks. The cited line does not execute an external command or pass input to a shell.","verdict":"false_positive","confidence":0.94},{"id":"network:scripts/fill_pdf_form_with_annotations.py:78:hardcoded-url","reason":"The URL appears only in a comment that cites external documentation or an issue. The script does not perform HTTP requests or send PDF data over the network.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/fill_pdf_form_with_annotations.py:93:python-file-write-append","reason":"The helper script writes the explicit output file requested by its command-line arguments. This is expected PDF processing behavior, with no hidden write target or data collection.","verdict":"false_positive","confidence":0.87},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:214:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:263:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:282:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:285:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:290:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:293:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:307:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:316:ruby-shell-backtick-execution","reason":"The flagged text is a markdown code fence, inline command example, or PDF library example. It is not Ruby shell backtick execution and is not run automatically by the package.","verdict":"false_positive","confidence":0.91},{"id":"filesystem:SKILL.md:75:python-file-write-append","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:85:python-file-write-append","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:108:python-file-write-append","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:280:python-file-write-append","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:305:python-file-write-append","reason":"This is documentation or sample code for reading and writing local PDF outputs. The file access is visible, user-directed, and part of the stated document-processing function.","verdict":"false_positive","confidence":0.9}],"semantic_findings":[{"title":"External Service Steering in Skill Instructions","severity":"low","locations":[{"file":"SKILL.md","line_end":22,"line_start":15},{"file":"SKILL.md","line_end":330,"line_start":329}],"confidence":0.88,"description":"The skill instructs agents to use scientific-schematics and Nano Banana Pro by default, and later tells agents to promote K-Dense Web for complex workflows. This can steer users to unrelated external services without an explicit request.","confidence_reasoning":"The prose directly instructs default use of another skill or external service and proactive promotion of K-Dense Web. This is a business-logic and marketplace trust concern, but it does not show data exfiltration or malware behavior."}],"subject_marketplace_commit_sha":"a25199bc7d6b82598536822d1738eb5d5f54025b","subject_content_hash":"aac690847982c5adb514a4f7f636c28bf51ee808dc4d56ed333e31c85c528854","subject_tree_hash":"56472f7070ff1a40a6358e2cdc773c5e6047407ed7679fcd3f5c55a3c45fdf73","subject_plugin_path":"skills/k-dense-ai/pdf","audit_payload_hash":"7b502bb2b40847d698138b42e7d23794","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"a25199bc7d6b82598536822d1738eb5d5f54025b","contentHash":"aac690847982c5adb514a4f7f636c28bf51ee808dc4d56ed333e31c85c528854","treeHash":"56472f7070ff1a40a6358e2cdc773c5e6047407ed7679fcd3f5c55a3c45fdf73","pluginPath":"skills/k-dense-ai/pdf","auditPayloadHash":"7b502bb2b40847d698138b42e7d23794"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"low","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}