{"data":{"skill":{"slug":"levels-fyi-benchmark-my-pay","name":"benchmark-my-pay","icon":"📦","repo":"https://github.com/levels-fyi/levels-fyi-plugin/tree/c5a10da9b68fd47098766c840b1df473d8ba7100/plugin/skills/benchmark-my-pay","status":"approved","author":"levels-fyi","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"8720cdca-7b28-4c64-82ae-d4b138cc8869","skill_id":"539839ea-63da-48f2-b817-e9f1dc1194df","version":1,"content_hash":"v3:d0f337367e73fffe897bd80a0afd327f0b2ee80f:8dfc4128709c7f652364489495fae913253b335f22d96ddbe704675c055d557c:873a2e7bb13d227e6afccec80d3e3cdc3db0c6bbc48d02a793292a960a683436:736b696c6c732f6c6576656c732d6679692f62656e63686d61726b2d6d792d706179:081f29fca407d1148fffebca0fa70c77","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All seven static findings are false positives: six match Markdown references, and one identifies an ordinary Levels.fyi attribution link. Salary contribution requires an explicit yes and delegates to another skill; no evidence found of unauthorized disclosure or prompt injection in this file. Referenced skills and external tool implementations are outside this audit.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":56,"line_start":56}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":48,"line_start":48}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":57,"audit_model":"codex","audited_at":"2026-10-29T23:12:04.852+00:00","created_at":"2026-10-30T04:19:07.214055+00:00","static_findings":[{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If the Levels.fyi tools aren't available, get access as the `levels-fyi` skill describes. Use the Le","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Resolve every name to a slug first with `search-companies`, `search-job-families` and `search-locati","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `get-company-levels` for the company and job family: find the user's level among the company's ow","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `get-salaries-by-company-level` for the company, job family and location: the median total compen","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. `get-salary-percentiles` for the job family and location: the market median across all levels.","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"When the numbers came from a document, add: \"I already have the numbers from your [letter / statemen","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"network:SKILL.md:48:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"End with one line, \"Data: Levels.fyi, medians from the last 12 months.\", and link Levels.fyi in it (","category":"network","line_end":48,"severity":"low","line_start":48}],"finding_verdicts":[{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"Backticks mark names of related skills in Markdown prose. This line contains no shell execution or executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Backticks format lookup tool names and a location parameter example. These are legitimate salary query instructions, not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"The backticks format get-company-levels, a tool used to identify company job levels. No shell expression or command execution appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The backticks format get-salaries-by-company-level, a compensation lookup tool. The country fallback is a query instruction, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The backticks identify get-salary-percentiles for a market median lookup. Markdown formatting does not execute code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"Backticks format a related skill and metadata values, not executable statements. The contribution handoff requires user agreement and stops after refusal.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:48:hardcoded-url","reason":"The HTTPS URL is an attribution link to Levels.fyi with a fixed referral parameter. It contains no compensation data or credentials and directs no upload.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"d0f337367e73fffe897bd80a0afd327f0b2ee80f","subject_content_hash":"8dfc4128709c7f652364489495fae913253b335f22d96ddbe704675c055d557c","subject_tree_hash":"873a2e7bb13d227e6afccec80d3e3cdc3db0c6bbc48d02a793292a960a683436","subject_plugin_path":"skills/levels-fyi/benchmark-my-pay","audit_payload_hash":"081f29fca407d1148fffebca0fa70c77","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"d0f337367e73fffe897bd80a0afd327f0b2ee80f","contentHash":"8dfc4128709c7f652364489495fae913253b335f22d96ddbe704675c055d557c","treeHash":"873a2e7bb13d227e6afccec80d3e3cdc3db0c6bbc48d02a793292a960a683436","pluginPath":"skills/levels-fyi/benchmark-my-pay","auditPayloadHash":"081f29fca407d1148fffebca0fa70c77"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/levels-fyi-benchmark-my-pay/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}