{"data":{"skill":{"slug":"levels-fyi-contribute-salary","name":"contribute-salary","icon":"📦","repo":"https://github.com/levels-fyi/levels-fyi-plugin/tree/c5a10da9b68fd47098766c840b1df473d8ba7100/plugin/skills/contribute-salary","status":"approved","author":"levels-fyi","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"dd9ccf4f-a5c2-4cc2-8f95-969539c43c61","skill_id":"24d53a45-9468-46ea-bfe8-6caf63f8c5bf","version":1,"content_hash":"v3:d0f337367e73fffe897bd80a0afd327f0b2ee80f:10176e7b9c47b547ee94449a3272b6c115b2d99c1b5e2aa9b6665848f4b31ba7:1debe5ebb0b5854ecf09a9ded21a4377d7ebd0673e6e5ca6aab2ae80a4bed684:736b696c6c732f6c6576656c732d6679692f636f6e747269627574652d73616c617279:d466fd054817670684dff6cd7abbc136","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 19 static findings are false positives: Markdown backticks describe tools or fields, and work arrangement is not system reconnaissance. No evidence found of prompt injection, shell execution, or covert data collection in SKILL.md. The workflow sends user-provided compensation data to Levels.fyi for preview and requires explicit confirmation before final submission; connector behavior is outside this review.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":55,"line_start":55}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":64,"audit_model":"codex","audited_at":"2026-10-29T23:17:33.002+00:00","created_at":"2026-10-30T04:19:25.352581+00:00","static_findings":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Help the user add their own pay or an offer they received, using `add-salary-submission`. No account","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Company, role and title.** Resolve with `search-companies` and `search-job-families`. Use `comp","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Location: a city.** Use `search-locations` with `type: \"city\"`; a metro, state or country won't","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Level.** Use the company's own level name from `get-company-levels` when the company has a ladd","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"8. **Sign-on and relocation:** offers only. For current pay, put them in `otherDetails`.","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"For stock options, set `stockType` to `option` and send `totalOptionsGranted` (or `avgAnnualOptionsG","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`vestingSchedule` has one entry per year: `percent` of the grant vesting that year, and `occurrences","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- \"4 years, 1-year cliff, then quarterly\": `[{percent:25, occurrences:1}, {percent:25, occurrences:4","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- \"4 years, vests monthly\": four entries of `{percent:25, occurrences:12}`","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- \"5/15/40/40\": `[{percent:5, ...}, {percent:15, ...}, {percent:40, ...}, {percent:40, ...}]`, with ","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If the user doesn't know, `get-vesting-schedules` shows the company's usual schedule. Confirm it wit","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Generate one UUID as `submissionId` and keep it for this submission.","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Call `add-salary-submission` with `confirm: false`. Set `source` to `user_document` when the numb","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Show the preview in this form, leaving out lines that don't apply, and ask about anything in `not","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. If the user isn't signed in, ask for their email and pass it as `email`. Say it's used to verify ","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. If the user asks for enhanced anonymity, at any point, set `anonymise: true`. It can hide details","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. Only after a clear yes, call again with the same arguments, the same `submissionId`, and `confirm","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If a call fails, fix what the error names and retry with the same `submissionId`, so a retry can't a","category":"external_commands","line_end":55,"severity":"medium","line_start":55},{"id":"blocker:SKILL.md:30:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"9. **Years of experience** and **work arrangement** (remote, hybrid or office).","category":"blocker","line_end":30,"severity":"low","line_start":30}],"finding_verdicts":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","reason":"The backticks format the connected Levels.fyi tool name in Markdown, not a shell expression. Line 10 restricts submission to those tools.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"Backticks identify company and job-family lookup tools and a fallback field. This prose contains no Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The inline spans name a location lookup tool and its city filter. They describe structured tool arguments, not executable shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The backticks mark a company-level lookup tool in Markdown. Resolving a compensation level is task-relevant and does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"The backticks surround the otherDetails field name. The line explains where compensation information belongs and contains no command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The inline spans identify stock-option fields and a literal option type. These are structured compensation inputs, not shell substitutions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The backticks format vestingSchedule, percent, and occurrences as field names. The sentence defines a data structure without executing code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The inline array illustrates yearly vesting percentages and frequencies. It is a Markdown data example, not a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The backtick span shows a vesting data entry with numeric fields. There is no execution mechanism or command payload.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The inline array is an illustrative vesting allocation with placeholders. Markdown formatting does not execute this compensation data.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The span names a tool for retrieving typical vesting schedules. The instruction requires user confirmation before using a suggested schedule.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The backticks identify the submissionId field for a UUID. This is duplicate-prevention guidance, not a shell invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The inline spans name the submission tool, preview flag, and source values. They describe an intended compensation preview through the connector, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The backticks identify the notProvided response field. The instruction asks the user about missing details and does not execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The inline span marks an email argument for submission verification. The prose requests user input and restricts email reuse; it contains no shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The backticks format the anonymise boolean argument. This requested privacy setting is structured tool data, not an executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The spans identify the stable submission identifier and final confirmation flag. The instruction explicitly requires user approval and does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The backticks mark the submissionId field reused after an error. This is retry guidance intended to prevent duplicates, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:30:system-reconnaissance","reason":"The line asks for employment experience and remote, hybrid, or office work arrangement. It does not inspect a computer, network, or system configuration.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"d0f337367e73fffe897bd80a0afd327f0b2ee80f","subject_content_hash":"10176e7b9c47b547ee94449a3272b6c115b2d99c1b5e2aa9b6665848f4b31ba7","subject_tree_hash":"1debe5ebb0b5854ecf09a9ded21a4377d7ebd0673e6e5ca6aab2ae80a4bed684","subject_plugin_path":"skills/levels-fyi/contribute-salary","audit_payload_hash":"d466fd054817670684dff6cd7abbc136","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"d0f337367e73fffe897bd80a0afd327f0b2ee80f","contentHash":"10176e7b9c47b547ee94449a3272b6c115b2d99c1b5e2aa9b6665848f4b31ba7","treeHash":"1debe5ebb0b5854ecf09a9ded21a4377d7ebd0673e6e5ca6aab2ae80a4bed684","pluginPath":"skills/levels-fyi/contribute-salary","auditPayloadHash":"d466fd054817670684dff6cd7abbc136"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/levels-fyi-contribute-salary/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}