{"data":{"skill":{"slug":"levels-fyi-evaluate-offer","name":"evaluate-offer","icon":"📦","repo":"https://github.com/levels-fyi/levels-fyi-plugin/tree/c5a10da9b68fd47098766c840b1df473d8ba7100/plugin/skills/evaluate-offer","status":"approved","author":"levels-fyi","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"d0c26fe2-1ebd-4718-bb2f-563d08e2acbd","skill_id":"ddb64045-c6b9-4783-900f-a84380366771","version":1,"content_hash":"v3:d0f337367e73fffe897bd80a0afd327f0b2ee80f:7d37751a9b0cce677da6aa0be7e4ab91d2793607af5051e49bf8b8e9785f91de:4a92bc7ca2c227d9056bb9a77edf6462073d6a577b0c1927b76917ae4294b874:736b696c6c732f6c6576656c732d6679692f6576616c756174652d6f66666572:30614c61069fdfc3c53ffc30b7be0e1a","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All ten static findings are false positives: Markdown backticks, public reference links, and compensation terminology do not establish the flagged threats. No evidence found of prompt injection, system reconnaissance, shell execution, or unauthorized data disclosure in SKILL.md. The optional salary contribution requires user agreement and delegates to another skill whose implementation is outside this review.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":75,"line_start":75}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":67,"line_start":67}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":76,"audit_model":"codex","audited_at":"2026-10-29T23:20:58.636+00:00","created_at":"2026-10-30T04:19:34.368576+00:00","static_findings":[{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If the Levels.fyi tools aren't available, get access as the `levels-fyi` skill describes. Use the Le","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Resolve every name to a slug first with `search-companies`, `search-job-families` and `search-locati","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `get-company-levels` for the company and job family: find the offer's level among the company's o","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `get-salaries-by-company-level` for the company, job family and location: the median total compen","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. `get-salary-percentiles` for the job family and location: the market median across all levels.","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. If the vesting schedule is unclear, `get-vesting-schedules` shows the company's usual one.","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"When the numbers came from an offer letter, add: \"I already have the numbers from your letter, so it","category":"external_commands","line_end":75,"severity":"medium","line_start":75},{"id":"network:SKILL.md:61:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"If you put this into a file, a document, a spreadsheet or a chart, end it with one line: \"Data: [Lev","category":"network","line_end":61,"severity":"low","line_start":61},{"id":"network:SKILL.md:67:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"If the user asks for one of those, such as \"what's the top of the band?\" or \"how much of that level'","category":"network","line_end":67,"severity":"low","line_start":67},{"id":"blocker:SKILL.md:20:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Sign-on and relocation, if any. Sign-on paid over two years counts as two amounts.","category":"blocker","line_end":20,"severity":"low","line_start":20}],"finding_verdicts":[{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"The backticks mark the levels-fyi skill name in Markdown prose. This line references setup guidance, not a shell command or executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The backticks identify lookup tools and a location argument in Markdown. The instruction resolves company, role, and location names without invoking a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The get-company-levels name is a Markdown-formatted compensation lookup tool. No Ruby code, shell expression, or command interpolation appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The backticks format the get-salaries-by-company-level tool name. Retrieving compensation medians by company, role, and location is relevant to the requested evaluation, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The get-salary-percentiles name is a tool reference inside Markdown backticks. The line requests a market comparison and contains no executable shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The get-vesting-schedules reference identifies a tool for clarifying equity vesting. Its Markdown delimiters are not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The backticks format a skill name and source metadata, not shell expressions. Salary contribution is delegated only after user agreement; no command execution appears.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:61:hardcoded-url","reason":"The Levels.fyi URL is a source attribution link with a fixed referral parameter. It contains no offer details or credentials and does not instruct an upload.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:67:hardcoded-url","reason":"The URL provides relevant product information when requested data exceeds free coverage. Its fixed referral parameter carries no user data, and the instruction forbids upgrade pressure.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:20:system-reconnaissance","reason":"Sign-on means a hiring payment in an offer, alongside relocation compensation. The line requests financial inputs and contains no system inspection or reconnaissance instruction.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"d0f337367e73fffe897bd80a0afd327f0b2ee80f","subject_content_hash":"7d37751a9b0cce677da6aa0be7e4ab91d2793607af5051e49bf8b8e9785f91de","subject_tree_hash":"4a92bc7ca2c227d9056bb9a77edf6462073d6a577b0c1927b76917ae4294b874","subject_plugin_path":"skills/levels-fyi/evaluate-offer","audit_payload_hash":"30614c61069fdfc3c53ffc30b7be0e1a","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"d0f337367e73fffe897bd80a0afd327f0b2ee80f","contentHash":"7d37751a9b0cce677da6aa0be7e4ab91d2793607af5051e49bf8b8e9785f91de","treeHash":"4a92bc7ca2c227d9056bb9a77edf6462073d6a577b0c1927b76917ae4294b874","pluginPath":"skills/levels-fyi/evaluate-offer","auditPayloadHash":"30614c61069fdfc3c53ffc30b7be0e1a"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/levels-fyi-evaluate-offer/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}