{"data":{"skill":{"slug":"limrun-inc-limrun-bazel","name":"limrun-bazel","icon":"📦","repo":"https://github.com/limrun-inc/skills/tree/1ed3b6bfb7272c8a4799f5ce724affaa93dc3132/skills/limrun-bazel","status":"approved","author":"limrun-inc","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"6487b5e4-abf3-48bb-b18f-e076cbc6c454","skill_id":"ebfa5482-245a-4d78-9732-88a2e64e408b","version":1,"content_hash":"v3:7f17813fb6af1acc7d8fd3fb5f05480f5be52783:da99f6c5efaf6960efbca959d01edcd55723c816f7208773f990b180acfb67c4:219f0053d36544e9b1078d6de0c3dd4c1201c1c22ed0a100b887cb3c243fd640:736b696c6c732f6c696d72756e2d696e632f6c696d72756e2d62617a656c:46340014b0876fa12fe54830ca3d87f3","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 49 static findings are false positives from Markdown formatting, documented service authentication, or platform descriptions. No evidence found of credential exfiltration, malicious reconnaissance, or prompt injection. The workflow intentionally uses external packages, remote build workers, and cloud app installation; their implementations are not included for review.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":33,"line_start":31},{"file":"SKILL.md","line_end":35,"line_start":33},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":45,"line_start":44},{"file":"SKILL.md","line_end":46,"line_start":45},{"file":"SKILL.md","line_end":47,"line_start":46},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":50,"line_start":48},{"file":"SKILL.md","line_end":54,"line_start":50},{"file":"SKILL.md","line_end":56,"line_start":54},{"file":"SKILL.md","line_end":59,"line_start":56},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":63,"line_start":60},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":74,"line_start":71},{"file":"SKILL.md","line_end":76,"line_start":74},{"file":"SKILL.md","line_end":81,"line_start":76},{"file":"SKILL.md","line_end":88,"line_start":81},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":92,"line_start":92}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":81,"line_start":81}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":89,"line_start":89}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":96,"audit_model":"codex","audited_at":"2026-10-13T15:30:59.173+00:00","created_at":"2026-10-13T18:58:48.999049+00:00","static_findings":[{"id":"external_commands:SKILL.md:3:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"description: \"The default way to build any Bazel workspace on Limrun: build its iOS and Android targ","category":"external_commands","line_end":3,"severity":"medium","line_start":3},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`lim bazel setup` points a Bazel workspace at Limrun's build plane: Apple","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Install with npm: `npm install --global lim` (0.44.0 or later). The npm","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"package also installs `lim-bazel-credentials`, the credential helper Bazel","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"calls; the standalone tarball and DotSlash builds do not put it on `PATH`,","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"so Bazel cannot authenticate with them. Auth is `lim login` or `LIM_API_KEY`","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"asking). The helper reads only `lim login` or `LIM_API_KEY`, never a key","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"passed with `--api-key`. The CLI is the source of truth: if a flag errors,","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"check `lim bazel setup --help` instead of guessing.","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run inside the workspace (it walks up to the directory with `MODULE.bazel`):","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":33,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":35,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"It needs Bazel 8 or later and `rules_apple` or `rules_android` in the root","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`MODULE.bazel`. It writes a gitignored `.limrun/` with the `--config=limrun`","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"configuration and adds a `try-import` to `.bazelrc`. Nothing secret is","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--region <name>` pins one.","category":"external_commands","line_end":42,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Android:** Linux workers need `rules_cc`, `rules_java`, `protobuf` and","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`hermetic_android_toolchains` in the root `MODULE.bazel`. Setup prints the","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"missing lines and asks; `--yes` adds them without asking. Without a","category":"external_commands","line_end":45,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"terminal and without `--yes` it stops and prints the lines, so pass","category":"external_commands","line_end":46,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--yes` in scripts and CI.","category":"external_commands","line_end":47,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Java runtime:** a `--java_runtime_version` already in `.bazelrc` is","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"kept; otherwise the limrun config uses `remotejdk_17`.","category":"external_commands","line_end":50,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Apple or Android rules. Do not hand-edit `.limrun/`.","category":"external_commands","line_end":54,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":56,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":59,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(the `.apk` or `.ipa`). Without `--config=limrun`, Bazel builds as before.","category":"external_commands","line_end":59,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Own flags for the limrun path go in `user.limrun.bazelrc` at the workspace","category":"external_commands","line_end":63,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"In CI: install `lim` from npm, set `LIM_API_KEY` as a secret, run","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`lim bazel setup --yes`, then build with `--config=limrun`.","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Build for the simulator or emulator, then install the `.ipa` or `.apk` path","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":74,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":76,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Re-run `lim ios sync` after each rebuild; it sends only the difference. To","category":"external_commands","line_end":81,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The console's Bazel page (`https://console.limrun.com/bazel`) lists the","category":"external_commands","line_end":88,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"that `lim-bazel-credentials` is on `PATH` (npm install) and that","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`lim login` or `LIM_API_KEY` is set where Bazel runs.","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Missing `@androidsdk` or Android toolchain errors:** the `MODULE.bazel`","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"network:SKILL.md:81:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"The console's Bazel page (`https://console.limrun.com/bazel`) lists the","category":"network","line_end":81,"severity":"low","line_start":81},{"id":"env_access:SKILL.md:21:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"so Bazel cannot authenticate with them. Auth is `lim login` or `LIM_API_KEY`","category":"env_access","line_end":21,"severity":"high","line_start":21},{"id":"env_access:SKILL.md:23:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"asking). The helper reads only `lim login` or `LIM_API_KEY`, never a key","category":"env_access","line_end":23,"severity":"high","line_start":23},{"id":"env_access:SKILL.md:63:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"In CI: install `lim` from npm, set `LIM_API_KEY` as a secret, run","category":"env_access","line_end":63,"severity":"high","line_start":63},{"id":"env_access:SKILL.md:89:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"`lim login` or `LIM_API_KEY` is set where Bazel runs.","category":"env_access","line_end":89,"severity":"high","line_start":89},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: \"The default way to build any Bazel workspace on Limrun: build its iOS and Android targ","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:SKILL.md:11:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"actions run on Limrun's Macs, Android actions on Limrun's Linux workers, and","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"blocker:SKILL.md:13:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"where it already does; no local Xcode or Android SDK is needed for the","category":"blocker","line_end":13,"severity":"low","line_start":13},{"id":"blocker:SKILL.md:50:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Apple or Android rules. Do not hand-edit `.limrun/`.","category":"blocker","line_end":50,"severity":"low","line_start":50},{"id":"blocker:SKILL.md:73:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"lim android create && lim android install-app bazel-bin/app/app.apk","category":"blocker","line_end":73,"severity":"low","line_start":73},{"id":"blocker:SKILL.md:92:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Missing `@androidsdk` or Android toolchain errors:** the `MODULE.bazel`","category":"blocker","line_end":92,"severity":"low","line_start":92}],"finding_verdicts":[{"id":"external_commands:SKILL.md:3:ruby-shell-backtick-execution","reason":"Backticks delimit command names in the YAML description, not executable Ruby or shell substitution. The description identifies the requested remote build workflow.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"The backticks format the setup command as Markdown inline code. No shell command substitution or injected input appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The line documents npm installation of the required CLI, with Markdown delimiters rather than executable backticks. No malicious package behavior is evidenced here.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The backticks format the credential helper name in explanatory prose. This line contains no executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"PATH is an inline code identifier explaining helper installation requirements. The text does not perform shell substitution or enumerate environment contents.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"Markdown backticks label the login command and authentication variable. There is no executable backtick syntax or secret transmission command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"Inline code identifies supported credential sources in prose. The line does not execute a shell expression or instruct disclosure of credential values.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The backticks format an unsupported authentication flag. The surrounding text explains CLI behavior without executing a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The documented help command is a normal troubleshooting step. Its backticks are Markdown formatting, not shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"MODULE.bazel is a filename formatted as inline code. Workspace root discovery is described, not implemented as an executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Lines 31 through 33 are a Markdown fenced example of the fixed setup command. The fence is not Ruby execution or shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Line 33 closes a Markdown code fence before prerequisite prose. The detected delimiters do not form executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks format Bazel rule names in a prerequisite sentence. No command execution occurs in this text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Inline code labels the module file, generated directory, and configuration flag. The documented setup changes support the requested build configuration, not backtick execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The line describes a Bazel configuration import using Markdown identifiers. No executable backtick expression or credential-writing instruction appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The region flag is formatted as inline code in setup documentation. It is not interpolated into an executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"Backticks mark Android build dependency names. The line contains explanatory prose rather than executable shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The toolchain name and module filename are Markdown inline code. No Ruby or shell execution is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The text explains that the yes flag accepts displayed dependency additions. This is documented setup behavior, not executable backticks or concealed modification.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The yes flag is an inline code label explaining noninteractive setup behavior. Backticks are formatting, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The instruction documents the yes flag for scripts and CI after describing dependency changes. It contains no executable backtick expression.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"Inline code formats a Java runtime option and Bazel configuration filename. The line describes preserving an existing setting, not executing code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The runtime identifier is Markdown inline code. The surrounding text describes generated configuration without executable shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The generated directory name is inline code, followed later by a Markdown fence. The passage advises configuration maintenance, not backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"Lines 54 through 56 contain a fenced example of a Bazel remote build. The fence is Markdown syntax, not command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"Line 56 closes the build example fence before output documentation. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"Artifact extensions and the configuration flag are Markdown identifiers. The sentence explains build outputs and does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"Inline code identifies the user configuration filename. The surrounding CI text is documentation, not an executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"Backticks label the CLI package and CI credential variable. The line recommends secret storage rather than shell substitution or credential disclosure.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The fixed setup command and build flag are Markdown inline examples for CI. No unsafe interpolation or executable backticks are shown.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"Backticks format mobile artifact extensions. The line describes installing the requested build output and contains no executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The Markdown fence encloses explicit simulator creation and app installation examples. Shell command chaining is visible and task-related, not backtick substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"Line 74 closes the Markdown app installation example. The following inline command reference does not form executable backtick syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The sync command is a Markdown reference to the documented cloud app update workflow. No hidden command substitution or unrelated transfer appears.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"Backticks format the Limrun console URL and later helper identifiers. They are Markdown delimiters, not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The helper name and PATH are inline code in authentication troubleshooting. The line does not execute shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"Markdown identifies the expected login command and credential variable. The troubleshooting instruction does not execute backticks or expose secret values.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The SDK label and module filename are formatted as inline code. The passage describes a dependency error, not executable backticks.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:81:hardcoded-url","reason":"The URL points to the documented Limrun build console for viewing results. No request payload, credential forwarding, or unrelated destination is specified.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:21:generic-api-secret-keys","reason":"LIM_API_KEY is the intended service authentication variable, not an embedded credential. The prose requests checking availability without directing secret disclosure.","verdict":"false_positive","confidence":0.97},{"id":"env_access:SKILL.md:23:generic-api-secret-keys","reason":"The line documents the credential sources used by the service helper. No evidence found of unrelated secret collection or credential exfiltration.","verdict":"false_positive","confidence":0.97},{"id":"env_access:SKILL.md:63:generic-api-secret-keys","reason":"The CI guidance explicitly stores LIM_API_KEY as a secret for requested Limrun authentication. It does not print, commit, or send credentials elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:89:generic-api-secret-keys","reason":"The troubleshooting step checks that service authentication is configured where Bazel runs. No secret value or instruction to disclose credentials appears.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"The description lists supported host environments and mobile build workflows. It does not request host enumeration or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:11:system-reconnaissance","reason":"Mac and Linux worker references explain remote build platforms. They are not commands to inspect or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:13:system-reconnaissance","reason":"The sentence explains that remote actions do not require local mobile SDK installations. No system reconnaissance behavior is present.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:50:system-reconnaissance","reason":"The instruction avoids manual changes to a generated configuration directory. It neither enumerates system resources nor requests privileged access.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:73:system-reconnaissance","reason":"The example creates a Limrun Android instance and installs the built app. These explicit workflow actions are not host reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:92:system-reconnaissance","reason":"The text identifies a missing Android toolchain dependency in the Bazel module. It provides build troubleshooting, not system enumeration.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"7f17813fb6af1acc7d8fd3fb5f05480f5be52783","subject_content_hash":"da99f6c5efaf6960efbca959d01edcd55723c816f7208773f990b180acfb67c4","subject_tree_hash":"219f0053d36544e9b1078d6de0c3dd4c1201c1c22ed0a100b887cb3c243fd640","subject_plugin_path":"skills/limrun-inc/limrun-bazel","audit_payload_hash":"46340014b0876fa12fe54830ca3d87f3","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"7f17813fb6af1acc7d8fd3fb5f05480f5be52783","contentHash":"da99f6c5efaf6960efbca959d01edcd55723c816f7208773f990b180acfb67c4","treeHash":"219f0053d36544e9b1078d6de0c3dd4c1201c1c22ed0a100b887cb3c243fd640","pluginPath":"skills/limrun-inc/limrun-bazel","auditPayloadHash":"46340014b0876fa12fe54830ca3d87f3"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/limrun-inc-limrun-bazel/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}