{"data":{"skill":{"slug":"lllllllama-minimal-run-and-audit","name":"minimal-run-and-audit","icon":"📦","repo":"https://github.com/lllllllama/ai-paper-reproduction-skill/tree/main/skills/minimal-run-and-audit/","status":"approved","author":"lllllllama","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"9d517d92-2f2a-4fb8-b13c-0a879dad79be","skill_id":"a7048a7e-8ab4-4761-99a0-bf3b93a0b292","version":1,"content_hash":"6de587f0099d13286e5d2bfa369ee48f","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis flagged 16 patterns, but 15 are false positives from misidentified file types (markdown docs flagged as Ruby, YAML config flagged as crypto). One true positive: Python subprocess.run for command execution is legitimate and properly sandboxed with timeout handling and shlex parsing. External command execution is the intended function of this skill.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"scripts/run_command.py","line_end":55,"line_start":55},{"file":"scripts/run_command.py","line_end":148,"line_start":148}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"External Command Execution","locations":[{"file":"scripts/run_command.py","line_end":55,"line_start":55},{"file":"scripts/run_command.py","line_end":148,"line_start":148}],"confidence":0.85,"description":"Script executes user-provided commands via subprocess.run with shlex.split parsing. Commands run with timeout protection (default 60s) and capture stdout/stderr. Risk is mitigated by timeout limits and lack of shell=True flag.","confidence_reasoning":"subprocess.run is called with split_command output (shlex.split), no shell=True, and timeout enforcement - legitimate command execution pattern"}],"dangerous_patterns":[],"files_scanned":5,"total_lines":384,"audit_model":"claude","audited_at":"2026-04-09T08:41:33.429+00:00","created_at":"2026-04-09T10:12:29.774825+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}