{"data":{"skill":{"slug":"lllllllama-paper-context-resolver","name":"paper-context-resolver","icon":"📦","repo":"https://github.com/lllllllama/ai-paper-reproduction-skill/tree/main/skills/paper-context-resolver/","status":"approved","author":"lllllllama","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"3b98e555-1a67-4178-b634-023c5b52a4a8","skill_id":"8138c84a-5047-4fbf-b8d7-c57406e60084","version":2,"content_hash":"0a4a4623aae2fc3e6c7e8f6a5ddb85c7","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static findings were reviewed and dismissed as false positives. The weak cryptographic algorithm alerts point to descriptive text, and the backtick alert points to a markdown inline file path. No prompt injection, exfiltration behavior, command execution, or malicious intent was found.","remediation":[],"risk_factor_evidence":[],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"False Positive: Weak Cryptographic Algorithm","verdict":"FALSE_POSITIVE","locations":[{"file":"agents/openai.yaml","line_end":2,"line_start":2}],"confidence":0.96,"description":"The alert at agents/openai.yaml:2 points to a short_description field. It contains plain skill metadata, not cryptographic code or insecure algorithm usage.","confidence_reasoning":"The line is YAML metadata text only. There is no hashing, encryption, key handling, or algorithm selection on this line."},{"title":"False Positive: Markdown Backtick Execution","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":46,"line_start":46}],"confidence":0.98,"description":"The alert at SKILL.md:46 is an inline markdown reference to references/paper-assisted-reproduction.md. It is not Ruby code or shell command execution.","confidence_reasoning":"The backticks delimit a documentation path in markdown. No interpreter, subprocess call, or user-controlled command string is present."},{"title":"False Positive: Weak Cryptographic Algorithm","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":3,"line_start":3}],"confidence":0.95,"description":"The alert at SKILL.md:3 points to the skill description. It describes research workflow boundaries and does not include cryptographic implementation details.","confidence_reasoning":"The line is a natural-language description. No evidence was found for weak cryptography or security-sensitive cryptographic behavior."}],"dangerous_patterns":[],"files_scanned":3,"total_lines":102,"audit_model":"codex","audited_at":"2026-06-30T07:35:31.138+00:00","created_at":"2026-06-30T10:03:00.255958+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}