{"data":{"skill":{"slug":"localaipicks-localaipicks","name":"localaipicks","icon":"📦","repo":"https://github.com/localaipicks/localaipicks-mcp/tree/573c4a5197811f03337b68b9449995a38690bf60/skills/localaipicks","status":"approved","author":"Local AI Picks","authorVersion":"1.0.0","skillstoreRevision":1},"audit":{"id":"0fb93124-0b2b-4d0b-a255-9f13dbcc4da8","skill_id":"2b06d133-36fb-4688-b93c-04bf8a28cec4","version":1,"content_hash":"v3:525d9f82cedba8bd357400a37b4aac0138197a25:4f56a2f5defdd3f6dd771fe4fd0817680e71a6657f7cba922da10c17cf8bbfa3:2321d4d701b70775a3e1d3ad23479fc233b0d341cf4d6559b3a10862636584ab:736b696c6c732f6c6f63616c61697069636b732f6c6f63616c61697069636b73:80d097bf8145d25cded58a5b3a194506","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All nine static findings are false positives: the backticks mark Markdown identifiers, and the website links support model research. The instructions request relevant hardware memory and MCP queries, but contain no evidence of malicious reconnaissance or prompt injection.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":30,"line_start":30}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":31,"audit_model":"codex","audited_at":"2026-10-27T12:15:41.66+00:00","created_at":"2026-10-27T18:13:18.606516+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Ask for, or find out, the memory that matters: unified memory on Apple Silicon, VRAM on a GPU, sys","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Memory is estimated only for text LLMs. For other tasks it comes from vendor sources or is `unknow","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If the `localaipicks` MCP server is connected (tools `list_tasks`, `find_models`, `get_model`, `comp","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. If the task is unclear, call `list_tasks` and pick the task id (for example `llm`, `coding`, `ima","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Call `find_models` with `task`, `memory_gb` and `device` (`apple`, `gpu` or `cpu`). It keeps the ","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. For the two or three the user cares about, call `get_model` or `compare_models` to read weight op","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. Answer with the model, the weight option that fits, its file size and memory need, and the page l","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"network:SKILL.md:30:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Every answer is also on the website. Link the user to the task page (for example https://localaipick","category":"network","line_end":30,"severity":"low","line_start":30},{"id":"blocker:SKILL.md:23:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"1. If the task is unclear, call `list_tasks` and pick the task id (for example `llm`, `coding`, `ima","category":"blocker","line_end":23,"severity":"low","line_start":23}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The backticks format the memory_gb parameter in Markdown; they do not execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"The backticks format the literal value unknown; there is no command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The backticks mark the MCP server and tool names as Markdown code, not shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The backticks format an MCP tool name and example task identifiers, not executable shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The backticks format an MCP tool name, parameters, and device values in prose.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The backticks identify MCP tools used for model comparison; no shell execution is specified.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks format the as_of data field, not a command.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:30:hardcoded-url","reason":"The URLs are links to task and model pages for the stated research workflow, with no instruction to send sensitive data.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:23:system-reconnaissance","reason":"The list_tasks call lists model categories, not system information. The example task identifiers are unrelated to system reconnaissance.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"525d9f82cedba8bd357400a37b4aac0138197a25","subject_content_hash":"4f56a2f5defdd3f6dd771fe4fd0817680e71a6657f7cba922da10c17cf8bbfa3","subject_tree_hash":"2321d4d701b70775a3e1d3ad23479fc233b0d341cf4d6559b3a10862636584ab","subject_plugin_path":"skills/localaipicks/localaipicks","audit_payload_hash":"80d097bf8145d25cded58a5b3a194506","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"525d9f82cedba8bd357400a37b4aac0138197a25","contentHash":"4f56a2f5defdd3f6dd771fe4fd0817680e71a6657f7cba922da10c17cf8bbfa3","treeHash":"2321d4d701b70775a3e1d3ad23479fc233b0d341cf4d6559b3a10862636584ab","pluginPath":"skills/localaipicks/localaipicks","auditPayloadHash":"80d097bf8145d25cded58a5b3a194506"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/localaipicks-localaipicks/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}