{"data":{"skill":{"slug":"locusintelligence-dauagency-gbp-post-calendar","name":"gbp-post-calendar","icon":"📦","repo":"https://github.com/locusintelligence-dauagency/reach-skills/tree/2b10a6be9b9b9a990ae0beb360a21476fad41918/skills/gbp-post-calendar","status":"approved","author":"locusintelligence-dauagency","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"6109090a-8b38-4601-8516-45348bb71dfe","skill_id":"c71d0b0a-f18c-4010-b85a-a5f5958b3643","version":1,"content_hash":"v3:5e1f762ecf28b75c366ed9b67053b444b2eb9ffd:3a86f52f9b891f43acaaf425049ea80dded58c13756a2be4d73370ab1715dac3:f087cf6b6dc7d385e2272624bfd0efb7f79c9c090da09512550b3d6081002248:736b696c6c732f6c6f637573696e74656c6c6967656e63652d6461756167656e63792f6762702d706f73742d63616c656e646172:04632e5e56d4ff77bc7891b25954ad47","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 19 static findings are false positives: Markdown formatting, privacy guidance, or disclosed service and reference URLs. The workflow requires OAuth, limits data use, rejects tool-result instructions, and requires approval for each exact post before scheduling. No evidence found of credential theft, unauthorized shell execution, or prompt injection; the hosted server implementation is outside this repository.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":54,"line_start":54},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":57,"line_start":57}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":45,"line_start":45}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":80,"audit_model":"codex","audited_at":"2026-10-10T22:43:18.291+00:00","created_at":"2026-10-11T03:53:04.451882+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`publish_post` has no preview mode, and there is no tool to delete a post. Each scheduled post goes ","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Pick the location.** Call `get_account`. If there is more than one location, ask which one. If ","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Read the listing.** Call `get_listing` with `sections: [\"profile\", \"posts\"]`. Use the services,","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Ask the owner.** How long (a month or N weeks), how many posts per week, and any offers or even","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Present the calendar.** A table: date, type (`STANDARD`, `OFFER`, `EVENT`), topic, button. Tie ","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **Draft one post.** At most 1,500 characters. Lead with the news, end with one clear call to acti","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. **Show the exact post** in one block: type, title and dates (for `OFFER` or `EVENT`), full text, ","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"8. **Schedule.** Call `publish_post` with `locationId`, `content` (`summary`, `topicType`, `event` /","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"10. **Read back.** At the end call `get_listing` with `sections: [\"posts\"]` and list what is in `sch","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Free tools: [post calendar](https://reach.locus-intelligence.com/tools/google-business-profile-post-","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Stop if the location's `connectionStatus` is not `active`.","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Read `limitations` before saying there is no data.","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- On `rate_limited`, give `retryAfterSeconds` and do not retry right away. On an upgrade refusal, sa","category":"external_commands","line_end":55,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If the owner asks for something Reach cannot do, offer to send it to the Reach team with `request_","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"network:SKILL.md:30:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"- Use only the customer fields needed for the owner's task. Keep private contact details and unrelat","category":"network","line_end":30,"severity":"low","line_start":30},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:SKILL.md:16:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Setup for Claude, ChatGPT, Claude Code, Codex, Cursor, VS Code and others: [Reach setup guide](htt","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:SKILL.md:45:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Free tools: [post calendar](https://reach.locus-intelligence.com/tools/google-business-profile-post-","category":"network","line_end":45,"severity":"low","line_start":45}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The backticks format the documented MCP endpoint in Markdown. There is no Ruby code, shell command, or command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The backticks identify the publish_post tool in a warning about public posting and missing deletion support. They do not execute shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The backticks mark the get_account tool and connectionStatus field in Markdown. The step selects an account location, not a shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks format listing-read parameters and response fields. This is documented MCP usage for calendar planning, with no shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Europe/London is an inline timezone example, not executable code. The instruction requires owner-supplied dates, terms, and timezone.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"STANDARD, OFFER, and EVENT are Markdown-formatted post type labels. Calendar approval explicitly schedules nothing, and no shell syntax is executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The backticks format supported call-to-action options. Links and images require owner-provided URLs; there is no shell or Ruby invocation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The backticks format post types and the displayed scheduling timestamp. This step shows an exact preview for owner approval, not command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The backticks document publish_post parameters, not shell commands. The preceding steps require approval of the exact post before this intended MCP write.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The backticks format get_listing parameters and the scheduled response field. This is a readback instruction with no shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The backticks format the related skill name write-gbp-post. The line contains reference links, not a shell or Ruby program.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The backticks format connectionStatus and active in a safety check. The instruction stops work for disconnected locations and executes no shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The backticks identify the limitations response field. Reading tool limitations is plain workflow guidance, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The backticks format rate-limit, plan, and connection response fields. These instructions stop or delay workflow actions; no Ruby or shell code appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The backticks identify the request_feature MCP tool. Sending requires approval of the exact request wording, and the line contains no shell execution.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:30:python-http-libraries","reason":"The line contains privacy and credential-protection instructions, not Python imports or HTTP calls. Its mention of feature requests is ordinary prose.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:15:hardcoded-url","reason":"This is the disclosed Reach MCP endpoint required for the requested workflow, using browser OAuth. No evidence shows covert transmission or credential exfiltration.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:16:hardcoded-url","reason":"The URL is a Reach setup documentation link for supported clients. The line contains no instruction to transmit account data or secrets.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:45:hardcoded-url","reason":"The URLs are related public Reach tools, presented as optional references. No automatic request or private-data transmission is specified.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","subject_content_hash":"3a86f52f9b891f43acaaf425049ea80dded58c13756a2be4d73370ab1715dac3","subject_tree_hash":"f087cf6b6dc7d385e2272624bfd0efb7f79c9c090da09512550b3d6081002248","subject_plugin_path":"skills/locusintelligence-dauagency/gbp-post-calendar","audit_payload_hash":"04632e5e56d4ff77bc7891b25954ad47","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","contentHash":"3a86f52f9b891f43acaaf425049ea80dded58c13756a2be4d73370ab1715dac3","treeHash":"f087cf6b6dc7d385e2272624bfd0efb7f79c9c090da09512550b3d6081002248","pluginPath":"skills/locusintelligence-dauagency/gbp-post-calendar","auditPayloadHash":"04632e5e56d4ff77bc7891b25954ad47"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/locusintelligence-dauagency-gbp-post-calendar/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}