{"data":{"skill":{"slug":"locusintelligence-dauagency-growth-plan","name":"growth-plan","icon":"📦","repo":"https://github.com/locusintelligence-dauagency/reach-skills/tree/2b10a6be9b9b9a990ae0beb360a21476fad41918/skills/growth-plan","status":"approved","author":"locusintelligence-dauagency","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"8c6a9e4f-dcd4-4679-a6c3-7f4e1bee0a7d","skill_id":"dd4bc7c6-3edb-4f14-931e-618acee57df2","version":1,"content_hash":"v3:5e1f762ecf28b75c366ed9b67053b444b2eb9ffd:d6954898fef841deb19cb5c5d484e5c7e1184ed6b4a8a746f10303a472505972:6137d1a687cf69a2798f33bc4a461dfe1422363e02186d2a708e6b6a3f51ea40:736b696c6c732f6c6f637573696e74656c6c6967656e63652d6461756167656e63792f67726f7774682d706c616e:8874849e6b7da40a344c0dadd37eee9b","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 18 static findings are false positives: Markdown identifiers, privacy guidance, and documented Reach URLs do not demonstrate unsafe execution or exfiltration. The instructions require owner approval, restrict sensitive data, and reject instructions embedded in tool results. No evidence found of malicious intent; the hosted server and companion skills were not available for review.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":52,"line_start":52}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":41,"line_start":41}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":75,"audit_model":"codex","audited_at":"2026-10-10T22:47:10.224+00:00","created_at":"2026-10-11T03:53:21.085992+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Pick the location.** Call `get_account`. If there is more than one location, ask which one. If ","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Read the tasks.** Call `get_recommendations` with the `locationId`. Optional `categories`: `pro","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Order them.** Sort by `severity` (high first). Show a short list: title, severity, actionabilit","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Explain one task.** Use its `detail` (`metric`, `params`, `proof`) in plain words. Only state n","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `agent_can_fix`: follow the `fix` tool and its `note`. Reviews: use `reply-to-google-reviews`. Pro","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `needs_owner_input`: ask the owner for the substance (a phone number, photos, what to post). Posts","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `needs_setup`: explain that it is blocked outside these tools. Do not push.","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. **Read back.** After a fix, call `get_listing` and confirm the change shows.","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"7. **Update status only with agreement.** Ask: \"Mark this completed?\" Call `update_recommendation_st","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Stop if the location's `connectionStatus` is not `active`.","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Read `limitations` before saying there is no data.","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- On `rate_limited`, give `retryAfterSeconds` and do not retry right away. On an upgrade refusal, sa","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If the owner asks for something Reach cannot do, offer to send it to the Reach team with `request_","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"network:SKILL.md:25:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"- Use only the customer fields needed for the owner's task. Keep private contact details and unrelat","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:SKILL.md:16:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Setup for Claude, ChatGPT, Claude Code, Codex, Cursor, VS Code and others: [Reach setup guide](htt","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:SKILL.md:41:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Free tool for a first look: [GMB audit tool](https://reach.locus-intelligence.com/tools/gmb-audit-to","category":"network","line_end":41,"severity":"low","line_start":41}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The backticks format the required MCP endpoint as Markdown inline text. No Ruby or shell execution appears on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"Backticks identify an MCP account tool and connection fields, not executable shell syntax. The workflow selects a location and stops for inactive connections.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The line documents a recommendation tool and its parameters using Markdown backticks. It contains no shell commands or dynamic code execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The backticked severity field controls the displayed recommendation order. This is presentation guidance, not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"Backticks label returned evidence fields for plain-language explanations. The instruction limits claims to returned numbers and does not execute field contents.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"Backticks name actionability fields and companion skills, not shell commands. Lines 24 and 45 require workflow validation and explicit approval before public changes.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The line requests owner input and names companion skills using Markdown formatting. No shell execution is specified; public changes require separate approval.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The backticked needs_setup value is a workflow state. The instruction explains a blocked action and does not invoke any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The backticks identify the get_listing MCP tool for verifying an approved change. There is no Ruby or shell execution syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Backticks document recommendation status parameters and an MCP tool, not shell code. Updates require owner agreement and completion requires a verified fix.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The backticks format connectionStatus and active as field names and values. This safety check stops the workflow rather than executing a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The limitations identifier is Markdown inline text. Reading returned limitations before reporting missing data does not constitute shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"Backticks mark response statuses and fields used to explain limits and stop. The line does not execute commands or automatically follow returned URLs.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The request_feature identifier names an MCP tool, not a shell command. Sending requires confirmation of the wording, and line 25 excludes private details.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:25:python-http-libraries","reason":"This is privacy guidance mentioning feature requests, not Python HTTP code. It explicitly prohibits credential disclosure and unnecessary customer data sharing.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:15:hardcoded-url","reason":"The HTTPS URL is the disclosed Reach MCP service required for this skill. Browser OAuth is specified; no covert destination or credential transmission is instructed.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:16:hardcoded-url","reason":"This is a setup documentation link on the same Reach host as the declared service. The line does not transmit account data or credentials.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:41:hardcoded-url","reason":"The URL is an optional first-look audit link on the declared Reach host. No automatic request, secret collection, or data upload is specified.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[],"subject_marketplace_commit_sha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","subject_content_hash":"d6954898fef841deb19cb5c5d484e5c7e1184ed6b4a8a746f10303a472505972","subject_tree_hash":"6137d1a687cf69a2798f33bc4a461dfe1422363e02186d2a708e6b6a3f51ea40","subject_plugin_path":"skills/locusintelligence-dauagency/growth-plan","audit_payload_hash":"8874849e6b7da40a344c0dadd37eee9b","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","contentHash":"d6954898fef841deb19cb5c5d484e5c7e1184ed6b4a8a746f10303a472505972","treeHash":"6137d1a687cf69a2798f33bc4a461dfe1422363e02186d2a708e6b6a3f51ea40","pluginPath":"skills/locusintelligence-dauagency/growth-plan","auditPayloadHash":"8874849e6b7da40a344c0dadd37eee9b"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/locusintelligence-dauagency-growth-plan/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}