{"data":{"skill":{"slug":"locusintelligence-dauagency-local-rank-audit","name":"local-rank-audit","icon":"📦","repo":"https://github.com/locusintelligence-dauagency/reach-skills/tree/2b10a6be9b9b9a990ae0beb360a21476fad41918/skills/local-rank-audit","status":"approved","author":"locusintelligence-dauagency","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"c7b3fb84-4640-4442-939f-32c56a24d0be","skill_id":"1e617ca0-bb09-4199-9bfe-c06a43552729","version":1,"content_hash":"v3:5e1f762ecf28b75c366ed9b67053b444b2eb9ffd:ae9bcfde2b605e78fc039afee8e20e23232507bcf37fb87747c45a521a7df4be:0aa45377505ba3a10ce3b6012c7fb7b5e71982f4d08b77df47e402957a412934:736b696c6c732f6c6f637573696e74656c6c6967656e63652d6461756167656e63792f6c6f63616c2d72616e6b2d6175646974:6a6c47a9562394f3b411699896393067","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 16 static findings are false positives involving Markdown formatting, legitimate service URLs, and protective prose. No evidence found of shell execution, credential exfiltration, system reconnaissance, or prompt injection in the reviewed instructions. The hosted Reach server is outside this repository audit; keyword tracking requires explicit owner approval.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":62,"line_start":62}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":16,"line_start":16}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":86,"audit_model":"codex","audited_at":"2026-10-10T22:55:30.78+00:00","created_at":"2026-10-11T03:53:51.092605+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Pick the location.** Call `get_account`. If there is more than one location, ask which one. If ","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Read visibility.** Call `get_visibility` with `sections: [\"summary\", \"grid\", \"competitors\"]`. P","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Rank history.** For the keywords that matter most, call `get_visibility` with `sections: [\"rank","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Profile context.** Call `get_listing` with `sections: [\"profile\", \"reviews\"]` for categories, c","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`get_visibility` covers tracked keywords only. If the owner wants a keyword that is not tracked:","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Only then call `track_keywords` with `action: \"track\"`, the exact approved keywords and an `idemp","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `track_keywords` changes Reach (keyword slots), not Google. Get the owner's yes first.","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Stop if the location's `connectionStatus` is not `active`.","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Read `limitations` before saying there is no data.","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- On `rate_limited`, give `retryAfterSeconds` and do not retry right away. On an upgrade refusal, na","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"network:SKILL.md:24:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"- Use only the customer fields needed for the owner's task. Keep private contact details and unrelat","category":"network","line_end":24,"severity":"low","line_start":24},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:SKILL.md:16:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Setup for Claude, ChatGPT, Claude Code, Codex, Cursor, VS Code and others: [Reach setup guide](htt","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: Local SEO rank audit for a Google Business Profile (GMB, Google My Business) with the R","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:SKILL.md:52:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Use only rankings, grid points and competitor facts the tools returned. Never promise a rank (\"you","category":"blocker","line_end":52,"severity":"low","line_start":52}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The backticks format the declared Reach MCP URL as inline Markdown. There is no shell or Ruby execution context.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The backticks identify the get_account MCP tool and connectionStatus field, not executable shell expressions. The step requires location selection and stops on inactive connections.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"Inline Markdown names get_visibility and its structured arguments for reading ranking data. No shell invocation or command interpolation is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The backticks document MCP parameters for rank history and search surfaces. They are Markdown formatting, not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The line names get_listing and optional get_recommendations tools for task-relevant profile context. Backticks do not execute these names as shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The backticks format the get_visibility tool name in a statement about tracked-keyword coverage. The line contains no execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"This is an MCP write operation, not shell execution, and follows explicit approval of the exact keywords. An idempotencyKey guards against duplicate submissions.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The line explains that track_keywords changes Reach keyword slots and requires owner approval. Its backticks are Markdown formatting, not shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The backticks format connectionStatus and active in a protective stop condition. No command execution is requested.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The line directs the assistant to inspect the returned limitations field before interpreting missing data. Backticks label a data field, not a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"Backticks label tool response states and fields for rate limits, plan restrictions, and connection guidance. The instructions require stopping or delaying, not executing shell commands.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:24:python-http-libraries","reason":"The matched word requests appears in feature requests, not a Python library import or HTTP call. The paragraph prohibits secret access and credential disclosure.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:15:hardcoded-url","reason":"The HTTPS URL is the disclosed Reach MCP endpoint required for the stated audit workflow. Browser OAuth is prescribed; no unrelated data transfer is requested.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:16:hardcoded-url","reason":"The URL links to setup documentation on the same disclosed provider domain. It is not a credential collection or data upload instruction.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"The metadata describes local search rankings and nearby business competitors. It does not request host inspection, system enumeration, or secret discovery.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:52:system-reconnaissance","reason":"The rule restricts reports to returned rankings, grid points, and competitor facts while prohibiting rank guarantees. No system reconnaissance is described.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","subject_content_hash":"ae9bcfde2b605e78fc039afee8e20e23232507bcf37fb87747c45a521a7df4be","subject_tree_hash":"0aa45377505ba3a10ce3b6012c7fb7b5e71982f4d08b77df47e402957a412934","subject_plugin_path":"skills/locusintelligence-dauagency/local-rank-audit","audit_payload_hash":"6a6c47a9562394f3b411699896393067","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","contentHash":"ae9bcfde2b605e78fc039afee8e20e23232507bcf37fb87747c45a521a7df4be","treeHash":"0aa45377505ba3a10ce3b6012c7fb7b5e71982f4d08b77df47e402957a412934","pluginPath":"skills/locusintelligence-dauagency/local-rank-audit","auditPayloadHash":"6a6c47a9562394f3b411699896393067"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/locusintelligence-dauagency-local-rank-audit/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}