{"data":{"skill":{"slug":"locusintelligence-dauagency-multi-location-report","name":"multi-location-report","icon":"📦","repo":"https://github.com/locusintelligence-dauagency/reach-skills/tree/2b10a6be9b9b9a990ae0beb360a21476fad41918/skills/multi-location-report","status":"approved","author":"locusintelligence-dauagency","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"49b3a0a3-7191-43e8-9a24-6f7c63c07a04","skill_id":"fd89ebf8-1ccd-4d76-907b-ad35b3450a12","version":1,"content_hash":"v3:5e1f762ecf28b75c366ed9b67053b444b2eb9ffd:39ef483d7dbe15992c25ed8f603f9da69e774f782bbbe7403c6e9190c9c40859:b833c7443df0fdfc121d94d09d858c099073da37c1b596baec27fb955e76657b:736b696c6c732f6c6f637573696e74656c6c6967656e63652d6461756167656e63792f6d756c74692d6c6f636174696f6e2d7265706f7274:0935c4743b932b367d929bfdf230d5bd","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 14 static findings are false positives: Markdown formatting, privacy prose, and disclosed Reach setup URLs do not establish execution or unauthorized disclosure. No evidence found of prompt injection, credential harvesting, or malicious data transfer in the reviewed instructions. The hosted server implementation is outside this audit; optional feature requests require owner confirmation.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":52,"line_start":42},{"file":"SKILL.md","line_end":59,"line_start":52},{"file":"SKILL.md","line_end":60,"line_start":59},{"file":"SKILL.md","line_end":62,"line_start":60}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":16,"line_start":16}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":85,"audit_model":"codex","audited_at":"2026-10-10T22:57:29.023+00:00","created_at":"2026-10-11T03:54:00.052697+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **List locations.** Call `get_account` with `include: [\"locations\", \"connection\"]`. Take each ent","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Skip what cannot be read.** A location whose `connectionStatus` is not `active`, or that is pau","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `get_performance` for each range.","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `get_listing` with `sections: [\"reviews\"]` and `reviewFilter: { startDate, endDate }` for the curr","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `get_visibility` with `sections: [\"summary\"]` for tracked keyword rank.","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **On `rate_limited`,** tell the owner `retryAfterSeconds`, stop, and report the locations done so","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```text","category":"external_commands","line_end":52,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":59,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Read `limitations` per location before saying there is no data; relay each message and link.","category":"external_commands","line_end":60,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- On `listing_only`, record the location as \"listing only\" and continue.","category":"external_commands","line_end":62,"severity":"medium","line_start":60},{"id":"network:SKILL.md:26:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"- Use only the customer fields needed for the owner's task. Keep private contact details and unrelat","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:SKILL.md:16:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Setup for Claude, ChatGPT, Claude Code, Codex, Cursor, VS Code and others: [Reach setup guide](htt","category":"network","line_end":16,"severity":"low","line_start":16}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The backticks format the documented HTTPS MCP endpoint in Markdown. No shell or Ruby execution appears on this line.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Backticks mark MCP tool names, parameters, and response fields. The instruction lists account locations through get_account, not a shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The inline formatting identifies connection statuses and listing fields. This step skips unavailable locations and contains no executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The formatted get_performance name denotes a reporting MCP tool. There is no shell invocation or interpolation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks format get_listing and its review filter arguments. These are scoped review retrieval instructions, not Ruby or shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The line formats get_visibility and its summary parameter as inline Markdown. Reading tracked keyword ranks does not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The formatted identifiers are rate-limit response fields. The instruction stops reporting and relays the retry delay; it executes no command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"Lines 42 through 52 form a text-fenced report template containing a table and placeholders. The backticks are Markdown delimiters, not executable code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"Line 52 closes the Markdown report fence, and subsequent lines describe reporting rules. No shell execution exists in this span.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"Backticks format the limitations and listing_only response fields. The instructions explain data gaps and do not execute returned messages or links.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The formatted listing_only status and request_feature tool name are Markdown identifiers. Optional feature submission requires owner confirmation and does not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:26:python-http-libraries","reason":"This line is privacy guidance, not Python code or an HTTP library import. It explicitly prohibits credential reads and disclosure to tool-returned destinations.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:15:hardcoded-url","reason":"The HTTPS endpoint is the disclosed Reach MCP dependency for the reporting task, with browser OAuth to the owner's account. No unauthorized payload or hidden destination is specified.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:16:hardcoded-url","reason":"This is a setup documentation link on the same Reach domain as the declared server. It contains no credentials, upload instructions, or automatic execution.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","subject_content_hash":"39ef483d7dbe15992c25ed8f603f9da69e774f782bbbe7403c6e9190c9c40859","subject_tree_hash":"b833c7443df0fdfc121d94d09d858c099073da37c1b596baec27fb955e76657b","subject_plugin_path":"skills/locusintelligence-dauagency/multi-location-report","audit_payload_hash":"0935c4743b932b367d929bfdf230d5bd","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","contentHash":"39ef483d7dbe15992c25ed8f603f9da69e774f782bbbe7403c6e9190c9c40859","treeHash":"b833c7443df0fdfc121d94d09d858c099073da37c1b596baec27fb955e76657b","pluginPath":"skills/locusintelligence-dauagency/multi-location-report","auditPayloadHash":"0935c4743b932b367d929bfdf230d5bd"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/locusintelligence-dauagency-multi-location-report/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}