{"data":{"skill":{"slug":"locusintelligence-dauagency-optimize-google-business-profile","name":"optimize-google-business-profile","icon":"📦","repo":"https://github.com/locusintelligence-dauagency/reach-skills/tree/2b10a6be9b9b9a990ae0beb360a21476fad41918/skills/optimize-google-business-profile","status":"approved","author":"locusintelligence-dauagency","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"9dd13189-4764-4745-a5a6-cf74c8ee7e30","skill_id":"22f60e8b-9050-4f25-b0ff-d7a2fae32dd6","version":1,"content_hash":"v3:5e1f762ecf28b75c366ed9b67053b444b2eb9ffd:f282bd6938adb5aa795905e4960d9a000cfd43d5bc2f0e982fdbc1e399acc35c:bfec67bf169614390cc222f45e0894bc34477e460aa504bcde7e5d4860706a99:736b696c6c732f6c6f637573696e74656c6c6967656e63652d6461756167656e63792f6f7074696d697a652d676f6f676c652d627573696e6573732d70726f66696c65:00d8c907f66efff126dabf0475460a87","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 22 static findings are false positives: Markdown backticks, privacy prose, and documented service links do not establish malicious execution or network abuse. No evidence found of prompt injection, credential extraction, or unauthorized publishing in the reviewed files. The remote Reach server implementation is absent, so its security was not assessed.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":60,"line_start":60}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":16,"line_start":16}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":83,"audit_model":"codex","audited_at":"2026-10-10T23:00:59.662+00:00","created_at":"2026-10-11T03:54:16.632405+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Pick the location.** Call `get_account`. If there is more than one location, ask which one. If ","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Find the gaps.** Call `get_recommendations` for the location, then `get_listing` with `sections","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Summarise** the gaps in a few lines, most useful first, grouped by `actionability`:","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `agent_can_fix`: offer to do it with the tool named in `fix`.","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `needs_owner_input`: ask the owner for the substance (a phone number, the real opening hours, what","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `needs_setup`: explain once what it needs, without pushing.","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Call `update_listing` with `preview: true` (the default) and only that change in `changes`.","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. Call `update_listing` again with the same `changes`, `preview: false` and the `basedOn` the previ","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. Report `published.applied`, `skipped` and `failed` exactly as returned.","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. Read back with `get_listing` (`sections: [\"profile\"]`). If the old value still shows, say Google ","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"7. When the fix is done and read back, ask whether to mark it completed. Only after the owner agrees","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **Next item**, or stop when the owner says so. Use `status: \"dismissed\"` only when the owner asks","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- The primary category and the address cannot be changed here. Photos are a separate, previewed tool","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If the preview shows `stagedDashboardEdits` (unpublished edits saved in Reach), show them separate","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `publishMode: \"all\"` only when the owner asks to publish everything and has approved the previ","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Stop if the location's `connectionStatus` is not `active`.","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Read `limitations` before saying there is no data.","category":"external_commands","line_end":59,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- On `rate_limited`, give `retryAfterSeconds` and do not retry right away. On `listing_only`, relay ","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"network:SKILL.md:26:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"- Use only the customer fields needed for the owner's task. Keep private contact details and unrelat","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:SKILL.md:16:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Setup for Claude, ChatGPT, Claude Code, Codex, Cursor, VS Code and others: [Reach setup guide](htt","category":"network","line_end":16,"severity":"low","line_start":16}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The backticks format the documented HTTPS MCP server address in Markdown. No Ruby or shell command is executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Backticks mark the get_account tool name and connectionStatus field. This is an account-selection instruction, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Backticks format MCP read-tool names and profile parameters. The instruction retrieves recommendations and listing data without invoking a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The actionability identifier is inline Markdown in a summary instruction. It is not an executable expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Backticks label recommendation fields, not shell commands. Line 25 restricts suggested fixes to the supported workflow and reserves approval for the owner.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The needs_owner_input label is Markdown formatting. The instruction asks for factual business details and prohibits invention, with no executable command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The needs_setup label categorizes recommendations in prose. The backticks do not perform shell or Ruby execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The line documents an update_listing preview with one proposed change. Backticks format the MCP tool and parameters, not a shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"This MCP publish step follows explicit approval in line 39 and preserves previewed changes with basedOn and an idempotencyKey. No shell execution appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The backticks identify returned outcome fields for accurate reporting. They are neither commands nor executable code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The line instructs a profile readback through get_listing and acknowledges propagation delays. Its backticks are Markdown around MCP names and parameters.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The instruction changes recommendation status only after owner agreement and readback. Tool names and status parameters are Markdown literals, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The dismissed status is an inline parameter example. The instruction requires an owner request to dismiss an item and invokes no shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The manage_media name documents a separate previewed MCP tool. Backticks provide formatting, and the line primarily describes editing limitations.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The stagedDashboardEdits and includeStagedEdits identifiers are Markdown literals. This instruction prevents including unpublished edits without separate owner approval.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The publishMode parameter is formatted as inline Markdown, not executed by a shell. Every included change requires an approved preview, including staged edits.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The connectionStatus and active literals define a stop condition. This is a safety instruction, not command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The limitations identifier names returned data to consult before making claims. It is plain Markdown formatting with no executable context.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The backticks identify rate-limit, connection, and plan-response fields. This prose requires stopping or delaying retries and contains no shell invocation.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:26:python-http-libraries","reason":"The line is privacy guidance containing the ordinary word requests, not a Python HTTP library import or call. It expressly prohibits credential disclosure.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:15:hardcoded-url","reason":"The URL identifies the required Reach MCP service, disclosed as third-party infrastructure in line 18. Browser OAuth is specified; no covert destination or credential payload appears.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:16:hardcoded-url","reason":"The URL is a same-host setup documentation link. The file does not instruct code download, automatic execution, or transmission of secrets to it.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","subject_content_hash":"f282bd6938adb5aa795905e4960d9a000cfd43d5bc2f0e982fdbc1e399acc35c","subject_tree_hash":"bfec67bf169614390cc222f45e0894bc34477e460aa504bcde7e5d4860706a99","subject_plugin_path":"skills/locusintelligence-dauagency/optimize-google-business-profile","audit_payload_hash":"00d8c907f66efff126dabf0475460a87","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","contentHash":"f282bd6938adb5aa795905e4960d9a000cfd43d5bc2f0e982fdbc1e399acc35c","treeHash":"bfec67bf169614390cc222f45e0894bc34477e460aa504bcde7e5d4860706a99","pluginPath":"skills/locusintelligence-dauagency/optimize-google-business-profile","auditPayloadHash":"00d8c907f66efff126dabf0475460a87"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/locusintelligence-dauagency-optimize-google-business-profile/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}