{"data":{"skill":{"slug":"locusintelligence-dauagency-write-gbp-post","name":"write-gbp-post","icon":"📦","repo":"https://github.com/locusintelligence-dauagency/reach-skills/tree/2b10a6be9b9b9a990ae0beb360a21476fad41918/skills/write-gbp-post","status":"approved","author":"locusintelligence-dauagency","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"5593a152-5f0b-4c3b-a2b3-30e8325627cb","skill_id":"647bd5c0-a3f3-413a-b103-f778ab77bec3","version":1,"content_hash":"v3:5e1f762ecf28b75c366ed9b67053b444b2eb9ffd:fe7e535bee4cfbe3765898be0a42f91c87355f779a9e285a22905bb946fe303f:4210683025f848fd9cad269cc939095e8644a329e14c99f4e8f20620261c1e7d:736b696c6c732f6c6f637573696e74656c6c6967656e63652d6461756167656e63792f77726974652d6762702d706f7374:ab643a23375ffd7b98a82aa7be11e71d","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 18 static findings are false positives: Markdown formatting, privacy prose, and documented Reach service URLs do not establish a security threat. The workflow requires exact owner approval, rejects instructions embedded in tool results, and prohibits credential disclosure. No evidence found of malicious intent; the hosted server implementation is outside this repository.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":53,"line_start":46},{"file":"SKILL.md","line_end":57,"line_start":53},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":67,"line_start":66},{"file":"SKILL.md","line_end":67,"line_start":67}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":16,"line_start":16}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":90,"audit_model":"codex","audited_at":"2026-10-10T23:09:31.905+00:00","created_at":"2026-10-11T03:54:47.728191+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`publish_post` has no preview mode, and there is no tool to delete a post. Once published, the post ","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Pick the location.** Call `get_account`. If there is more than one location, ask which one. If ","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Get the brief.** Ask what the post is about, if not given. Optionally call `get_listing` with `","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `STANDARD`: an update.","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `OFFER`: a promotion; needs a title and start and end dates and times; coupon code, redeem link an","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `EVENT`: needs a title and start and end dates and times.","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **Button (optional).** One of `BOOK`, `ORDER`, `SHOP`, `LEARN_MORE`, `SIGN_UP` (each needs a URL ","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"7. **Timing.** Publish now, or schedule. To schedule, ask the owner for the local date and time and ","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```text","category":"external_commands","line_end":53,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":57,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"10. **Publish.** Call `publish_post` with `locationId`, `content` (`summary`, `topicType`, and `even","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Stop if the location's `connectionStatus` is not `active`.","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Read `limitations` before saying there is no data.","category":"external_commands","line_end":67,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- On `rate_limited`, give `retryAfterSeconds` and do not retry right away. On an upgrade refusal (fo","category":"external_commands","line_end":67,"severity":"medium","line_start":67},{"id":"network:SKILL.md:30:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"- Use only the customer fields needed for the owner's task. Keep private contact details and unrelat","category":"network","line_end":30,"severity":"low","line_start":30},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Server URL: `https://reach.locus-intelligence.com/api/mcp` (remote, Streamable HTTP, OAuth sign-in","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:SKILL.md:16:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Setup for Claude, ChatGPT, Claude Code, Codex, Cursor, VS Code and others: [Reach setup guide](htt","category":"network","line_end":16,"severity":"low","line_start":16}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The backticks format the documented Reach MCP endpoint as inline Markdown. There is no Ruby or shell execution on this line.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The backticks format the publish_post tool name in a warning about public publication and missing deletion support. No executable shell syntax is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"Inline Markdown names the get_account tool and connectionStatus field. The instruction selects an authorized location and stops on inactive connections, without shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks format get_listing and its profile/posts parameters for optional business context retrieval. These are MCP tool instructions, not Ruby or shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"STANDARD is a post-type enum displayed as inline Markdown. No command execution or interpreter is involved.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"OFFER is an inline Markdown enum followed by promotion requirements. This is descriptive text, not executable Ruby or shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"EVENT is an inline Markdown enum identifying a post type. The line documents required event details and executes nothing.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"Backticks label supported call-to-action enums, not commands. The workflow requires owner-provided button URLs or the listing phone number.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"Europe/London is an inline Markdown timezone example. The instruction requires the owner to supply scheduling details and explicitly forbids guessing the timezone.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The triple backticks open a text-only Markdown block showing the approval draft fields. Its contents are placeholders, not executable shell or Ruby code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The triple backticks close the approval draft block. Subsequent prose warns about public publication and requires renewed approval after edits, rather than executing commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"Inline Markdown documents publish_post parameters and an idempotency key, not shell execution. The preceding steps require explicit owner approval of the exact post.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"Backticks format the connectionStatus field and active status value. This safety rule stops publishing for inactive connections and executes no shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The limitations field is formatted as inline Markdown within a data-interpretation instruction. Neither this line nor the following error-handling text contains shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"Backticks identify tool response fields and error codes. The prose requires respecting retry delays and stopping on plan or connection failures, not executing shell commands.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:30:python-http-libraries","reason":"The word requests refers to feature requests in privacy guidance, not a Python HTTP library. No Python import or network call appears here.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:15:hardcoded-url","reason":"This is the disclosed HTTPS endpoint required for Reach MCP, with browser OAuth and an explicit prohibition on sharing secrets. No unauthorized transfer is instructed.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:16:hardcoded-url","reason":"The URL is a setup documentation link on the same Reach domain as the disclosed service. It does not instruct credential transmission or unrelated network activity.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","subject_content_hash":"fe7e535bee4cfbe3765898be0a42f91c87355f779a9e285a22905bb946fe303f","subject_tree_hash":"4210683025f848fd9cad269cc939095e8644a329e14c99f4e8f20620261c1e7d","subject_plugin_path":"skills/locusintelligence-dauagency/write-gbp-post","audit_payload_hash":"ab643a23375ffd7b98a82aa7be11e71d","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"5e1f762ecf28b75c366ed9b67053b444b2eb9ffd","contentHash":"fe7e535bee4cfbe3765898be0a42f91c87355f779a9e285a22905bb946fe303f","treeHash":"4210683025f848fd9cad269cc939095e8644a329e14c99f4e8f20620261c1e7d","pluginPath":"skills/locusintelligence-dauagency/write-gbp-post","auditPayloadHash":"ab643a23375ffd7b98a82aa7be11e71d"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/locusintelligence-dauagency-write-gbp-post/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}