{"data":{"skill":{"slug":"logbrewco-instrument-app","name":"instrument-app","icon":"📦","repo":"https://github.com/logbrewco/skills/tree/abac3ee500d980ca7fa4edb6c75949094d3ea792/plugins/logbrew/skills/instrument-app","status":"approved","author":"logbrewco","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"c9412027-dccd-4648-a203-eb6db0086546","skill_id":"c8e076fe-c55d-4a82-9019-f6d5ada6403e","version":1,"content_hash":"v3:07bd35e828bc5e79e3fd7ad19a1298e33cdbb753:e2c98b7a9b3718d43ff48cf62b8af49980f80914d2a86771f95cfc7356000931:eda4e75150c16c46a68f99b01fd5130a298611566e156a71e7abe550b76ee282:736b696c6c732f6c6f6762726577636f2f696e737472756d656e742d617070:351c262dc592057a030a37e92fc7ecb9","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static matches are Markdown, SDK configuration, or safe secret-handling guidance. The Rails key export can expose a secret in shell history, and the workflow should validate install commands and review existing logs before forwarding them.","remediation":[{"issue":"The Rails example places a key in a shell command.","severity":"high","suggestion":"Load the ingest key through a secret manager or protected environment configuration without typing it into shell history."},{"issue":"The generated install command is executed without explicit validation.","severity":"medium","suggestion":"Validate the package manager, arguments, and package source, and request approval before running the command."},{"issue":"Existing logs can be forwarded without a privacy review.","severity":"medium","suggestion":"Review existing log fields and SDK capture defaults, redact sensitive data, and obtain approval before enabling forwarding."}],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"references/frameworks.md","line_end":221,"line_start":209}]},{"factor":"external_commands","evidence":[{"file":"references/frameworks.md","line_end":134,"line_start":123},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":40,"line_start":38},{"file":"SKILL.md","line_end":42,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":56,"line_start":54},{"file":"SKILL.md","line_end":58,"line_start":56},{"file":"SKILL.md","line_end":62,"line_start":58},{"file":"SKILL.md","line_end":66,"line_start":62},{"file":"SKILL.md","line_end":68,"line_start":66},{"file":"SKILL.md","line_end":69,"line_start":68},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":82,"line_start":79},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":84,"line_start":83},{"file":"SKILL.md","line_end":91,"line_start":84},{"file":"SKILL.md","line_end":92,"line_start":91},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":101,"line_start":96},{"file":"SKILL.md","line_end":104,"line_start":101},{"file":"SKILL.md","line_end":106,"line_start":104},{"file":"SKILL.md","line_end":107,"line_start":106},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":129,"line_start":118},{"file":"SKILL.md","line_end":129,"line_start":129},{"file":"SKILL.md","line_end":130,"line_start":130}]},{"factor":"env_access","evidence":[{"file":"references/frameworks.md","line_end":51,"line_start":51},{"file":"references/frameworks.md","line_end":86,"line_start":86},{"file":"references/frameworks.md","line_end":51,"line_start":51},{"file":"references/frameworks.md","line_end":86,"line_start":86},{"file":"references/frameworks.md","line_end":148,"line_start":148},{"file":"references/frameworks.md","line_end":178,"line_start":178},{"file":"references/frameworks.md","line_end":51,"line_start":51},{"file":"references/frameworks.md","line_end":86,"line_start":86},{"file":"references/frameworks.md","line_end":148,"line_start":148},{"file":"references/frameworks.md","line_end":178,"line_start":178},{"file":"references/frameworks.md","line_end":198,"line_start":198},{"file":"references/frameworks.md","line_end":230,"line_start":230},{"file":"references/frameworks.md","line_end":282,"line_start":282},{"file":"references/frameworks.md","line_end":286,"line_start":286},{"file":"references/frameworks.md","line_end":292,"line_start":292},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":129,"line_start":129}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":65,"line_start":65}]}],"critical_findings":[],"high_findings":[{"title":"Generic API/secret keys","locations":[{"file":"references/frameworks.md","line_end":282,"line_start":282}],"confidence":0.83,"description":"export LOGBREW_SERVER_API_KEY=\"your project-scoped server ingest key\"","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The shell export example invites entry of an actual ingest key in a command, which can persist in shell history."}],"medium_findings":[{"title":"Unreviewed generated install command","locations":[{"file":"SKILL.md","line_end":45,"line_start":42},{"file":"SKILL.md","line_end":75,"line_start":73}],"confidence":0.85,"description":"The instructions execute the CLI-provided install command without requiring validation of its executable, arguments, or package source. A compromised CLI or manipulated output could cause unintended command execution.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The instructions explicitly use and run the generated command, but exploitation depends on compromised or manipulated CLI output."},{"title":"Existing logs may expose sensitive data","locations":[{"file":"SKILL.md","line_end":86,"line_start":85},{"file":"SKILL.md","line_end":24,"line_start":23}],"confidence":0.84,"description":"Connecting the existing logger can send current logs to an external service without first checking their contents. Existing records may contain sensitive data despite the rules for newly added logs.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The skill forwards current logs while applying logging rules to added events; exposure depends on the existing application logs and SDK privacy settings."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":3,"total_lines":520,"audit_model":"codex","audited_at":"2026-10-27T11:31:16.964+00:00","created_at":"2026-10-27T18:05:46.959343+00:00","static_findings":[{"id":"scripts:references/frameworks.md:209:dynamic-import-expression","file":"references/frameworks.md","pattern":"Dynamic import() expression","snippet":"import (","category":"scripts","line_end":221,"severity":"medium","line_start":209},{"id":"external_commands:references/frameworks.md:123:ruby-shell-backtick-execution","file":"references/frameworks.md","pattern":"Ruby/shell backtick execution","snippet":"`Retry after ${error instanceof Error ? error.message : \"React error\"}`","category":"external_commands","line_end":134,"severity":"medium","line_start":123},{"id":"env_access:references/frameworks.md:51:environment-variable-access-dot-notation","file":"references/frameworks.md","pattern":"Environment variable access (dot notation)","snippet":"const logbrewServerApiKey = process.env.LOGBREW_SERVER_API_KEY;","category":"env_access","line_end":51,"severity":"low","line_start":51},{"id":"env_access:references/frameworks.md:86:environment-variable-access-dot-notation","file":"references/frameworks.md","pattern":"Environment variable access (dot notation)","snippet":"serverApiKey: process.env.LOGBREW_SERVER_API_KEY,","category":"env_access","line_end":86,"severity":"low","line_start":86},{"id":"env_access:references/frameworks.md:51:environment-variable-object","file":"references/frameworks.md","pattern":"Environment variable object","snippet":"const logbrewServerApiKey = process.env.LOGBREW_SERVER_API_KEY;","category":"env_access","line_end":51,"severity":"low","line_start":51},{"id":"env_access:references/frameworks.md:86:environment-variable-object","file":"references/frameworks.md","pattern":"Environment variable object","snippet":"serverApiKey: process.env.LOGBREW_SERVER_API_KEY,","category":"env_access","line_end":86,"severity":"low","line_start":86},{"id":"env_access:references/frameworks.md:148:python-environment-access","file":"references/frameworks.md","pattern":"Python environment access","snippet":"api_key=os.environ[\"LOGBREW_API_KEY\"],","category":"env_access","line_end":148,"severity":"low","line_start":148},{"id":"env_access:references/frameworks.md:178:python-environment-access","file":"references/frameworks.md","pattern":"Python environment access","snippet":"api_key=os.environ[\"LOGBREW_SERVER_API_KEY\"],","category":"env_access","line_end":178,"severity":"low","line_start":178},{"id":"env_access:references/frameworks.md:51:generic-api-secret-keys","file":"references/frameworks.md","pattern":"Generic API/secret keys","snippet":"const logbrewServerApiKey = process.env.LOGBREW_SERVER_API_KEY;","category":"env_access","line_end":51,"severity":"high","line_start":51},{"id":"env_access:references/frameworks.md:86:generic-api-secret-keys","file":"references/frameworks.md","pattern":"Generic API/secret keys","snippet":"serverApiKey: process.env.LOGBREW_SERVER_API_KEY,","category":"env_access","line_end":86,"severity":"high","line_start":86},{"id":"env_access:references/frameworks.md:148:generic-api-secret-keys","file":"references/frameworks.md","pattern":"Generic API/secret keys","snippet":"api_key=os.environ[\"LOGBREW_API_KEY\"],","category":"env_access","line_end":148,"severity":"high","line_start":148},{"id":"env_access:references/frameworks.md:178:generic-api-secret-keys","file":"references/frameworks.md","pattern":"Generic API/secret keys","snippet":"api_key=os.environ[\"LOGBREW_SERVER_API_KEY\"],","category":"env_access","line_end":178,"severity":"high","line_start":178},{"id":"env_access:references/frameworks.md:198:generic-api-secret-keys","file":"references/frameworks.md","pattern":"Generic API/secret keys","snippet":"The initializer reads `LOGBREW_SERVER_API_KEY`, `LOGBREW_SERVICE_NAME`,","category":"env_access","line_end":198,"severity":"high","line_start":198},{"id":"env_access:references/frameworks.md:230:generic-api-secret-keys","file":"references/frameworks.md","pattern":"Generic API/secret keys","snippet":"APIKey: os.Getenv(\"LOGBREW_SERVER_API_KEY\"),","category":"env_access","line_end":230,"severity":"high","line_start":230},{"id":"env_access:references/frameworks.md:282:generic-api-secret-keys","file":"references/frameworks.md","pattern":"Generic API/secret keys","snippet":"export LOGBREW_SERVER_API_KEY=\"your project-scoped server ingest key\"","category":"env_access","line_end":282,"severity":"high","line_start":282},{"id":"env_access:references/frameworks.md:286:generic-api-secret-keys","file":"references/frameworks.md","pattern":"Generic API/secret keys","snippet":"No initializer is needed. Without `LOGBREW_SERVER_API_KEY`, the integration","category":"env_access","line_end":286,"severity":"high","line_start":286},{"id":"env_access:references/frameworks.md:292:generic-api-secret-keys","file":"references/frameworks.md","pattern":"Generic API/secret keys","snippet":"Set `LOGBREW_SERVER_API_KEY`, `LOGBREW_SERVICE_NAME`,","category":"env_access","line_end":292,"severity":"high","line_start":292},{"id":"sensitive:references/frameworks.md:51:environment-file-access","file":"references/frameworks.md","pattern":"Environment file access","snippet":"const logbrewServerApiKey = process.env.LOGBREW_SERVER_API_KEY;","category":"sensitive","line_end":51,"severity":"high","line_start":51},{"id":"sensitive:references/frameworks.md:86:environment-file-access","file":"references/frameworks.md","pattern":"Environment file access","snippet":"serverApiKey: process.env.LOGBREW_SERVER_API_KEY,","category":"sensitive","line_end":86,"severity":"high","line_start":86},{"id":"blocker:references/frameworks.md:36:system-reconnaissance","file":"references/frameworks.md","pattern":"System reconnaissance","snippet":"| Kotlin and Android | `co.logbrew:logbrew-kotlin` from Maven Central | [`logbrew-kotlin`](https://g","category":"blocker","line_end":36,"severity":"low","line_start":36},{"id":"sensitive:references/logging-rules.md:26:crypto-seed-private-key-mention","file":"references/logging-rules.md","pattern":"Crypto seed/private key mention","snippet":"headers, card numbers, or private keys.","category":"sensitive","line_end":26,"severity":"high","line_start":26},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"key. Browser and mobile code use a key of kind `browser`, never a server","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":40,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":42,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Read `detected` (manifest, runtime, package manager). When `install_plan`","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"is not `null`, use `install_plan.install_command`, check each item in","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`install_plan.compatibility`, and read `install_plan.surfaces` for the key","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"kind that each surface needs. When `install_plan` is `null`, select the","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`brew install LogBrewCo/tap/logbrew` or `npm install -g logbrew-cli@latest`,","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":56,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":58,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If it reports no authentication, ask a person to run `logbrew login` once,","category":"external_commands","line_end":62,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":66,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":68,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run only one of the 2 commands: `projects create` for a new project, or","category":"external_commands","line_end":69,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`projects keys create` for an existing one. Read `project.id` from the","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`LOGBREW_SERVER_API_KEY`. Do not write it in source files.","category":"external_commands","line_end":82,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`LOGBREW_SERVICE_NAME`, `LOGBREW_ENVIRONMENT`, and `LOGBREW_RELEASE`. Take","category":"external_commands","line_end":82,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"the release from the deployment, such as `checkout-api@1.4.0` or a commit","category":"external_commands","line_end":84,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"SHA. Do not use `latest`, a branch name, or an empty value.","category":"external_commands","line_end":91,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"already has, or log 1 `info` message with a unique marker, such as","category":"external_commands","line_end":92,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`setup check 2026-10-26T10:00:00Z`. Keep it at `info`; do not make a fake","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The SDK or the app reports a `2xx` status. This shows only that LogBrew","category":"external_commands","line_end":101,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":104,"severity":"medium","line_start":101},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":106,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"With a project read key instead of account access, set `LOGBREW_TOKEN` to","category":"external_commands","line_end":107,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"the key and leave out `--project`. With the MCP server, use `logs.list.v1`","category":"external_commands","line_end":107,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"with `project_id`, `search`, and `since`.","category":"external_commands","line_end":108,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. Read the SDK delivery error. `unauthenticated` means the ingest key is","category":"external_commands","line_end":129,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(`LOGBREW_SERVER_API_KEY`, `LOGBREW_SERVICE_NAME`,","category":"external_commands","line_end":129,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`LOGBREW_ENVIRONMENT`, `LOGBREW_RELEASE`, or the names that the SDK uses);","category":"external_commands","line_end":130,"severity":"medium","line_start":130},{"id":"filesystem:SKILL.md:63:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"install -d -m 700 \"$HOME/.logbrew\"","category":"filesystem","line_end":63,"severity":"medium","line_start":63},{"id":"filesystem:SKILL.md:64:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"logbrew projects create \"$APP_NAME\" --runtime \"$RUNTIME\" --environment development --ingest-key-file","category":"filesystem","line_end":64,"severity":"medium","line_start":64},{"id":"filesystem:SKILL.md:65:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"logbrew projects keys create \"$PROJECT_ID\" --kind server --label \"$APP_NAME server\" --ingest-key-fil","category":"filesystem","line_end":65,"severity":"medium","line_start":65},{"id":"env_access:SKILL.md:79:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"`LOGBREW_SERVER_API_KEY`. Do not write it in source files.","category":"env_access","line_end":79,"severity":"high","line_start":79},{"id":"env_access:SKILL.md:129:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"(`LOGBREW_SERVER_API_KEY`, `LOGBREW_SERVICE_NAME`,","category":"env_access","line_end":129,"severity":"high","line_start":129}],"finding_verdicts":[{"id":"scripts:references/frameworks.md:209:dynamic-import-expression","reason":"This is a Go import declaration, not a dynamic code import.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/frameworks.md:123:ruby-shell-backtick-execution","reason":"This is a JavaScript template literal for a React button, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/frameworks.md:51:environment-variable-access-dot-notation","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:86:environment-variable-access-dot-notation","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:51:environment-variable-object","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:86:environment-variable-object","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:148:python-environment-access","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:178:python-environment-access","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:51:generic-api-secret-keys","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:86:generic-api-secret-keys","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:148:generic-api-secret-keys","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:178:generic-api-secret-keys","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:198:generic-api-secret-keys","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:230:generic-api-secret-keys","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:282:generic-api-secret-keys","reason":"The shell export example invites entry of an actual ingest key in a command, which can persist in shell history.","verdict":"confirmed","confidence":0.83},{"id":"env_access:references/frameworks.md:286:generic-api-secret-keys","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/frameworks.md:292:generic-api-secret-keys","reason":"This documents or reads the project ingest key for LogBrew SDK configuration; no unrelated credential collection is shown.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:references/frameworks.md:51:environment-file-access","reason":"The snippet reads a named environment variable for SDK configuration, not an environment file.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:references/frameworks.md:86:environment-file-access","reason":"The snippet reads a named environment variable for SDK configuration, not an environment file.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/frameworks.md:36:system-reconnaissance","reason":"This table lists the Kotlin SDK package; it does not perform system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/logging-rules.md:26:crypto-seed-private-key-mention","reason":"The guidance explicitly prohibits logging private keys and other secrets.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence around documented setup commands, not backtick command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence around documented setup commands, not backtick command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"These are documented package installation commands in Markdown, not Ruby or shell backtick substitution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence around documented setup commands, not backtick command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence around documented setup commands, not backtick command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence around documented setup commands, not backtick command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence around documented setup commands, not backtick command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence around documented setup commands, not backtick command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The match is a Markdown code fence around documented setup commands, not backtick command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The backticks mark inline Markdown for setup terms or commands; they are not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:63:hidden-file-access","reason":"The command creates or uses a dedicated LogBrew key file; the documented CLI writes a new owner-only file.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:64:hidden-file-access","reason":"The command creates or uses a dedicated LogBrew key file; the documented CLI writes a new owner-only file.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:SKILL.md:65:hidden-file-access","reason":"The command creates or uses a dedicated LogBrew key file; the documented CLI writes a new owner-only file.","verdict":"false_positive","confidence":0.95},{"id":"env_access:SKILL.md:79:generic-api-secret-keys","reason":"This names the SDK configuration variable and instructs users not to put keys in source files.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:129:generic-api-secret-keys","reason":"This names the SDK configuration variable and instructs users not to put keys in source files.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Unreviewed generated install command","severity":"medium","locations":[{"file":"SKILL.md","line_end":45,"line_start":42},{"file":"SKILL.md","line_end":75,"line_start":73}],"confidence":0.85,"description":"The instructions execute the CLI-provided install command without requiring validation of its executable, arguments, or package source. A compromised CLI or manipulated output could cause unintended command execution.","confidence_reasoning":"The instructions explicitly use and run the generated command, but exploitation depends on compromised or manipulated CLI output."},{"title":"Existing logs may expose sensitive data","severity":"medium","locations":[{"file":"SKILL.md","line_end":86,"line_start":85},{"file":"SKILL.md","line_end":24,"line_start":23}],"confidence":0.84,"description":"Connecting the existing logger can send current logs to an external service without first checking their contents. Existing records may contain sensitive data despite the rules for newly added logs.","confidence_reasoning":"The skill forwards current logs while applying logging rules to added events; exposure depends on the existing application logs and SDK privacy settings."}],"subject_marketplace_commit_sha":"07bd35e828bc5e79e3fd7ad19a1298e33cdbb753","subject_content_hash":"e2c98b7a9b3718d43ff48cf62b8af49980f80914d2a86771f95cfc7356000931","subject_tree_hash":"eda4e75150c16c46a68f99b01fd5130a298611566e156a71e7abe550b76ee282","subject_plugin_path":"skills/logbrewco/instrument-app","audit_payload_hash":"351c262dc592057a030a37e92fc7ecb9","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"07bd35e828bc5e79e3fd7ad19a1298e33cdbb753","contentHash":"e2c98b7a9b3718d43ff48cf62b8af49980f80914d2a86771f95cfc7356000931","treeHash":"eda4e75150c16c46a68f99b01fd5130a298611566e156a71e7abe550b76ee282","pluginPath":"skills/logbrewco/instrument-app","auditPayloadHash":"351c262dc592057a030a37e92fc7ecb9"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/logbrewco-instrument-app/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}