{"data":{"skill":{"slug":"longbridge-longbridge-content","name":"longbridge-content","icon":"📦","repo":"https://github.com/longbridge/skills/tree/main/skills/longbridge-content","status":"approved","author":"longbridge","authorVersion":"1.0.0","skillstoreRevision":2},"audit":{"id":"d1650dc8-4c86-414b-b753-516cce65e872","skill_id":"42a5833e-62c8-4f9c-b976-e804c059b973","version":5,"content_hash":"v3:ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006:aeb19acd52cca852c40f643b4faf708f4ed606b5680c7f67796f80899381efe9:a3ccfa456752189c90af74aee33a4a92a2c371a6799a0d499e19d0f497670735:736b696c6c732f6c6f6e676272696467652f6c6f6e676272696467652d636f6e74656e74:a17fb934855ed01e17fdda06c99ac74a","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 11 static findings are false positives caused by Markdown inline code or code fences; none performs Ruby or shell backtick execution. The skill documents a fixed Longbridge CLI workflow, but no dynamic shell construction, credential access, exfiltration intent, or prompt injection was found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"references/filing.md","line_end":38,"line_start":31},{"file":"references/topic.md","line_end":43,"line_start":36},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":72,"line_start":72},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":83,"line_start":77}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":6,"total_lines":549,"audit_model":"codex","audited_at":"2026-07-23T17:51:41.33+00:00","created_at":"2026-07-25T21:20:57.139213+00:00","static_findings":[{"id":"external_commands:references/filing.md:31:ruby-shell-backtick-execution","file":"references/filing.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":38,"severity":"medium","line_start":31},{"id":"external_commands:references/topic.md:36:ruby-shell-backtick-execution","file":"references/topic.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":43,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Trigger when user asks about: latest news for a stock, company announcements / regulatory filings, c","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run `longbridge <cmd> --help` for current flags and output fields.","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `news` — latest news articles for a symbol; fetch full article content","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `filing` — regulatory filings list; fetch full filing content","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `topic` — community discussion topics for a symbol; keyword search","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `command not found: longbridge` | Install longbridge-terminal |","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Analyst ratings / institutional data | `longbridge-research` |","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Morning briefing / catalyst radar | `longbridge-intel` |","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":83,"severity":"medium","line_start":77}],"finding_verdicts":[{"id":"external_commands:references/filing.md:31:ruby-shell-backtick-execution","reason":"The backticks format the literal asterisk character in CLI help text. They are Markdown syntax and cannot execute Ruby or shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:references/topic.md:36:ruby-shell-backtick-execution","reason":"The backticks format the literal asterisk character in CLI help text. They are Markdown syntax and cannot execute Ruby or shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The backticks mark the longbridge-research skill name as inline Markdown code. There is no shell expression or executable code at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The backticks present a fixed CLI help command in prose. This is Markdown formatting, not command substitution or dynamic shell construction.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The backticks format the news subcommand name in a Markdown heading. No command is executed by the document.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The backticks format the filing subcommand name in a Markdown heading. No command is executed by the document.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The backticks format the topic subcommand name in a Markdown heading. No command is executed by the document.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The backticks format an expected command-not-found error message. The text neither invokes a process nor constructs a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The backticks format the related longbridge-research skill name in a table. This is a reference, not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The backticks format the related longbridge-intel skill name in a table. This is a reference, not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Markdown block that displays the file layout. They do not perform shell command substitution.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","subject_content_hash":"aeb19acd52cca852c40f643b4faf708f4ed606b5680c7f67796f80899381efe9","subject_tree_hash":"a3ccfa456752189c90af74aee33a4a92a2c371a6799a0d499e19d0f497670735","subject_plugin_path":"skills/longbridge/longbridge-content","audit_payload_hash":"a17fb934855ed01e17fdda06c99ac74a","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","contentHash":"aeb19acd52cca852c40f643b4faf708f4ed606b5680c7f67796f80899381efe9","treeHash":"a3ccfa456752189c90af74aee33a4a92a2c371a6799a0d499e19d0f497670735","pluginPath":"skills/longbridge/longbridge-content","auditPayloadHash":"a17fb934855ed01e17fdda06c99ac74a"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/longbridge-longbridge-content/audits/5/attestation","status":"superseded"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"superseded","verificationState":"not_verified"},"isLatest":false}}