{"data":{"skill":{"slug":"metixai-official-metix-company-search","name":"metix-company-search","icon":"📦","repo":"https://github.com/metixai-official/metix-skills/tree/989f0b41515b405e4dd2ac73d527399f4f027746/skills/metix-company-search","status":"approved","author":"metixai-official","authorVersion":null,"skillstoreRevision":1,"license":null},"licenseCorrection":null,"audit":{"id":"a01504d2-ae2d-4dc9-8d38-e63f9c58664a","skill_id":"120f4048-7596-4bdf-8998-46d6916d4a28","version":1,"content_hash":"v3:9938f91a9ab0f5763a54332b129295339bf829dd:a05b6085f89a1d19b6d9b72f2926a73fd74f16a2d94dc72bcb89ec8dcb408ffc:04a14e6a2c99cb628c7be41fa0d811028ecbb5f3fae3ea3c9dfdcd35db104183:736b696c6c732f6d6574697861692d6f6666696369616c2f6d657469782d636f6d70616e792d736561726368:ef5754a7f76666e1eb4db458b2457aa9","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 38 static findings are false positives: Markdown backticks, documented Metix HTTPS endpoints, and company identifiers do not indicate execution or reconnaissance. Credential use is limited to the documented API, with explicit rules against key discovery and disclosure. No evidence found of prompt injection, unauthorized data transfer, or other semantic security issues in SKILL.md; remote services were not inspected.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":30,"line_start":14},{"file":"SKILL.md","line_end":32,"line_start":30},{"file":"SKILL.md","line_end":36,"line_start":32},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":37},{"file":"SKILL.md","line_end":39,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":42},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":48,"line_start":47},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":67,"line_start":54},{"file":"SKILL.md","line_end":69,"line_start":67},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":79,"line_start":73},{"file":"SKILL.md","line_end":80,"line_start":79},{"file":"SKILL.md","line_end":84,"line_start":80}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":63,"line_start":63}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":85,"audit_model":"codex","audited_at":"2026-11-09T03:00:01.028+00:00","created_at":"2026-11-09T16:01:06.446912+00:00","static_findings":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Search returns `company_ids`. Detail returns the records. Field names, operators,","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":32,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The same pages are rendered for people at `https://platform.metix.ai/docs`.","category":"external_commands","line_end":36,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `GET /contract` (or MCP `metix_get_contract`). Build `where` only from","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`querySpecByEntity.company`. The field list is closed; a name outside it is","category":"external_commands","line_end":38,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"refused. Use the operators `fieldOperators` lists for each field: exact","category":"external_commands","line_end":39,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"fields such as `type` take `eq` or `in` with a value from the companies","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"page, ordered fields such as `size` also take `gte`, `gt`, `lte` and `lt` by","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"position in their value list, and `match` is only for free-text fields such","category":"external_commands","line_end":42,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"as `industry`.","category":"external_commands","line_end":43,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `POST /v1/companies/query`, then `POST /entity/v1/companies/detail-by-id`","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. On a 4xx, switch on `error_code`; `msg` says what to change. For the full","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"explanation, fetch `docs_url` with `.md` added to the path:","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`https://platform.metix.ai/docs/reference/errors#query-refusals` becomes","category":"external_commands","line_end":48,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`https://platform.metix.ai/docs/reference/errors.md`, and `query-refusals`","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":67,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":69,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"For the next page, send `data.next` back as `after` with the same `where`.","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Every call reads `METIX_KEY` from the environment. If it is unset, stop and tell","category":"external_commands","line_end":79,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Contact details are a people capability: `POST /v1/contact/unlock`, through","category":"external_commands","line_end":80,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`metix-people-search`. If a user asks for an email or a phone number, send","category":"external_commands","line_end":84,"severity":"medium","line_start":80},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"API     https://mira-api.metix.ai","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Docs    https://mira-api.metix.ai/docs/api/companies.md","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:SKILL.md:23:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/api/jobs.md","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:SKILL.md:24:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/api/people.md","category":"network","line_end":24,"severity":"low","line_start":24},{"id":"network:SKILL.md:25:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/api/contact.md","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:SKILL.md:26:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/api/query-spec.md","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"network:SKILL.md:27:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/reference/errors.md","category":"network","line_end":27,"severity":"low","line_start":27},{"id":"network:SKILL.md:28:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/credits.md","category":"network","line_end":28,"severity":"low","line_start":28},{"id":"network:SKILL.md:29:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://platform.metix.ai/llms.txt","category":"network","line_end":29,"severity":"low","line_start":29},{"id":"network:SKILL.md:32:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"The same pages are rendered for people at `https://platform.metix.ai/docs`.","category":"network","line_end":32,"severity":"low","line_start":32},{"id":"network:SKILL.md:47:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`https://platform.metix.ai/docs/reference/errors#query-refusals` becomes","category":"network","line_end":47,"severity":"low","line_start":47},{"id":"network:SKILL.md:48:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`https://platform.metix.ai/docs/reference/errors.md`, and `query-refusals`","category":"network","line_end":48,"severity":"low","line_start":48},{"id":"network:SKILL.md:55:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -s https://mira-api.metix.ai/v1/companies/query \\","category":"network","line_end":55,"severity":"low","line_start":55},{"id":"network:SKILL.md:63:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -s https://mira-api.metix.ai/entity/v1/companies/detail-by-id \\","category":"network","line_end":63,"severity":"low","line_start":63},{"id":"blocker:SKILL.md:63:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"curl -s https://mira-api.metix.ai/entity/v1/companies/detail-by-id \\","category":"blocker","line_end":63,"severity":"low","line_start":63},{"id":"blocker:SKILL.md:65:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"-d '{\"company_ids\": [\"<an id from data.company_ids>\"],","category":"blocker","line_end":65,"severity":"low","line_start":65}],"finding_verdicts":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","reason":"The backticks mark company_ids as an inline identifier in Markdown. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"Lines 14-30 form a Markdown code fence listing API resources and documentation. The fence does not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Line 30 closes a Markdown resource listing, and line 32 formats a documentation URL. Neither is shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The backticks format a documentation URL and API identifiers in prose. There is no executable shell or Ruby expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"GET /contract, metix_get_contract, and where are inline Markdown references to documented API operations. They are not shell substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"querySpecByEntity.company and fieldOperators are contract property names formatted with Markdown backticks. This text describes query validation, not code execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The marked text names allowed fields and operators using inline Markdown formatting. It contains no shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"type, eq, and in are documented query identifiers enclosed in Markdown backticks. They do not invoke a command interpreter.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"size and comparison operators are inline Markdown examples of contract-supported filters. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"match and industry are Markdown-formatted query terms. The passage restricts operator usage and does not execute code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The matched backticks delimit industry and HTTP endpoint names in documentation. They are not shell execution syntax in an executable context.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The inline text names the company query and detail endpoints. Markdown backticks around HTTP routes do not execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"error_code and msg are response property names highlighted with inline backticks. This is ordinary API error-handling documentation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"docs_url and .md are Markdown-formatted references for finding error documentation. Neither constitutes shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The backticks enclose example Metix documentation URLs. The passage illustrates URL conversion, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"A documentation URL and section identifier are enclosed in Markdown backticks. There is no executable Ruby or shell expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The backticks delimit a Bash example containing curl requests to the documented Metix API. No backtick execution or unrelated command is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"Line 67 closes the Markdown example, and line 69 formats pagination properties. These backticks are documentation syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"data.next, after, and where are inline Markdown identifiers describing pagination. No shell substitution occurs.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"METIX_KEY is a Markdown-formatted environment variable name. The surrounding rules prohibit credential discovery and disclosure rather than invoking shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The backticks format an HTTP endpoint and a related skill name. This is a scope boundary for contact lookup, not command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The marked text contains a related skill name and credits documentation path in Markdown. Neither is executable backtick syntax.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:15:hardcoded-url","reason":"This HTTPS URL is the declared Metix API base for the requested company-search workflow. No unrelated destination or unauthorized payload is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:22:hardcoded-url","reason":"The URL points to company API documentation on the declared Metix service. It is a relevant reference, not an exfiltration endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:23:hardcoded-url","reason":"The URL is a jobs API documentation reference on the same Metix service. The file does not direct sensitive data to this page.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:24:hardcoded-url","reason":"The URL references people API documentation within the declared Metix service. It provides context for related workflows without an unauthorized transfer.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:25:hardcoded-url","reason":"The URL points to contact API documentation on the same Metix service. The skill explicitly routes contact requests to a separate people capability.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:26:hardcoded-url","reason":"This Metix query-specification documentation supports constructing valid company filters. No secret transmission or unrelated network activity is indicated.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:27:hardcoded-url","reason":"This URL is the declared service's error documentation. Consulting it is relevant to API failures and does not itself disclose credentials.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:28:hardcoded-url","reason":"The URL references Metix credit pricing documentation for the API workflow. No sensitive payload or unrelated recipient is specified.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:29:hardcoded-url","reason":"The llms.txt URL is listed as a Metix platform documentation resource. No instruction to execute downloaded content or transmit private data appears.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:32:hardcoded-url","reason":"This is the human-readable Metix documentation site identified in the resource section. A relevant documentation link is not unauthorized network activity.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:47:hardcoded-url","reason":"The URL illustrates a Metix error-documentation section. It does not carry secrets or direct requests to an unrelated service.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:48:hardcoded-url","reason":"The URL demonstrates the Markdown form of the same Metix error page. No executable download or credential transfer is requested.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:55:hardcoded-url","reason":"The curl example sends company filters and the designated authentication key to the declared Metix API over HTTPS. This is intended service authentication.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:63:hardcoded-url","reason":"The request sends company IDs and a field selection to the declared Metix detail endpoint over HTTPS. Credential use matches the documented service.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:63:system-reconnaissance","reason":"The detail-by-id text is part of a remote company-record endpoint, not a local identity command. The example performs no system enumeration.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:65:system-reconnaissance","reason":"company_ids is a JSON request property containing IDs returned by company search. It does not inspect local users, processes, or machine configuration.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"9938f91a9ab0f5763a54332b129295339bf829dd","subject_content_hash":"a05b6085f89a1d19b6d9b72f2926a73fd74f16a2d94dc72bcb89ec8dcb408ffc","subject_tree_hash":"04a14e6a2c99cb628c7be41fa0d811028ecbb5f3fae3ea3c9dfdcd35db104183","subject_plugin_path":"skills/metixai-official/metix-company-search","audit_payload_hash":"ef5754a7f76666e1eb4db458b2457aa9","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"9938f91a9ab0f5763a54332b129295339bf829dd","contentHash":"a05b6085f89a1d19b6d9b72f2926a73fd74f16a2d94dc72bcb89ec8dcb408ffc","treeHash":"04a14e6a2c99cb628c7be41fa0d811028ecbb5f3fae3ea3c9dfdcd35db104183","pluginPath":"skills/metixai-official/metix-company-search","auditPayloadHash":"ef5754a7f76666e1eb4db458b2457aa9"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/metixai-official-metix-company-search/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}