{"data":{"skill":{"slug":"metixai-official-metix-people-search","name":"metix-people-search","icon":"📦","repo":"https://github.com/metixai-official/metix-skills/tree/989f0b41515b405e4dd2ac73d527399f4f027746/skills/metix-people-search","status":"approved","author":"metixai-official","authorVersion":null,"skillstoreRevision":1,"license":null},"licenseCorrection":null,"audit":{"id":"5f386585-97e6-4de8-88e4-38bbecb6ee29","skill_id":"8ad2ec91-3598-4023-8a68-0ec9e7d48cc4","version":1,"content_hash":"v3:9938f91a9ab0f5763a54332b129295339bf829dd:d33ef9ea4706c5ba3da8188725826011d2fee9185a4a84b0e88ea28de074aced:6c07d2c05de1684377e9f88067e655f9d11adbb4f085d52fb2375cc15a49e29e:736b696c6c732f6d6574697861692d6f6666696369616c2f6d657469782d70656f706c652d736561726368:3ca9dfd25e06b6acefdd77fecbdb6143","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 59 static findings are false positives: Markdown backticks, documented Metix URLs, and profile identifiers do not indicate execution or system reconnaissance. API authentication uses the designated environment key, with explicit rules against exposing it or searching for substitute credentials. No evidence found of malicious instructions, unauthorized exfiltration, or additional intent-level risks in the reviewed file.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":32,"line_start":16},{"file":"SKILL.md","line_end":34,"line_start":32},{"file":"SKILL.md","line_end":38,"line_start":34},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":40,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":40},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":44,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":48,"line_start":46},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":51,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":58,"line_start":57},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":73,"line_start":60},{"file":"SKILL.md","line_end":75,"line_start":73},{"file":"SKILL.md","line_end":75,"line_start":75},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":77,"line_start":77},{"file":"SKILL.md","line_end":87,"line_start":83},{"file":"SKILL.md","line_end":89,"line_start":87},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":90,"line_start":90},{"file":"SKILL.md","line_end":91,"line_start":91},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":97,"line_start":95},{"file":"SKILL.md","line_end":98,"line_start":97},{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":106,"line_start":105},{"file":"SKILL.md","line_end":106,"line_start":106},{"file":"SKILL.md","line_end":121,"line_start":112},{"file":"SKILL.md","line_end":125,"line_start":121},{"file":"SKILL.md","line_end":131,"line_start":125},{"file":"SKILL.md","line_end":133,"line_start":131},{"file":"SKILL.md","line_end":141,"line_start":133},{"file":"SKILL.md","line_end":142,"line_start":141},{"file":"SKILL.md","line_end":143,"line_start":142},{"file":"SKILL.md","line_end":147,"line_start":143}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":69,"line_start":69}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":149,"audit_model":"codex","audited_at":"2026-11-09T03:06:02.666+00:00","created_at":"2026-11-09T16:01:25.373474+00:00","static_findings":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Search returns `profile_ids`. Detail returns the records. Prefer the structured","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":32,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":34,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The same pages are rendered for people at `https://platform.metix.ai/docs`.","category":"external_commands","line_end":38,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `GET /contract` (or MCP `metix_get_contract`). Build `where` only from","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`querySpecByEntity.profile`. The field list is closed; a name outside it is","category":"external_commands","line_end":40,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"refused. Use the operators `fieldOperators` lists for each field: exact","category":"external_commands","line_end":41,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"fields such as `experience.function`, `experience.seniority` or","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`location.country` take `eq` or `in` with a whole value from the people","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"page, and `match` is only for free-text fields.","category":"external_commands","line_end":44,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `POST /v1/people/query` for a structured tree, or `POST /v1/people-search`","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"with `text` (not `query`) when the constraints will not sit on fields. Then","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`POST /entity/v1/profiles/detail-by-id` with up to 100 of those IDs. Search","category":"external_commands","line_end":48,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. On a 4xx, switch on `error_code`; `msg` says what to change. For the full","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"explanation, fetch `docs_url` with `.md` added to the path:","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`https://platform.metix.ai/docs/reference/errors#query-refusals` becomes","category":"external_commands","line_end":51,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`https://platform.metix.ai/docs/reference/errors.md`, and `query-refusals`","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Search, then read the records. `location.country` is an exact field: it takes","category":"external_commands","line_end":58,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"the whole country name with `eq` or `in`, and refuses `match`.","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":73,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":75,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"For the next page, send `data.next` back as `after` with the same `where`.","category":"external_commands","line_end":75,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`POST /v1/people-search` takes `text` and `size` only, and returns","category":"external_commands","line_end":76,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`profile_ids` with no `total` and no `next`.","category":"external_commands","line_end":77,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Put the requirements in `where`, and keep preferences out.** Every leaf has","category":"external_commands","line_end":87,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`any`.","category":"external_commands","line_end":89,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"with `eq` (`\"United States\"`), a state its full name. Seniority fields take","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`eq` or `in` with labels from `closedValues`; they have no `gte`. \"5+ years\" is","category":"external_commands","line_end":90,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`total_experience_months` `gte` 60. `education.degree` is ordered, so `gte`","category":"external_commands","line_end":91,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"on profiles. Count a few spellings with `size: 1` and compare `total`, or read","category":"external_commands","line_end":94,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`current_title` on a few records.","category":"external_commands","line_end":97,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`has_experience` match the same job; separate leaves can match different jobs.","category":"external_commands","line_end":98,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Count before pulling records.** `size: 1` returns `total`, exact below","category":"external_commands","line_end":98,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Read only what you need.** Name the fields in `_source` on detail.","category":"external_commands","line_end":106,"severity":"medium","line_start":105},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`headline`, `summary` and `experience.description` are left out of the","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":121,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":125,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Every call reads `METIX_KEY` from the environment. If it is unset, stop and tell","category":"external_commands","line_end":131,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Contact details live on `POST /v1/contact/unlock`, for people you already","category":"external_commands","line_end":133,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"per-call rates on the API, so narrow the list first. `POST /v1/contact/probe`","category":"external_commands","line_end":141,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"figure before the call. Both routes have MCP tools, `metix_probe_contacts` and","category":"external_commands","line_end":142,"severity":"medium","line_start":141},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`metix_unlock_contacts`, so an MCP session does not have to drop to raw HTTP for","category":"external_commands","line_end":143,"severity":"medium","line_start":142},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"them. Unlock over MCP needs a connection granted the `contact:unlock` scope.","category":"external_commands","line_end":147,"severity":"medium","line_start":143},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"API     https://mira-api.metix.ai","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:SKILL.md:24:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Docs    https://mira-api.metix.ai/docs/api/people.md","category":"network","line_end":24,"severity":"low","line_start":24},{"id":"network:SKILL.md:25:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/api/contact.md","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:SKILL.md:26:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/api/jobs.md","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"network:SKILL.md:27:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/api/companies.md","category":"network","line_end":27,"severity":"low","line_start":27},{"id":"network:SKILL.md:28:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/api/query-spec.md","category":"network","line_end":28,"severity":"low","line_start":28},{"id":"network:SKILL.md:29:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/reference/errors.md","category":"network","line_end":29,"severity":"low","line_start":29},{"id":"network:SKILL.md:30:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/credits.md","category":"network","line_end":30,"severity":"low","line_start":30},{"id":"network:SKILL.md:31:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://platform.metix.ai/llms.txt","category":"network","line_end":31,"severity":"low","line_start":31},{"id":"network:SKILL.md:34:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"The same pages are rendered for people at `https://platform.metix.ai/docs`.","category":"network","line_end":34,"severity":"low","line_start":34},{"id":"network:SKILL.md:50:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`https://platform.metix.ai/docs/reference/errors#query-refusals` becomes","category":"network","line_end":50,"severity":"low","line_start":50},{"id":"network:SKILL.md:51:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`https://platform.metix.ai/docs/reference/errors.md`, and `query-refusals`","category":"network","line_end":51,"severity":"low","line_start":51},{"id":"network:SKILL.md:61:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -s https://mira-api.metix.ai/v1/people/query \\","category":"network","line_end":61,"severity":"low","line_start":61},{"id":"network:SKILL.md:69:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -s https://mira-api.metix.ai/entity/v1/profiles/detail-by-id \\","category":"network","line_end":69,"severity":"low","line_start":69},{"id":"blocker:SKILL.md:69:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"curl -s https://mira-api.metix.ai/entity/v1/profiles/detail-by-id \\","category":"blocker","line_end":69,"severity":"low","line_start":69},{"id":"blocker:SKILL.md:71:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"-d '{\"profile_ids\": [\"<an id from data.profile_ids>\"],","category":"blocker","line_end":71,"severity":"low","line_start":71}],"finding_verdicts":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","reason":"The backticks format the response field profile_ids in Markdown prose. They do not invoke a shell or Ruby interpreter.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"The triple backticks open a Markdown resource listing containing API routes and documentation links. The block contains no executable backtick substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"This is the closing Markdown fence for the resource listing. The adjacent URL is also inline documentation, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"Backticks format the Metix documentation URL and the following API route. Neither is evaluated as a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Inline backticks label GET /contract, its MCP equivalent, and a query field. These are documented interface identifiers, not shell substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The marked text names contract properties used to validate search fields. Markdown formatting does not execute those property names.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"Backticks identify fieldOperators and example profile fields. The passage describes contract validation rather than executing commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The marked strings are experience.function and experience.seniority field names. They are inline Markdown, with no interpreter invocation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"Backticks format location.country and the eq and in operators. These are query syntax labels, not executable shell content.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The passage formats the match operator and subsequent HTTP route names. It contains no shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The two backtick-delimited strings are documented POST routes for structured and natural-language searches. They are not shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The text and query strings identify request parameters in explanatory prose. Their Markdown delimiters have no execution semantics.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"Backticks label the profile detail route and subsequent error fields. The passage describes API usage without shell evaluation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The error_code and msg identifiers are response fields formatted as inline code. They are not executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"Backticks identify docs_url and the .md suffix in a documentation retrieval instruction. No shell command substitution appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The marked URLs illustrate converting a Metix documentation page to Markdown. They are inline examples, not executable backticks.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The Markdown URL and query-refusals section name are documentation references. Neither is executed by an interpreter.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"Inline code identifies location.country and its supported operators. This is explanatory query syntax, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"Backticks format eq, in, and match in a field validation rule. They are ordinary Markdown delimiters.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The backticks delimit a Bash example, not command substitution. Its curl requests authenticate only to the documented Metix API using quoted arguments.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"This closes the Bash example and precedes inline pagination field names. The backticks themselves execute nothing.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The marked data.next, after, and where identifiers explain cursor pagination. They are not shell substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"Inline backticks label the natural-language search route and its text and size parameters. This is API documentation, not execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The profile_ids, total, and next strings are response field names in prose. Markdown formatting does not run them.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The backticks format where and any while explaining required filters and alternatives. The passage has no shell evaluation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The marked any and eq terms are query operators, followed by a literal country example. These are Markdown examples, not commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"Backticks format the eq operator and United States value. Neither is executable code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The marked operators and closedValues property explain valid seniority filters. They are not shell command substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"Inline code formats experience duration, degree fields, and the gte operator. This is query construction guidance without command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The size: 1 and total strings describe a count query. Their backticks are Markdown formatting only.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The marked current_title and has_experience names refer to profile fields and query scope. There is no interpreter execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"Backticks identify has_experience and the subsequent size: 1 count parameter. They delimit query terminology, not shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"The size: 1 and total terms describe response counting behavior. They are inline documentation, not executable backticks.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"The marked _source and profile text fields explain selective record retrieval. Their Markdown delimiters perform no execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"Backticks format headline, summary, and experience.description as field names. They are not shell substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"The triple backticks delimit a JSON example containing static search filters. JSON data does not execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"This closes the JSON example before the credential handling section. It is a Markdown fence, not executable syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"Backticks identify METIX_KEY and the subsequent contact route. The rules explicitly prohibit searching for substitute keys and exposing credentials.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"The marked unlock and probe strings are documented contact API routes. The surrounding prose explains costs, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"Inline code labels the contact probe route and later its MCP tool. The passage describes paid API operations without backtick evaluation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"The marked metix_probe_contacts and metix_unlock_contacts strings are MCP tool names. Markdown formatting does not execute them as shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","reason":"Backticks identify an MCP tool and the required contact:unlock authorization scope. These are interface labels, not shell substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"The marked scope and credits documentation path are explanatory literals. The text requires scoped access and prohibits invented contact routes.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:17:hardcoded-url","reason":"The HTTPS URL identifies the Metix API used for the stated search workflow. No unrelated destination or unauthorized transmission is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:24:hardcoded-url","reason":"This is a Metix people API documentation link. The resource listing does not attach secrets or user data to the URL.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:25:hardcoded-url","reason":"This HTTPS link points to Metix contact API documentation supporting the documented lookup workflow. No data export is requested.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:26:hardcoded-url","reason":"The URL is a static jobs documentation reference on the same Metix API host. It contains no payload or executable download instruction.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:27:hardcoded-url","reason":"The URL references Metix company API documentation within the resource catalog. No credential forwarding or unrelated network behavior is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:28:hardcoded-url","reason":"This Metix query specification documentation link directly supports constructing valid search filters. It is not an exfiltration endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:29:hardcoded-url","reason":"The URL references Metix error documentation for troubleshooting API refusals. The listing transmits no sensitive data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:30:hardcoded-url","reason":"This is the Metix credit pricing documentation referenced for cost calculations. No unrelated network action or secret payload is present.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:31:hardcoded-url","reason":"The llms.txt URL is listed as a Metix documentation resource. The file does not instruct executing its contents or overriding audit instructions.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:34:hardcoded-url","reason":"The HTTPS URL names the human-readable Metix documentation site. It is a reference link without credentials or a data payload.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:50:hardcoded-url","reason":"This Metix error documentation URL illustrates converting an anchored page to Markdown. The example contains no sensitive query parameters.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:51:hardcoded-url","reason":"The URL is the Markdown version of the preceding Metix error documentation page. The text requests documentation, not arbitrary code execution.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:61:hardcoded-url","reason":"The curl example sends static search filters to the documented Metix HTTPS API. METIX_KEY is used as its authentication header, not exported elsewhere.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:69:hardcoded-url","reason":"The request retrieves selected fields for search-returned profile IDs from the documented Metix API. It does not upload local files or target unrelated services.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:69:system-reconnaissance","reason":"The detail-by-id URL retrieves professional profile records from Metix. It does not enumerate local users, hardware, processes, or system configuration.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:71:system-reconnaissance","reason":"The profile_ids JSON field carries identifiers returned by the search API. It is not a system identity command or local reconnaissance operation.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"9938f91a9ab0f5763a54332b129295339bf829dd","subject_content_hash":"d33ef9ea4706c5ba3da8188725826011d2fee9185a4a84b0e88ea28de074aced","subject_tree_hash":"6c07d2c05de1684377e9f88067e655f9d11adbb4f085d52fb2375cc15a49e29e","subject_plugin_path":"skills/metixai-official/metix-people-search","audit_payload_hash":"3ca9dfd25e06b6acefdd77fecbdb6143","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"9938f91a9ab0f5763a54332b129295339bf829dd","contentHash":"d33ef9ea4706c5ba3da8188725826011d2fee9185a4a84b0e88ea28de074aced","treeHash":"6c07d2c05de1684377e9f88067e655f9d11adbb4f085d52fb2375cc15a49e29e","pluginPath":"skills/metixai-official/metix-people-search","auditPayloadHash":"3ca9dfd25e06b6acefdd77fecbdb6143"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/metixai-official-metix-people-search/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}