{"data":{"skill":{"slug":"metixai-official-metix-platform-assistant","name":"metix-platform-assistant","icon":"📦","repo":"https://github.com/metixai-official/metix-skills/tree/989f0b41515b405e4dd2ac73d527399f4f027746/skills/metix-platform-assistant","status":"approved","author":"metixai-official","authorVersion":null,"skillstoreRevision":1,"license":null},"licenseCorrection":null,"audit":{"id":"1f8ccf3f-487b-4484-b6ba-c1fa650a312a","skill_id":"aab60361-b202-4a75-816e-aefd36d04248","version":1,"content_hash":"v3:9938f91a9ab0f5763a54332b129295339bf829dd:54d0d9264e8d2e600439f0d488dccd1fe6753dc772610ad0791c608944ac4d7f:482914a1bbf677111ce70366dbb6bfd93faa72f095bb8c7e55a8832913582cc0:736b696c6c732f6d6574697861692d6f6666696369616c2f6d657469782d706c6174666f726d2d617373697374616e74:90623853fc628e2e7a89cd19c6e72f0d","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 45 static findings are false positives involving Markdown formatting, documented Metix URLs, or ordinary API examples. No evidence found of prompt injection, system reconnaissance, or unauthorized exfiltration in SKILL.md. The skill requires external API access and credentials, with explicit key protection rules and paid contact retrieval limits.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":30,"line_start":14},{"file":"SKILL.md","line_end":32,"line_start":30},{"file":"SKILL.md","line_end":36,"line_start":32},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":37},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":42},{"file":"SKILL.md","line_end":44,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":47,"line_start":46},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":68,"line_start":60},{"file":"SKILL.md","line_end":70,"line_start":68},{"file":"SKILL.md","line_end":71,"line_start":70},{"file":"SKILL.md","line_end":72,"line_start":71},{"file":"SKILL.md","line_end":72,"line_start":72},{"file":"SKILL.md","line_end":83,"line_start":77},{"file":"SKILL.md","line_end":87,"line_start":83},{"file":"SKILL.md","line_end":93,"line_start":87},{"file":"SKILL.md","line_end":94,"line_start":93},{"file":"SKILL.md","line_end":95,"line_start":94},{"file":"SKILL.md","line_end":101,"line_start":95},{"file":"SKILL.md","line_end":102,"line_start":101}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":65,"line_start":65}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":103,"audit_model":"codex","audited_at":"2026-11-09T03:09:33.346+00:00","created_at":"2026-11-09T16:01:34.476164+00:00","static_findings":[{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":32,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The same pages are rendered for people at `https://platform.metix.ai/docs`.","category":"external_commands","line_end":36,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `GET /contract` (or MCP `metix_get_contract`). Build each `where` from","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`querySpecByEntity` for that dataset. The field lists are closed. Use the","category":"external_commands","line_end":38,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"operators `fieldOperators` lists for each field: exact fields take `eq` or","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`in` with a whole value, and `match` is only for free-text fields.","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Chain on IDs, not on names: ask for `company.id` in `_source` on a job","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"detail call, and a profile's `experience.company.id` is the same kind of","category":"external_commands","line_end":43,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"company token. Both resolve at `/entity/v1/companies/detail-by-id`.","category":"external_commands","line_end":44,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. On a 4xx, switch on `error_code`; `msg` says what to change. For the full","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"explanation, fetch `docs_url` with `.md` added to the path:","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`https://platform.metix.ai/docs/reference/errors#query-refusals` becomes","category":"external_commands","line_end":47,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`https://platform.metix.ai/docs/reference/errors.md`, and `query-refusals`","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"platform roles\": jobs query, job detail with `company.id` in `_source`, company","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":68,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":70,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The three Query Spec search routes take `{\"where\": ..., \"size\": 25}`; the focused","category":"external_commands","line_end":71,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"skills show one for each dataset. `/v1/people-search` is the exception: it takes","category":"external_commands","line_end":72,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`{\"text\": ..., \"size\": 25}` and refuses `where` outright, because it reads a","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Every call reads `METIX_KEY` from the environment. If it is unset, stop and tell","category":"external_commands","line_end":83,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Contact details are callable: `POST /v1/contact/unlock` takes people you have","category":"external_commands","line_end":87,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"expensive call on the API. `POST /v1/contact/probe` says who has one before","category":"external_commands","line_end":93,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"the expected spend. Both routes have MCP tools, `metix_probe_contacts` and","category":"external_commands","line_end":94,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`metix_unlock_contacts`; unlock over MCP needs a connection granted the","category":"external_commands","line_end":95,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`contact:unlock` scope, so a refusal there is about the grant, not the route.","category":"external_commands","line_end":101,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"walk a set; batch. The formulas live on `/docs/credits.md`. Check","category":"external_commands","line_end":102,"severity":"medium","line_start":101},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"API     https://mira-api.metix.ai","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Docs    https://mira-api.metix.ai/docs/api/jobs.md","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:SKILL.md:23:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/api/people.md","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:SKILL.md:24:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/api/contact.md","category":"network","line_end":24,"severity":"low","line_start":24},{"id":"network:SKILL.md:25:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/api/companies.md","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:SKILL.md:26:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/api/query-spec.md","category":"network","line_end":26,"severity":"low","line_start":26},{"id":"network:SKILL.md:27:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/reference/errors.md","category":"network","line_end":27,"severity":"low","line_start":27},{"id":"network:SKILL.md:28:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://mira-api.metix.ai/docs/credits.md","category":"network","line_end":28,"severity":"low","line_start":28},{"id":"network:SKILL.md:29:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"https://platform.metix.ai/llms.txt","category":"network","line_end":29,"severity":"low","line_start":29},{"id":"network:SKILL.md:32:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"The same pages are rendered for people at `https://platform.metix.ai/docs`.","category":"network","line_end":32,"severity":"low","line_start":32},{"id":"network:SKILL.md:46:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`https://platform.metix.ai/docs/reference/errors#query-refusals` becomes","category":"network","line_end":46,"severity":"low","line_start":46},{"id":"network:SKILL.md:47:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"`https://platform.metix.ai/docs/reference/errors.md`, and `query-refusals`","category":"network","line_end":47,"severity":"low","line_start":47},{"id":"network:SKILL.md:61:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -s https://mira-api.metix.ai/entity/v1/jobs/detail-by-id \\","category":"network","line_end":61,"severity":"low","line_start":61},{"id":"network:SKILL.md:65:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -s https://mira-api.metix.ai/entity/v1/companies/detail-by-id \\","category":"network","line_end":65,"severity":"low","line_start":65},{"id":"blocker:SKILL.md:61:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"curl -s https://mira-api.metix.ai/entity/v1/jobs/detail-by-id \\","category":"blocker","line_end":61,"severity":"low","line_start":61},{"id":"blocker:SKILL.md:63:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"-d '{\"job_ids\": [\"<an id from /v1/jobs/query>\"], \"_source\": [\"title\", \"company.id\"]}'","category":"blocker","line_end":63,"severity":"low","line_start":63},{"id":"blocker:SKILL.md:65:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"curl -s https://mira-api.metix.ai/entity/v1/companies/detail-by-id \\","category":"blocker","line_end":65,"severity":"low","line_start":65},{"id":"blocker:SKILL.md:67:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"-d '{\"company_ids\": [\"<company.id from the job record>\"]}'","category":"blocker","line_end":67,"severity":"low","line_start":67}],"finding_verdicts":[{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"The backticks delimit a Markdown resource listing containing API routes and documentation URLs. They do not execute Ruby or shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"This line closes the Markdown resource listing. The following backticks format a documentation URL, not executable shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"Inline backticks format the human-readable Metix documentation URL. No command execution is requested.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Backticks identify an HTTP route, an MCP tool, and a query property. These are documentation labels, not shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The text names querySpecByEntity and fieldOperators as contract properties. Markdown formatting does not execute these identifiers.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Backticks mark fieldOperators and the eq operator in API guidance. There is no Ruby or shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The in and match tokens are documented query operators. They are not executable substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The company.id and _source identifiers describe selecting API response fields. Backticks only apply Markdown styling.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The passage explains company identifier fields and their detail endpoint. No executable backtick expression exists.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The backticks format a relative API route and error response properties. These are documentation references, not commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The error_code and msg names identify response fields used for troubleshooting. Neither performs shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"Inline backticks mark docs_url and the .md suffix in documentation retrieval guidance. No Ruby or shell evaluation is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The passage demonstrates converting a Metix documentation URL into its Markdown form. Backticks only delimit URL text.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The Markdown URL and query-refusals section name are documentation references. No shell substitution is requested.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"Backticks highlight company.id and _source within a cross-dataset workflow. These are API fields, not commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The fenced Bash example makes two HTTPS API requests with JSON bodies and an environment-supplied bearer key. It contains no executable backtick substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"This line closes the Bash example. The following inline backticks describe request body structure, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"Inline code illustrates a JSON request body and references a people search route. Neither is an executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The passage documents the people-search endpoint and its request format. Markdown backticks do not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The JSON example contrasts text input with the where property. It is documentation, not command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"Backticks name the required METIX_KEY variable. Surrounding rules prohibit searching for substitute keys, printing credentials, or writing them to files.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The backticks identify the contact unlock API route. The prose explains its intended data retrieval and pricing, not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"Backticks format the contact probe endpoint. Surrounding text documents batch limits and payment requirements, with no shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"The text names the metix_probe_contacts MCP tool. It is an API capability reference, not executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The metix_unlock_contacts identifier names an MCP tool. The text explains its required connection grant rather than executing a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The contact:unlock token is a permission scope. The later credits documentation path is also a reference, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"Backticks mark the credits documentation path and a free key-status HTTP route. No executable substitution appears.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:15:hardcoded-url","reason":"The URL identifies the Metix API used by the advertised workflow. No unrelated destination or unauthorized transfer is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:22:hardcoded-url","reason":"This HTTPS URL points to Metix jobs API documentation. It contains no credentials or exfiltration payload.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:23:hardcoded-url","reason":"This is the Metix people API documentation URL. It supports the stated workflow without transmitting secrets.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:24:hardcoded-url","reason":"This URL references Metix contact API documentation. The listing contains no request to send personal data to an unrelated service.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:25:hardcoded-url","reason":"The URL provides company API documentation on the declared Metix API host. No malicious transfer is evident.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:26:hardcoded-url","reason":"The link documents Metix query specifications. It is a relevant reference without embedded credentials or data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:27:hardcoded-url","reason":"This HTTPS link points to Metix error documentation. It does not request an unrelated network action or credential disclosure.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:28:hardcoded-url","reason":"The URL references API credit formulas on the declared Metix host. It supports cost planning rather than data exfiltration.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:29:hardcoded-url","reason":"The platform.metix.ai URL is listed as a documentation resource. No credential-bearing request or instruction override appears here.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:32:hardcoded-url","reason":"This URL identifies the human-readable Metix documentation site. It is a contextual reference, not an exfiltration destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:46:hardcoded-url","reason":"The example references a Metix query error documentation section. No secret or user record is included in the URL.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:47:hardcoded-url","reason":"The URL is the Markdown form of the preceding Metix error documentation page. It shows documentation retrieval, not unauthorized data transfer.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:61:hardcoded-url","reason":"The HTTPS request sends a selected job identifier and field list to the advertised Metix API. Authentication serves that API, not an unrelated recipient.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:65:hardcoded-url","reason":"The request retrieves company details by a previously obtained identifier from the declared Metix API. It shows no unauthorized external destination.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:61:system-reconnaissance","reason":"The detail-by-id text is part of a remote jobs API route. The request does not inspect local users, privileges, or host configuration.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:63:system-reconnaissance","reason":"The job_ids and company.id strings are JSON properties in an API payload. No local identity command or system enumeration occurs.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:65:system-reconnaissance","reason":"The detail-by-id route retrieves remote company records. It is unrelated to operating system identity or reconnaissance.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:67:system-reconnaissance","reason":"The company_ids payload contains an API identifier placeholder. It neither executes an id command nor gathers host information.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"9938f91a9ab0f5763a54332b129295339bf829dd","subject_content_hash":"54d0d9264e8d2e600439f0d488dccd1fe6753dc772610ad0791c608944ac4d7f","subject_tree_hash":"482914a1bbf677111ce70366dbb6bfd93faa72f095bb8c7e55a8832913582cc0","subject_plugin_path":"skills/metixai-official/metix-platform-assistant","audit_payload_hash":"90623853fc628e2e7a89cd19c6e72f0d","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"9938f91a9ab0f5763a54332b129295339bf829dd","contentHash":"54d0d9264e8d2e600439f0d488dccd1fe6753dc772610ad0791c608944ac4d7f","treeHash":"482914a1bbf677111ce70366dbb6bfd93faa72f095bb8c7e55a8832913582cc0","pluginPath":"skills/metixai-official/metix-platform-assistant","auditPayloadHash":"90623853fc628e2e7a89cd19c6e72f0d"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/metixai-official-metix-platform-assistant/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}