{"data":{"skill":{"slug":"migoxlab-design-to-code","name":"design-to-code","icon":"📦","repo":"https://github.com/MigoXLab/coderio/tree/main/skills/design-to-code/","status":"approved","author":"MigoXLab","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"63c380bf-e7c8-466e-86cd-85a742146c3c","skill_id":"0ac7ac0c-545b-4ffb-822e-1f42fd1f27e2","version":4,"content_hash":"v3:6425ec35f4ac137735cff58cd7877843bba23e3b:6c788e228329e24213181421fcb45d03dc2af8ccebeedab684bbf7545ef641cd:a96bc97a80dd7679698ac818f1fa0d2934383c8f1e01c8895e99f0149fee3b98:736b696c6c732f6d69676f786c61622f64657369676e2d746f2d636f6465:17b07a87cba4932284f9e0e598308873","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static findings are false positives from markdown fences, JavaScript template literals, and expected local workflow files. The remaining risks are limited to unvalidated local path inputs, generated code writes, and Figma token handling through an external helper.","remediation":[{"issue":"Unvalidated component names can influence props file reads.","severity":"medium","suggestion":"Restrict component names to safe filename characters and reject path separators before reading props files."},{"issue":"Generated protocol paths influence where code is saved.","severity":"medium","suggestion":"Normalize resolved paths and enforce that generated files remain under the intended src component directory."},{"issue":"Figma tokens are passed to an external helper dependency.","severity":"medium","suggestion":"Document token handling, avoid logging tokens, and pin dependency versions used by the helper script."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"scripts/coderio-skill.mjs","line_end":174,"line_start":174},{"file":"scripts/coderio-skill.mjs","line_end":191,"line_start":191},{"file":"scripts/coderio-skill.mjs","line_end":207,"line_start":207},{"file":"scripts/coderio-skill.mjs","line_end":209,"line_start":209},{"file":"scripts/coderio-skill.mjs","line_end":263,"line_start":260},{"file":"scripts/coderio-skill.mjs","line_end":264,"line_start":263},{"file":"scripts/coderio-skill.mjs","line_end":264,"line_start":264},{"file":"scripts/coderio-skill.mjs","line_end":265,"line_start":265},{"file":"scripts/coderio-skill.mjs","line_end":283,"line_start":283},{"file":"scripts/coderio-skill.mjs","line_end":287,"line_start":287},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":23,"line_start":19},{"file":"SKILL.md","line_end":33,"line_start":23},{"file":"SKILL.md","line_end":43,"line_start":33},{"file":"SKILL.md","line_end":49,"line_start":43},{"file":"SKILL.md","line_end":58,"line_start":49},{"file":"SKILL.md","line_end":61,"line_start":58},{"file":"SKILL.md","line_end":63,"line_start":61},{"file":"SKILL.md","line_end":69,"line_start":63},{"file":"SKILL.md","line_end":71,"line_start":69},{"file":"SKILL.md","line_end":74,"line_start":71},{"file":"SKILL.md","line_end":75,"line_start":74},{"file":"SKILL.md","line_end":77,"line_start":75},{"file":"SKILL.md","line_end":80,"line_start":77},{"file":"SKILL.md","line_end":82,"line_start":80},{"file":"SKILL.md","line_end":88,"line_start":82},{"file":"SKILL.md","line_end":90,"line_start":88},{"file":"SKILL.md","line_end":96,"line_start":90},{"file":"SKILL.md","line_end":98,"line_start":96},{"file":"SKILL.md","line_end":101,"line_start":98},{"file":"SKILL.md","line_end":102,"line_start":101},{"file":"SKILL.md","line_end":104,"line_start":102},{"file":"SKILL.md","line_end":108,"line_start":104},{"file":"SKILL.md","line_end":111,"line_start":108},{"file":"SKILL.md","line_end":119,"line_start":111},{"file":"SKILL.md","line_end":121,"line_start":119},{"file":"SKILL.md","line_end":131,"line_start":121},{"file":"SKILL.md","line_end":134,"line_start":131},{"file":"SKILL.md","line_end":137,"line_start":134},{"file":"SKILL.md","line_end":138,"line_start":137},{"file":"SKILL.md","line_end":140,"line_start":138},{"file":"SKILL.md","line_end":143,"line_start":140},{"file":"SKILL.md","line_end":146,"line_start":143},{"file":"SKILL.md","line_end":150,"line_start":146},{"file":"SKILL.md","line_end":156,"line_start":150},{"file":"SKILL.md","line_end":157,"line_start":156}]},{"factor":"filesystem","evidence":[{"file":"scripts/coderio-skill.mjs","line_end":21,"line_start":21},{"file":"scripts/coderio-skill.mjs","line_end":120,"line_start":120},{"file":"scripts/coderio-skill.mjs","line_end":125,"line_start":125},{"file":"scripts/coderio-skill.mjs","line_end":133,"line_start":133},{"file":"scripts/coderio-skill.mjs","line_end":145,"line_start":145},{"file":"scripts/coderio-skill.mjs","line_end":146,"line_start":146},{"file":"scripts/coderio-skill.mjs","line_end":153,"line_start":153},{"file":"scripts/coderio-skill.mjs","line_end":159,"line_start":159},{"file":"scripts/coderio-skill.mjs","line_end":164,"line_start":164},{"file":"scripts/coderio-skill.mjs","line_end":171,"line_start":171},{"file":"scripts/coderio-skill.mjs","line_end":192,"line_start":192},{"file":"scripts/coderio-skill.mjs","line_end":199,"line_start":199},{"file":"scripts/coderio-skill.mjs","line_end":206,"line_start":206},{"file":"scripts/coderio-skill.mjs","line_end":215,"line_start":215},{"file":"scripts/coderio-skill.mjs","line_end":223,"line_start":223},{"file":"scripts/coderio-skill.mjs","line_end":230,"line_start":230},{"file":"scripts/coderio-skill.mjs","line_end":233,"line_start":233},{"file":"scripts/coderio-skill.mjs","line_end":276,"line_start":276},{"file":"scripts/coderio-skill.mjs","line_end":278,"line_start":278},{"file":"scripts/coderio-skill.mjs","line_end":21,"line_start":21},{"file":"scripts/coderio-skill.mjs","line_end":120,"line_start":120},{"file":"scripts/coderio-skill.mjs","line_end":125,"line_start":125},{"file":"scripts/coderio-skill.mjs","line_end":133,"line_start":133},{"file":"scripts/coderio-skill.mjs","line_end":145,"line_start":145},{"file":"scripts/coderio-skill.mjs","line_end":146,"line_start":146},{"file":"scripts/coderio-skill.mjs","line_end":153,"line_start":153},{"file":"scripts/coderio-skill.mjs","line_end":159,"line_start":159},{"file":"scripts/coderio-skill.mjs","line_end":164,"line_start":164},{"file":"scripts/coderio-skill.mjs","line_end":171,"line_start":171},{"file":"scripts/coderio-skill.mjs","line_end":192,"line_start":192},{"file":"scripts/coderio-skill.mjs","line_end":199,"line_start":199},{"file":"scripts/coderio-skill.mjs","line_end":206,"line_start":206},{"file":"scripts/coderio-skill.mjs","line_end":215,"line_start":215},{"file":"scripts/coderio-skill.mjs","line_end":223,"line_start":223},{"file":"scripts/coderio-skill.mjs","line_end":230,"line_start":230},{"file":"scripts/coderio-skill.mjs","line_end":276,"line_start":276},{"file":"scripts/coderio-skill.mjs","line_end":278,"line_start":278}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":60,"line_start":60}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Node.js fs operations","locations":[{"file":"scripts/coderio-skill.mjs","line_end":192,"line_start":192}],"confidence":0.58,"description":"const propsJson = fs.readFileSync(propsJsonPath, 'utf-8');","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The props file path is built from a CLI component name without visible validation. A crafted name could read an unintended local props file through path traversal."},{"title":"Synchronous file operations","locations":[{"file":"scripts/coderio-skill.mjs","line_end":192,"line_start":192}],"confidence":0.58,"description":"const propsJson = fs.readFileSync(propsJsonPath, 'utf-8');","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The props file path is built from a CLI component name without visible validation. A crafted name could read an unintended local props file through path traversal."},{"title":"Sensitive Figma Token Passed To External Helper","locations":[{"file":"SKILL.md","line_end":60,"line_start":58},{"file":"scripts/coderio-skill.mjs","line_end":116,"line_start":110}],"confidence":0.78,"description":"The workflow asks users to provide a Figma token, then passes it into an imported coderio helper. The visible code does not show token handling inside that dependency.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The token flow is explicit in the documentation and script. There is no proof of exfiltration, but the token leaves local code boundaries through an external helper."},{"title":"Generated Protocol Paths Drive Project Writes","locations":[{"file":"scripts/coderio-skill.mjs","line_end":287,"line_start":282}],"confidence":0.72,"description":"The save-code command reads component paths from protocol data and writes generated code into the project. The visible code does not validate the resolved output path.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The write path depends on protocol data generated earlier in the workflow. The helper may normalize paths, but this file does not show an explicit containment check."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":4,"total_lines":671,"audit_model":"codex","audited_at":"2026-07-05T23:15:29.181+00:00","created_at":"2026-07-17T18:49:00.268524+00:00","static_findings":[{"id":"external_commands:scripts/coderio-skill.mjs:174:ruby-shell-backtick-execution","file":"scripts/coderio-skill.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (!group) throw new Error(`Component ${compName} not found`);","category":"external_commands","line_end":174,"severity":"medium","line_start":174},{"id":"external_commands:scripts/coderio-skill.mjs:191:ruby-shell-backtick-execution","file":"scripts/coderio-skill.mjs","pattern":"Ruby/shell backtick execution","snippet":"const propsJsonPath = path.join(scriptsDir, `${cName}-props.json`);","category":"external_commands","line_end":191,"severity":"medium","line_start":191},{"id":"external_commands:scripts/coderio-skill.mjs:207:ruby-shell-backtick-execution","file":"scripts/coderio-skill.mjs","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Props applied to ${cName} (Parent: ${parentNode.data.name || parentNode.id})`);","category":"external_commands","line_end":207,"severity":"medium","line_start":207},{"id":"external_commands:scripts/coderio-skill.mjs:209:ruby-shell-backtick-execution","file":"scripts/coderio-skill.mjs","pattern":"Ruby/shell backtick execution","snippet":"console.error(`Parent not found for ${cName}`);","category":"external_commands","line_end":209,"severity":"medium","line_start":209},{"id":"external_commands:scripts/coderio-skill.mjs:260:ruby-shell-backtick-execution","file":"scripts/coderio-skill.mjs","pattern":"Ruby/shell backtick execution","snippet":"prompt += `\\n\\n<asset_imports_instruction>","category":"external_commands","line_end":263,"severity":"medium","line_start":260},{"id":"external_commands:scripts/coderio-skill.mjs:263:ruby-shell-backtick-execution","file":"scripts/coderio-skill.mjs","pattern":"Ruby/shell backtick execution","snippet":"1. Import these assets at the top of the file: \\`import image_foo from '@/assets/foo.png';\\`","category":"external_commands","line_end":264,"severity":"medium","line_start":263},{"id":"external_commands:scripts/coderio-skill.mjs:264:ruby-shell-backtick-execution","file":"scripts/coderio-skill.mjs","pattern":"Ruby/shell backtick execution","snippet":"2. In the \\`states\\` array in your code, use the variable \\`image_foo\\` instead of the string.","category":"external_commands","line_end":264,"severity":"medium","line_start":264},{"id":"external_commands:scripts/coderio-skill.mjs:265:ruby-shell-backtick-execution","file":"scripts/coderio-skill.mjs","pattern":"Ruby/shell backtick execution","snippet":"Example: \\`imageSrc: image_foo\\` (NOT \\`imageSrc: \"@/assets/foo.png\"\\`)","category":"external_commands","line_end":265,"severity":"medium","line_start":265},{"id":"external_commands:scripts/coderio-skill.mjs:283:ruby-shell-backtick-execution","file":"scripts/coderio-skill.mjs","pattern":"Ruby/shell backtick execution","snippet":"if (!componentPath) throw new Error(`Node ${node2.data.name} has no path`);","category":"external_commands","line_end":283,"severity":"medium","line_start":283},{"id":"external_commands:scripts/coderio-skill.mjs:287:ruby-shell-backtick-execution","file":"scripts/coderio-skill.mjs","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Code saved to ${compDir}`);","category":"external_commands","line_end":287,"severity":"medium","line_start":287},{"id":"filesystem:scripts/coderio-skill.mjs:21:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"if (!fs.existsSync(d)) fs.mkdirSync(d, { recursive: true });","category":"filesystem","line_end":21,"severity":"medium","line_start":21},{"id":"filesystem:scripts/coderio-skill.mjs:120:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"fs.writeFileSync(path.join(processDir, 'processed.json'), JSON.stringify(processed, null, 2));","category":"filesystem","line_end":120,"severity":"medium","line_start":120},{"id":"filesystem:scripts/coderio-skill.mjs:125:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"fs.writeFileSync(path.join(processDir, 'thumbnail.png'), Buffer.from(base64, 'base64'));","category":"filesystem","line_end":125,"severity":"medium","line_start":125},{"id":"filesystem:scripts/coderio-skill.mjs:133:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"const procDoc = JSON.parse(fs.readFileSync(path.join(processDir, 'processed.json'), 'utf-8'));","category":"filesystem","line_end":133,"severity":"medium","line_start":133},{"id":"filesystem:scripts/coderio-skill.mjs:145:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"const structureJson = fs.readFileSync(path.join(scriptsDir, 'structure-output.json'), 'utf-8');","category":"filesystem","line_end":145,"severity":"medium","line_start":145},{"id":"filesystem:scripts/coderio-skill.mjs:146:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"const pDoc = JSON.parse(fs.readFileSync(path.join(processDir, 'processed.json'), 'utf-8'));","category":"filesystem","line_end":146,"severity":"medium","line_start":146},{"id":"filesystem:scripts/coderio-skill.mjs:153:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"fs.writeFileSync(path.join(processDir, 'protocol.json'), JSON.stringify(protocol, null, 2));","category":"filesystem","line_end":153,"severity":"medium","line_start":153},{"id":"filesystem:scripts/coderio-skill.mjs:159:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"const prot = JSON.parse(fs.readFileSync(path.join(processDir, 'protocol.json'), 'utf-8'));","category":"filesystem","line_end":159,"severity":"medium","line_start":159},{"id":"filesystem:scripts/coderio-skill.mjs:164:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"fs.writeFileSync(path.join(scriptsDir, 'component-list.json'), JSON.stringify(list, null, 2));","category":"filesystem","line_end":164,"severity":"medium","line_start":164},{"id":"filesystem:scripts/coderio-skill.mjs:171:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"const prot2 = JSON.parse(fs.readFileSync(path.join(processDir, 'protocol.json'), 'utf-8'));","category":"filesystem","line_end":171,"severity":"medium","line_start":171},{"id":"filesystem:scripts/coderio-skill.mjs:192:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"const propsJson = fs.readFileSync(propsJsonPath, 'utf-8');","category":"filesystem","line_end":192,"severity":"medium","line_start":192},{"id":"filesystem:scripts/coderio-skill.mjs:199:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"const prot3 = JSON.parse(fs.readFileSync(path.join(processDir, 'protocol.json'), 'utf-8'));","category":"filesystem","line_end":199,"severity":"medium","line_start":199},{"id":"filesystem:scripts/coderio-skill.mjs:206:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"fs.writeFileSync(path.join(processDir, 'protocol.json'), JSON.stringify(prot3, null, 2));","category":"filesystem","line_end":206,"severity":"medium","line_start":206},{"id":"filesystem:scripts/coderio-skill.mjs:215:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"const prot4 = JSON.parse(fs.readFileSync(path.join(processDir, 'protocol.json'), 'utf-8'));","category":"filesystem","line_end":215,"severity":"medium","line_start":215},{"id":"filesystem:scripts/coderio-skill.mjs:223:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"fs.writeFileSync(path.join(scriptsDir, 'gen-tasks.json'), JSON.stringify(tasks, null, 2));","category":"filesystem","line_end":223,"severity":"medium","line_start":223},{"id":"filesystem:scripts/coderio-skill.mjs:230:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"const prot5 = JSON.parse(fs.readFileSync(path.join(processDir, 'protocol.json'), 'utf-8'));","category":"filesystem","line_end":230,"severity":"medium","line_start":230},{"id":"filesystem:scripts/coderio-skill.mjs:233:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"const assets = fs.readdirSync(assetsDir).join(', ');","category":"filesystem","line_end":233,"severity":"medium","line_start":233},{"id":"filesystem:scripts/coderio-skill.mjs:276:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"const code = fs.readFileSync(codePath, 'utf-8');","category":"filesystem","line_end":276,"severity":"medium","line_start":276},{"id":"filesystem:scripts/coderio-skill.mjs:278:node-js-fs-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs operations","snippet":"const prot6 = JSON.parse(fs.readFileSync(path.join(processDir, 'protocol.json'), 'utf-8'));","category":"filesystem","line_end":278,"severity":"medium","line_start":278},{"id":"filesystem:scripts/coderio-skill.mjs:21:node-js-fs-stat-operations","file":"scripts/coderio-skill.mjs","pattern":"Node.js fs stat operations","snippet":"if (!fs.existsSync(d)) fs.mkdirSync(d, { recursive: true });","category":"filesystem","line_end":21,"severity":"low","line_start":21},{"id":"filesystem:scripts/coderio-skill.mjs:120:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"fs.writeFileSync(path.join(processDir, 'processed.json'), JSON.stringify(processed, null, 2));","category":"filesystem","line_end":120,"severity":"medium","line_start":120},{"id":"filesystem:scripts/coderio-skill.mjs:125:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"fs.writeFileSync(path.join(processDir, 'thumbnail.png'), Buffer.from(base64, 'base64'));","category":"filesystem","line_end":125,"severity":"medium","line_start":125},{"id":"filesystem:scripts/coderio-skill.mjs:133:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"const procDoc = JSON.parse(fs.readFileSync(path.join(processDir, 'processed.json'), 'utf-8'));","category":"filesystem","line_end":133,"severity":"medium","line_start":133},{"id":"filesystem:scripts/coderio-skill.mjs:145:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"const structureJson = fs.readFileSync(path.join(scriptsDir, 'structure-output.json'), 'utf-8');","category":"filesystem","line_end":145,"severity":"medium","line_start":145},{"id":"filesystem:scripts/coderio-skill.mjs:146:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"const pDoc = JSON.parse(fs.readFileSync(path.join(processDir, 'processed.json'), 'utf-8'));","category":"filesystem","line_end":146,"severity":"medium","line_start":146},{"id":"filesystem:scripts/coderio-skill.mjs:153:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"fs.writeFileSync(path.join(processDir, 'protocol.json'), JSON.stringify(protocol, null, 2));","category":"filesystem","line_end":153,"severity":"medium","line_start":153},{"id":"filesystem:scripts/coderio-skill.mjs:159:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"const prot = JSON.parse(fs.readFileSync(path.join(processDir, 'protocol.json'), 'utf-8'));","category":"filesystem","line_end":159,"severity":"medium","line_start":159},{"id":"filesystem:scripts/coderio-skill.mjs:164:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"fs.writeFileSync(path.join(scriptsDir, 'component-list.json'), JSON.stringify(list, null, 2));","category":"filesystem","line_end":164,"severity":"medium","line_start":164},{"id":"filesystem:scripts/coderio-skill.mjs:171:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"const prot2 = JSON.parse(fs.readFileSync(path.join(processDir, 'protocol.json'), 'utf-8'));","category":"filesystem","line_end":171,"severity":"medium","line_start":171},{"id":"filesystem:scripts/coderio-skill.mjs:192:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"const propsJson = fs.readFileSync(propsJsonPath, 'utf-8');","category":"filesystem","line_end":192,"severity":"medium","line_start":192},{"id":"filesystem:scripts/coderio-skill.mjs:199:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"const prot3 = JSON.parse(fs.readFileSync(path.join(processDir, 'protocol.json'), 'utf-8'));","category":"filesystem","line_end":199,"severity":"medium","line_start":199},{"id":"filesystem:scripts/coderio-skill.mjs:206:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"fs.writeFileSync(path.join(processDir, 'protocol.json'), JSON.stringify(prot3, null, 2));","category":"filesystem","line_end":206,"severity":"medium","line_start":206},{"id":"filesystem:scripts/coderio-skill.mjs:215:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"const prot4 = JSON.parse(fs.readFileSync(path.join(processDir, 'protocol.json'), 'utf-8'));","category":"filesystem","line_end":215,"severity":"medium","line_start":215},{"id":"filesystem:scripts/coderio-skill.mjs:223:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"fs.writeFileSync(path.join(scriptsDir, 'gen-tasks.json'), JSON.stringify(tasks, null, 2));","category":"filesystem","line_end":223,"severity":"medium","line_start":223},{"id":"filesystem:scripts/coderio-skill.mjs:230:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"const prot5 = JSON.parse(fs.readFileSync(path.join(processDir, 'protocol.json'), 'utf-8'));","category":"filesystem","line_end":230,"severity":"medium","line_start":230},{"id":"filesystem:scripts/coderio-skill.mjs:276:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"const code = fs.readFileSync(codePath, 'utf-8');","category":"filesystem","line_end":276,"severity":"medium","line_start":276},{"id":"filesystem:scripts/coderio-skill.mjs:278:synchronous-file-operations","file":"scripts/coderio-skill.mjs","pattern":"Synchronous file operations","snippet":"const prot6 = JSON.parse(fs.readFileSync(path.join(processDir, 'protocol.json'), 'utf-8'));","category":"filesystem","line_end":278,"severity":"medium","line_start":278},{"id":"obfuscation:scripts/coderio-skill.mjs:125:buffer-base64-decode","file":"scripts/coderio-skill.mjs","pattern":"Buffer base64 decode","snippet":"fs.writeFileSync(path.join(processDir, 'thumbnail.png'), Buffer.from(base64, 'base64'));","category":"obfuscation","line_end":125,"severity":"medium","line_start":125},{"id":"sensitive:scripts/coderio-skill.mjs:161:certificate-key-files","file":"scripts/coderio-skill.mjs","pattern":"Certificate/key files","snippet":"const list = Array.from(groups.keys()).map(name => {","category":"sensitive","line_end":161,"severity":"high","line_start":161},{"id":"blocker:scripts/coderio-skill.mjs:78:system-reconnaissance","file":"scripts/coderio-skill.mjs","pattern":"System reconnaissance","snippet":"child.id = childName;","category":"blocker","line_end":78,"severity":"low","line_start":78},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3.  **coderio**: Installed in `scripts/` folder (handled by Setup phase)","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":23,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":33,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":43,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":49,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1.  Run: `node scripts/coderio-skill.mjs scaffold-prompt \"MyApp\"`","category":"external_commands","line_end":58,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":61,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":63,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Verify**: `process/thumbnail.png` should exist.","category":"external_commands","line_end":69,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":71,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":74,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **ATTACH**: `process/thumbnail.png` (MANDATORY)","category":"external_commands","line_end":75,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **READ**: `scripts/structure-prompt.md`","category":"external_commands","line_end":77,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **SAVE**: Paste the JSON result into `scripts/structure-output.json`.","category":"external_commands","line_end":80,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":82,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":88,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":90,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":96,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":98,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":101,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **ATTACH**: `process/thumbnail.png` (MANDATORY)","category":"external_commands","line_end":102,"severity":"medium","line_start":101},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **READ**: `scripts/current-props-prompt.md`","category":"external_commands","line_end":104,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **SAVE**: Paste the JSON result into `scripts/ComponentName-props.json`.","category":"external_commands","line_end":108,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":111,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":119,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":121,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":131,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":134,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":137,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **ATTACH**: `process/thumbnail.png` (MANDATORY)","category":"external_commands","line_end":138,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **READ**: `scripts/code-prompt.md`","category":"external_commands","line_end":140,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **SAVE**: Paste the code block into `scripts/code-output.txt`.","category":"external_commands","line_end":143,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":146,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":150,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Inject the root component into `App.tsx`. Use the path found in the last task of Phase 2.1.","category":"external_commands","line_end":156,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **\"Props validation failed\"**: The AI generated empty props. Check if `process/thumbnail.png` was ","category":"external_commands","line_end":157,"severity":"medium","line_start":156},{"id":"network:SKILL.md:60:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"node scripts/coderio-skill.mjs fetch-figma \"https://figma.com/file/...\" \"figd_...\"","category":"network","line_end":60,"severity":"low","line_start":60},{"id":"blocker:SKILL.md:158:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **\"Visuals don't match\"**: Did you attach the thumbnail? The AI relies on it for spacing and layou","category":"blocker","line_end":158,"severity":"low","line_start":158}],"finding_verdicts":[{"id":"external_commands:scripts/coderio-skill.mjs:174:ruby-shell-backtick-execution","reason":"This line uses JavaScript template literal syntax for strings, logs, or generated prompt text. There is no shell invocation or child process execution here.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/coderio-skill.mjs:191:ruby-shell-backtick-execution","reason":"This line uses JavaScript template literal syntax for strings, logs, or generated prompt text. There is no shell invocation or child process execution here.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/coderio-skill.mjs:207:ruby-shell-backtick-execution","reason":"This line uses JavaScript template literal syntax for strings, logs, or generated prompt text. There is no shell invocation or child process execution here.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/coderio-skill.mjs:209:ruby-shell-backtick-execution","reason":"This line uses JavaScript template literal syntax for strings, logs, or generated prompt text. There is no shell invocation or child process execution here.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/coderio-skill.mjs:260:ruby-shell-backtick-execution","reason":"This line uses JavaScript template literal syntax for strings, logs, or generated prompt text. There is no shell invocation or child process execution here.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/coderio-skill.mjs:263:ruby-shell-backtick-execution","reason":"This line uses JavaScript template literal syntax for strings, logs, or generated prompt text. There is no shell invocation or child process execution here.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/coderio-skill.mjs:264:ruby-shell-backtick-execution","reason":"This line uses JavaScript template literal syntax for strings, logs, or generated prompt text. There is no shell invocation or child process execution here.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/coderio-skill.mjs:265:ruby-shell-backtick-execution","reason":"This line uses JavaScript template literal syntax for strings, logs, or generated prompt text. There is no shell invocation or child process execution here.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/coderio-skill.mjs:283:ruby-shell-backtick-execution","reason":"This line uses JavaScript template literal syntax for strings, logs, or generated prompt text. There is no shell invocation or child process execution here.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:scripts/coderio-skill.mjs:287:ruby-shell-backtick-execution","reason":"This line uses JavaScript template literal syntax for strings, logs, or generated prompt text. There is no shell invocation or child process execution here.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:scripts/coderio-skill.mjs:21:node-js-fs-operations","reason":"The code creates expected local project directories under the current workspace. The paths are fixed process, scripts, and asset directories.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:scripts/coderio-skill.mjs:120:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:125:node-js-fs-operations","reason":"The file write stores a downloaded Figma thumbnail under the process directory. It decodes image data for the documented design workflow.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:scripts/coderio-skill.mjs:133:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:145:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:146:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:153:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:159:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:164:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:171:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:192:node-js-fs-operations","reason":"The props file path is built from a CLI component name without visible validation. A crafted name could read an unintended local props file through path traversal.","verdict":"confirmed","severity":"medium","confidence":0.58},{"id":"filesystem:scripts/coderio-skill.mjs:199:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:206:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:215:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:223:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:230:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:233:node-js-fs-operations","reason":"The directory read lists local asset filenames for prompt context. It does not read file contents or access locations outside the asset directory.","verdict":"false_positive","confidence":0.87},{"id":"filesystem:scripts/coderio-skill.mjs:276:node-js-fs-operations","reason":"The code reads the documented code-output file before saving generated components. The broader generated-code risk is captured as a semantic finding.","verdict":"false_positive","confidence":0.78},{"id":"filesystem:scripts/coderio-skill.mjs:278:node-js-fs-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:21:node-js-fs-stat-operations","reason":"The code creates expected local project directories under the current workspace. The paths are fixed process, scripts, and asset directories.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:scripts/coderio-skill.mjs:120:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:125:synchronous-file-operations","reason":"The file write stores a downloaded Figma thumbnail under the process directory. It decodes image data for the documented design workflow.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:scripts/coderio-skill.mjs:133:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:145:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:146:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:153:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:159:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:164:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:171:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:192:synchronous-file-operations","reason":"The props file path is built from a CLI component name without visible validation. A crafted name could read an unintended local props file through path traversal.","verdict":"confirmed","severity":"medium","confidence":0.58},{"id":"filesystem:scripts/coderio-skill.mjs:199:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:206:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:215:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:223:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:230:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"filesystem:scripts/coderio-skill.mjs:276:synchronous-file-operations","reason":"The code reads the documented code-output file before saving generated components. The broader generated-code risk is captured as a semantic finding.","verdict":"false_positive","confidence":0.78},{"id":"filesystem:scripts/coderio-skill.mjs:278:synchronous-file-operations","reason":"This is expected local workflow state management under process or scripts directories. No secret file access or arbitrary external path is visible at this line.","verdict":"false_positive","confidence":0.84},{"id":"obfuscation:scripts/coderio-skill.mjs:125:buffer-base64-decode","reason":"The base64 decode converts a Figma thumbnail response into a PNG file. This is normal binary image handling, not code obfuscation.","verdict":"false_positive","confidence":0.89},{"id":"sensitive:scripts/coderio-skill.mjs:161:certificate-key-files","reason":"The line maps component group names into a list. It does not reference certificate files, private keys, or credential material.","verdict":"false_positive","confidence":0.95},{"id":"blocker:scripts/coderio-skill.mjs:78:system-reconnaissance","reason":"The line assigns an internal component id while normalizing design nodes. It performs no host, process, network, or environment reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","reason":"This is markdown formatting or an instructional command example in documentation. The text is not automatic command execution by the skill file itself.","verdict":"false_positive","confidence":0.91},{"id":"network:SKILL.md:60:hardcoded-url","reason":"The URL is a placeholder Figma example in documented setup instructions. It is not a hidden endpoint or unauthorized network destination.","verdict":"false_positive","confidence":0.82},{"id":"blocker:SKILL.md:158:system-reconnaissance","reason":"This line is troubleshooting text about visual mismatch. It does not request system information or perform reconnaissance.","verdict":"false_positive","confidence":0.96}],"semantic_findings":[{"title":"Sensitive Figma Token Passed To External Helper","severity":"medium","locations":[{"file":"SKILL.md","line_end":60,"line_start":58},{"file":"scripts/coderio-skill.mjs","line_end":116,"line_start":110}],"confidence":0.78,"description":"The workflow asks users to provide a Figma token, then passes it into an imported coderio helper. The visible code does not show token handling inside that dependency.","confidence_reasoning":"The token flow is explicit in the documentation and script. There is no proof of exfiltration, but the token leaves local code boundaries through an external helper."},{"title":"Generated Protocol Paths Drive Project Writes","severity":"medium","locations":[{"file":"scripts/coderio-skill.mjs","line_end":287,"line_start":282}],"confidence":0.72,"description":"The save-code command reads component paths from protocol data and writes generated code into the project. The visible code does not validate the resolved output path.","confidence_reasoning":"The write path depends on protocol data generated earlier in the workflow. The helper may normalize paths, but this file does not show an explicit containment check."}],"subject_marketplace_commit_sha":"6425ec35f4ac137735cff58cd7877843bba23e3b","subject_content_hash":"6c788e228329e24213181421fcb45d03dc2af8ccebeedab684bbf7545ef641cd","subject_tree_hash":"a96bc97a80dd7679698ac818f1fa0d2934383c8f1e01c8895e99f0149fee3b98","subject_plugin_path":"skills/migoxlab/design-to-code","audit_payload_hash":"17b07a87cba4932284f9e0e598308873","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"6425ec35f4ac137735cff58cd7877843bba23e3b","contentHash":"6c788e228329e24213181421fcb45d03dc2af8ccebeedab684bbf7545ef641cd","treeHash":"a96bc97a80dd7679698ac818f1fa0d2934383c8f1e01c8895e99f0149fee3b98","pluginPath":"skills/migoxlab/design-to-code","auditPayloadHash":"17b07a87cba4932284f9e0e598308873"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}