{"data":{"skill":{"slug":"muratcankoylan-tool-design","name":"tool-design","icon":"📦","repo":"https://github.com/muratcankoylan/Agent-Skills-for-Context-Engineering/tree/main/skills/tool-design","status":"approved","author":"muratcankoylan","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"2ac818d8-d522-414e-9559-1d82f66f2881","skill_id":"fcac6f67-4be0-450a-a4c0-c730072f73ca","version":8,"content_hash":"v3:02be9409c79ca1183f7844009c14d9df684d0cf9:14f5a12b69113bc6450da69c5b4d408fe91601832ab1055ae25311339c84a06b:761f0ab8cac01b9a135b9e78a48100c00d89f3f3028188ab34dd84f72c4cfb32:736b696c6c732f6d7572617463616e6b6f796c616e2f746f6f6c2d64657369676e:494ee479e5ceeea1f7de8c007f9e8117","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 49 static findings are false positives from documentation markup, ordinary prose, or sandboxed command examples. The Python utility performs no network or process execution.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"references/architectural_reduction.md","line_end":48,"line_start":48},{"file":"references/architectural_reduction.md","line_end":124,"line_start":124}]},{"factor":"external_commands","evidence":[{"file":"references/architectural_reduction.md","line_end":48,"line_start":48},{"file":"references/architectural_reduction.md","line_end":124,"line_start":124},{"file":"scripts/description_generator.py","line_end":11,"line_start":11},{"file":"scripts/description_generator.py","line_end":12,"line_start":12},{"file":"scripts/description_generator.py","line_end":13,"line_start":13},{"file":"scripts/description_generator.py","line_end":14,"line_start":14},{"file":"scripts/description_generator.py","line_end":52,"line_start":52},{"file":"scripts/description_generator.py","line_end":433,"line_start":433},{"file":"scripts/description_generator.py","line_end":435,"line_start":435},{"file":"scripts/description_generator.py","line_end":436,"line_start":436},{"file":"scripts/description_generator.py","line_end":437,"line_start":437},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":97,"line_start":97},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":116,"line_start":109},{"file":"SKILL.md","line_end":126,"line_start":116},{"file":"SKILL.md","line_end":154,"line_start":126},{"file":"SKILL.md","line_end":189,"line_start":154},{"file":"SKILL.md","line_end":210,"line_start":189},{"file":"SKILL.md","line_end":216,"line_start":210},{"file":"SKILL.md","line_end":220,"line_start":216},{"file":"SKILL.md","line_end":254,"line_start":220},{"file":"SKILL.md","line_end":254,"line_start":254},{"file":"SKILL.md","line_end":256,"line_start":256},{"file":"SKILL.md","line_end":257,"line_start":257},{"file":"SKILL.md","line_end":267,"line_start":260},{"file":"SKILL.md","line_end":268,"line_start":267},{"file":"SKILL.md","line_end":269,"line_start":268},{"file":"SKILL.md","line_end":270,"line_start":269},{"file":"SKILL.md","line_end":271,"line_start":270}]},{"factor":"network","evidence":[{"file":"references/best_practices.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":93,"line_start":93}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":4,"total_lines":1214,"audit_model":"codex","audited_at":"2026-08-09T10:00:37.674+00:00","created_at":"2026-08-11T01:34:36.148272+00:00","static_findings":[{"id":"scripts:references/architectural_reduction.md:48:python-exec-function","file":"references/architectural_reduction.md","pattern":"Python exec() function","snippet":"result = sandbox.exec(command)","category":"scripts","line_end":48,"severity":"high","line_start":48},{"id":"scripts:references/architectural_reduction.md:124:python-exec-function","file":"references/architectural_reduction.md","pattern":"Python exec() function","snippet":"execute=lambda command: sandbox.exec(command)","category":"scripts","line_end":124,"severity":"high","line_start":124},{"id":"external_commands:references/architectural_reduction.md:48:process-exec","file":"references/architectural_reduction.md","pattern":"Process exec","snippet":"result = sandbox.exec(command)","category":"external_commands","line_end":48,"severity":"high","line_start":48},{"id":"external_commands:references/architectural_reduction.md:124:process-exec","file":"references/architectural_reduction.md","pattern":"Process exec","snippet":"execute=lambda command: sandbox.exec(command)","category":"external_commands","line_end":124,"severity":"high","line_start":124},{"id":"network:references/best_practices.md:7:python-http-libraries","file":"references/best_practices.md","pattern":"Python HTTP libraries","snippet":"Tools are the primary interface between agents and the world. Unlike traditional APIs designed for d","category":"network","line_end":7,"severity":"low","line_start":7},{"id":"blocker:references/best_practices.md:47:system-reconnaissance","file":"references/best_practices.md","pattern":"System reconnaissance","snippet":"Design error messages with agent recovery as the primary consideration. Include what specifically we","category":"blocker","line_end":47,"severity":"low","line_start":47},{"id":"blocker:references/best_practices.md:147:system-reconnaissance","file":"references/best_practices.md","pattern":"System reconnaissance","snippet":"## Anti-Patterns to Avoid","category":"blocker","line_end":149,"severity":"low","line_start":147},{"id":"blocker:references/best_practices.md:169:system-reconnaissance","file":"references/best_practices.md","pattern":"System reconnaissance","snippet":"Bad: Using id in some tools, identifier in others, customer_id in some and user_id in others for sim","category":"blocker","line_end":169,"severity":"low","line_start":169},{"id":"external_commands:scripts/description_generator.py:11:ruby-shell-backtick-execution","file":"scripts/description_generator.py","pattern":"Ruby/shell backtick execution","snippet":"1. Define a tool spec with ``ToolSchemaBuilder``.","category":"external_commands","line_end":11,"severity":"medium","line_start":11},{"id":"external_commands:scripts/description_generator.py:12:ruby-shell-backtick-execution","file":"scripts/description_generator.py","pattern":"Ruby/shell backtick execution","snippet":"2. Generate a rendered description with ``generate_tool_description``.","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:scripts/description_generator.py:13:ruby-shell-backtick-execution","file":"scripts/description_generator.py","pattern":"Ruby/shell backtick execution","snippet":"3. Score the description with ``ToolDescriptionEvaluator.evaluate``.","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:scripts/description_generator.py:14:ruby-shell-backtick-execution","file":"scripts/description_generator.py","pattern":"Ruby/shell backtick execution","snippet":"4. Generate error templates with ``ErrorMessageGenerator.generate``.","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:scripts/description_generator.py:52:ruby-shell-backtick-execution","file":"scripts/description_generator.py","pattern":"Ruby/shell backtick execution","snippet":"``ToolSchemaBuilder`` (e.g., third-party specs).","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:scripts/description_generator.py:433:ruby-shell-backtick-execution","file":"scripts/description_generator.py","pattern":"Ruby/shell backtick execution","snippet":"``generate_tool_description``.","category":"external_commands","line_end":433,"severity":"medium","line_start":433},{"id":"external_commands:scripts/description_generator.py:435:ruby-shell-backtick-execution","file":"scripts/description_generator.py","pattern":"Ruby/shell backtick execution","snippet":"Returns a ``_BuiltToolSpec`` object that satisfies the ``ToolSpec``","category":"external_commands","line_end":435,"severity":"medium","line_start":435},{"id":"external_commands:scripts/description_generator.py:436:ruby-shell-backtick-execution","file":"scripts/description_generator.py","pattern":"Ruby/shell backtick execution","snippet":"protocol, so it can be used directly with ``generate_tool_description``","category":"external_commands","line_end":436,"severity":"medium","line_start":436},{"id":"external_commands:scripts/description_generator.py:437:ruby-shell-backtick-execution","file":"scripts/description_generator.py","pattern":"Ruby/shell backtick execution","snippet":"and ``ToolDescriptionEvaluator``.","category":"external_commands","line_end":437,"severity":"medium","line_start":437},{"id":"blocker:scripts/description_generator.py:316:system-reconnaissance","file":"scripts/description_generator.py","pattern":"System reconnaissance","snippet":"\"message\": \"Invalid {field}: {received_value}\",","category":"blocker","line_end":316,"severity":"low","line_start":316},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The unit of work for this skill is a single tool or a tool catalog. Project-shape, pipeline architec","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Deciding whether the project should use LLMs at all, or what the pipeline stages should be: `proje","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Deciding whether to split work across sub-agents or run a single agent with more tools: `multi-age","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Reducing the token weight of tool outputs at the trajectory level (observation masking, format-opt","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Namespace tools under common prefixes as the collection grows, because agents benefit from hierarchi","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Build single comprehensive tools instead of multiple narrow tools that overlap. Rather than implemen","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Establish a consistent schema across all tools. Use verb-noun pattern for tool names (`get_customer`","category":"external_commands","line_end":97,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Format: `ServerName:tool_name`","category":"external_commands","line_end":107,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":116,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":126,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":154,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":189,"severity":"medium","line_start":154},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":210,"severity":"medium","line_start":189},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":216,"severity":"medium","line_start":210},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":220,"severity":"medium","line_start":216},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":254,"severity":"medium","line_start":220},{"id":"external_commands:SKILL.md:254:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Cryptic parameter names**: Parameters named `x`, `val`, or `param1` force agents to guess meani","category":"external_commands","line_end":254,"severity":"medium","line_start":254},{"id":"external_commands:SKILL.md:256:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Inconsistent naming across tools**: Using `id` in one tool, `identifier` in another, and `custo","category":"external_commands","line_end":256,"severity":"medium","line_start":256},{"id":"external_commands:SKILL.md:257:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **MCP namespace collisions**: When multiple MCP tool providers register tools with similar names ","category":"external_commands","line_end":257,"severity":"medium","line_start":257},{"id":"external_commands:SKILL.md:260:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"8. **Parameter explosion**: Too many optional parameters overwhelm agent decision-making. Each param","category":"external_commands","line_end":267,"severity":"medium","line_start":260},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `project-development`: shape of the project, choice of pipeline stages, task-model-fit, cost estim","category":"external_commands","line_end":268,"severity":"medium","line_start":267},{"id":"external_commands:SKILL.md:268:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `multi-agent-patterns`: deciding whether one agent with more tools is better than two agents with ","category":"external_commands","line_end":269,"severity":"medium","line_start":268},{"id":"external_commands:SKILL.md:269:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `context-optimization`: trajectory-level token efficiency, observation masking, choosing response-","category":"external_commands","line_end":270,"severity":"medium","line_start":269},{"id":"external_commands:SKILL.md:270:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `context-fundamentals`: the conceptual question of how tool definitions consume the attention budg","category":"external_commands","line_end":271,"severity":"medium","line_start":270},{"id":"network:SKILL.md:40:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"Design each tool as a self-contained contract. When humans call APIs, they read docs, understand con","category":"network","line_end":40,"severity":"low","line_start":40},{"id":"network:SKILL.md:93:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"Design error messages for two audiences: developers debugging issues and agents recovering from fail","category":"network","line_end":93,"severity":"low","line_start":93},{"id":"blocker:SKILL.md:67:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Choose reduction when the data layer is well-documented and consistently structured, the model has s","category":"blocker","line_end":67,"severity":"low","line_start":67},{"id":"blocker:SKILL.md:79:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"1. What does the tool do? State exactly what the tool accomplishes -- avoid vague language like \"hel","category":"blocker","line_end":79,"severity":"low","line_start":79},{"id":"blocker:SKILL.md:105:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Always use fully qualified tool names with MCP (Model Context Protocol) to avoid \"tool not found\" er","category":"blocker","line_end":105,"severity":"low","line_start":105},{"id":"blocker:SKILL.md:261:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"9. **Missing error context**: Error messages that say only \"failed\" or \"invalid input\" without speci","category":"blocker","line_end":261,"severity":"low","line_start":261},{"id":"blocker:SKILL.md:43:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"Write tool descriptions knowing they load directly into agent context and collectively steer behavio","category":"blocker","line_end":43,"severity":"low","line_start":43}],"finding_verdicts":[{"id":"scripts:references/architectural_reduction.md:48:python-exec-function","reason":"This is a fenced documentation example calling a sandbox API, not Python built-in exec or code executed during skill use.","verdict":"false_positive","confidence":0.98},{"id":"scripts:references/architectural_reduction.md:124:python-exec-function","reason":"The line documents a lambda passed to a sandboxed tool example and does not invoke Python built-in exec.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/architectural_reduction.md:48:process-exec","reason":"The command call appears only in a fenced sandbox example, with the reference explicitly requiring sandbox safety constraints.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/architectural_reduction.md:124:process-exec","reason":"This is non-executed sample code for a sandbox command tool, not a process launch performed by the skill.","verdict":"false_positive","confidence":0.96},{"id":"network:references/best_practices.md:7:python-http-libraries","reason":"The line is prose comparing agent tools with traditional APIs and contains no HTTP library or network request.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/best_practices.md:47:system-reconnaissance","reason":"The line gives general error-message guidance and performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/best_practices.md:147:system-reconnaissance","reason":"The matched text is an anti-pattern section heading and contains no reconnaissance behavior.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/best_practices.md:169:system-reconnaissance","reason":"The line illustrates inconsistent identifier naming and does not inspect any system information.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/description_generator.py:11:ruby-shell-backtick-execution","reason":"Double backticks are reStructuredText markup inside a Python module docstring, not shell execution syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/description_generator.py:12:ruby-shell-backtick-execution","reason":"Double backticks format a function name inside a docstring and cannot execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/description_generator.py:13:ruby-shell-backtick-execution","reason":"Double backticks format an evaluator method inside a docstring and are inert.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/description_generator.py:14:ruby-shell-backtick-execution","reason":"Double backticks format a method name in documentation and do not launch a process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/description_generator.py:52:ruby-shell-backtick-execution","reason":"The match is reStructuredText markup in a protocol docstring with no command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/description_generator.py:433:ruby-shell-backtick-execution","reason":"The line references a Python function using docstring markup and has no shell semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/description_generator.py:435:ruby-shell-backtick-execution","reason":"The double-backtick text is a documented return type inside a docstring, not executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/description_generator.py:436:ruby-shell-backtick-execution","reason":"The line uses documentation markup for a function name and performs no external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/description_generator.py:437:ruby-shell-backtick-execution","reason":"The line uses documentation markup for a class name and performs no external command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/description_generator.py:316:system-reconnaissance","reason":"This is a static validation-error message template and does not collect system information.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"Backticks mark related skill names in Markdown prose and do not execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"Backticks format a related skill name in Markdown and are inert.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Backticks format a related skill name in Markdown and are inert.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Backticks format a related skill name in Markdown and are inert.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"Inline backticks illustrate tool namespace names and cannot launch a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"Inline backticks format example tool names in explanatory prose.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"Inline backticks format naming examples such as tool and parameter identifiers.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"Backticks display an MCP naming format and have no execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The match is an opening Markdown code fence for a documentation example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"The match is a closing Markdown code fence and cannot execute shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"The match opens a fenced Python example for improving tool descriptions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","reason":"The match closes a Markdown code block and has no runtime effect.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","reason":"The match opens a fenced Python example that documents a tool signature.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","reason":"The match closes a Markdown code block and does not execute its contents.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","reason":"The match opens a fenced example of intentionally poor tool design.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","reason":"The match closes a Markdown code block and has no command execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:254:ruby-shell-backtick-execution","reason":"Inline backticks format poor parameter-name examples in documentation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:256:ruby-shell-backtick-execution","reason":"Inline backticks format identifier examples in naming guidance.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:257:ruby-shell-backtick-execution","reason":"Inline backticks format MCP tool-name examples and are not shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:260:ruby-shell-backtick-execution","reason":"Inline backticks format an example parameter name in prose.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","reason":"Backticks mark a related skill name in the integration section.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:268:ruby-shell-backtick-execution","reason":"Backticks mark a related skill name in the integration section.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:269:ruby-shell-backtick-execution","reason":"Backticks mark a related skill name in the integration section.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:270:ruby-shell-backtick-execution","reason":"Backticks mark a related skill name in the integration section.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:40:python-http-libraries","reason":"The line compares tools with APIs in prose and contains no HTTP import or network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:93:python-http-libraries","reason":"The line discusses error responses conceptually and performs no network request.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:67:system-reconnaissance","reason":"The line lists architectural decision criteria and does not inspect a host system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:79:system-reconnaissance","reason":"The line is a checklist question about tool descriptions, not reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:105:system-reconnaissance","reason":"The line recommends fully qualified MCP names and does not enumerate system resources.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:261:system-reconnaissance","reason":"The line explains missing error context and does not gather system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:43:network-reconnaissance","reason":"The line discusses how descriptions influence agent behavior and contains no network discovery.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"02be9409c79ca1183f7844009c14d9df684d0cf9","subject_content_hash":"14f5a12b69113bc6450da69c5b4d408fe91601832ab1055ae25311339c84a06b","subject_tree_hash":"761f0ab8cac01b9a135b9e78a48100c00d89f3f3028188ab34dd84f72c4cfb32","subject_plugin_path":"skills/muratcankoylan/tool-design","audit_payload_hash":"494ee479e5ceeea1f7de8c007f9e8117","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"02be9409c79ca1183f7844009c14d9df684d0cf9","contentHash":"14f5a12b69113bc6450da69c5b4d408fe91601832ab1055ae25311339c84a06b","treeHash":"761f0ab8cac01b9a135b9e78a48100c00d89f3f3028188ab34dd84f72c4cfb32","pluginPath":"skills/muratcankoylan/tool-design","auditPayloadHash":"494ee479e5ceeea1f7de8c007f9e8117"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/muratcankoylan-tool-design/audits/8/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}