{"data":{"skill":{"slug":"nexaiguy-nex-accent-contrast-ext","name":"nex-accent-contrast-ext","icon":"📦","repo":"https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/nex-accent-contrast-ext","status":"approved","author":"nexaiguy","authorVersion":"1.2","skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"7d0abe60-e411-4a2a-b463-56df9fadb919","skill_id":"be64c61b-15cc-4ed8-b849-d81888c806fe","version":1,"content_hash":"v3:3ddfdca559084abffbfdd188f2ba14b597dcfd9c:9617c919b080ca4b8e4cc75f2ee88605b16f1b9fecd77b5083a331625280d49a:4743a8490543e36d81d99649e75f38fdf7ac724d462fddc8418426893b5d494b:736b696c6c732f6e657861696775792f6e65782d616363656e742d636f6e74726173742d657874:2fabb00447a514d520239f5bd212be45","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All six static findings are false positives: Markdown code spans and attribution links do not execute commands, transmit data, or perform reconnaissance. No evidence found of prompt injection or malicious intent in SKILL.md. This package contains only a descriptive guide, so advertised extension implementation and security claims cannot be verified.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":26,"line_start":26}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":93,"line_start":93}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":94,"audit_model":"codex","audited_at":"2026-11-02T12:25:09.415+00:00","created_at":"2026-11-02T17:01:35.798089+00:00","static_findings":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The skill features a sophisticated HSL math engine that generates a unified palette—including hover ","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"This is a vanilla JS/HTML/CSS implementation. There are no heavy dependencies, no `npm install`, and","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Free skill by [Nex AI](https://nex-ai.be). This file is the public guide from [Agensi](https://www","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:34:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by Nex AI. More skills and info at [nex-ai.be](https://nex-ai.be) and [slopsome.com](https://s","category":"network","line_end":34,"severity":"low","line_start":34},{"id":"network:SKILL.md:93:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"network","line_end":93,"severity":"low","line_start":93},{"id":"blocker:SKILL.md:93:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"blocker","line_end":93,"severity":"low","line_start":93}],"finding_verdicts":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"Line 22 uses backticks to format document_start within explanatory Markdown prose. It contains no Ruby or shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Line 26 formats npm install as inline Markdown while explicitly stating that installation is unnecessary. It does not instruct command execution.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:14:hardcoded-url","reason":"Line 14 contains publisher attribution and a public catalog link. No request, upload instruction, or data transfer accompanies these references.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:34:hardcoded-url","reason":"Line 34 contains informational links to the publisher and another site. These passive references do not implement network access or request sensitive information.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:93:hardcoded-url","reason":"Line 93 links to the publisher and a paid catalog as footer attribution. It contains no instruction to contact those destinations or transmit data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:93:system-reconnaissance","reason":"Line 93 is solely a publisher attribution and catalog URL. There is no host enumeration, system inspection, or reconnaissance instruction.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","subject_content_hash":"9617c919b080ca4b8e4cc75f2ee88605b16f1b9fecd77b5083a331625280d49a","subject_tree_hash":"4743a8490543e36d81d99649e75f38fdf7ac724d462fddc8418426893b5d494b","subject_plugin_path":"skills/nexaiguy/nex-accent-contrast-ext","audit_payload_hash":"2fabb00447a514d520239f5bd212be45","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","contentHash":"9617c919b080ca4b8e4cc75f2ee88605b16f1b9fecd77b5083a331625280d49a","treeHash":"4743a8490543e36d81d99649e75f38fdf7ac724d462fddc8418426893b5d494b","pluginPath":"skills/nexaiguy/nex-accent-contrast-ext","auditPayloadHash":"2fabb00447a514d520239f5bd212be45"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/nexaiguy-nex-accent-contrast-ext/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}