{"data":{"skill":{"slug":"nexaiguy-nex-color-spy-ext","name":"nex-color-spy-ext","icon":"📦","repo":"https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/nex-color-spy-ext","status":"approved","author":"nexaiguy","authorVersion":"1.2","skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"8f0598ef-3c05-45fe-a227-1e2650e1d557","skill_id":"71aa8bc2-cd59-48f1-94d6-a5127a8625a3","version":1,"content_hash":"v3:3ddfdca559084abffbfdd188f2ba14b597dcfd9c:ede475c2bbbbf4ec92df9ebbde2c3161588163332ba769929a89b051ba4f4fea:3a5db336fe34c13a19164c51db4dcd99bd85d989587a2207e869e80578055c22:736b696c6c732f6e657861696775792f6e65782d636f6c6f722d7370792d657874:93f329c5b7ebed3f30e538959a575ea8","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All five static findings are false positives: attribution links and ordinary extension-development prose do not establish network execution or system reconnaissance. No evidence found of prompt injection, credential access, or data exfiltration in the reviewed guide. Extension source is explicitly absent, so its runtime security cannot be assessed.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":96,"line_start":96}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":97,"audit_model":"codex","audited_at":"2026-11-02T12:14:37.696+00:00","created_at":"2026-11-02T17:03:07.925139+00:00","static_findings":[{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Free skill by [Nex AI](https://nex-ai.be). This file is the public guide from [Agensi](https://www","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:38:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by Nex AI. More skills and info at [nex-ai.be](https://nex-ai.be) and [slopsome.com](https://s","category":"network","line_end":38,"severity":"low","line_start":38},{"id":"network:SKILL.md:96:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"network","line_end":96,"severity":"low","line_start":96},{"id":"blocker:SKILL.md:45:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Learn the no-build developer loop for rapid Chrome extension prototyping.","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"blocker:SKILL.md:96:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"blocker","line_end":96,"severity":"low","line_start":96}],"finding_verdicts":[{"id":"network:SKILL.md:14:hardcoded-url","reason":"Line 14 contains publisher and catalog links plus a disclosure that source files are absent. It does not instruct network execution or transmission of user data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:38:hardcoded-url","reason":"Line 38 contains attribution and informational Markdown links only. No request, upload, or automatic retrieval behavior is specified.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:96:hardcoded-url","reason":"Line 96 links to the publisher and paid catalog as promotional references. It contains no execution instructions or data collection behavior.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:45:system-reconnaissance","reason":"Line 45 describes learning a no-build Chrome extension prototyping workflow. It contains no commands or instructions to enumerate host information.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:96:system-reconnaissance","reason":"Line 96 is a publisher attribution and catalog reference. It neither requests system information nor specifies reconnaissance actions.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","subject_content_hash":"ede475c2bbbbf4ec92df9ebbde2c3161588163332ba769929a89b051ba4f4fea","subject_tree_hash":"3a5db336fe34c13a19164c51db4dcd99bd85d989587a2207e869e80578055c22","subject_plugin_path":"skills/nexaiguy/nex-color-spy-ext","audit_payload_hash":"93f329c5b7ebed3f30e538959a575ea8","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","contentHash":"ede475c2bbbbf4ec92df9ebbde2c3161588163332ba769929a89b051ba4f4fea","treeHash":"3a5db336fe34c13a19164c51db4dcd99bd85d989587a2207e869e80578055c22","pluginPath":"skills/nexaiguy/nex-color-spy-ext","auditPayloadHash":"93f329c5b7ebed3f30e538959a575ea8"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/nexaiguy-nex-color-spy-ext/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}