{"data":{"skill":{"slug":"nexaiguy-nex-frame-it-ext","name":"nex-frame-it-ext","icon":"📦","repo":"https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/nex-frame-it-ext","status":"approved","author":"nexaiguy","authorVersion":"1.2","skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"23e240fe-61cb-427a-8828-c43878a6ac35","skill_id":"365fff72-4f14-419d-92d1-54fa3a38a1ca","version":1,"content_hash":"v3:3ddfdca559084abffbfdd188f2ba14b597dcfd9c:7b8c82b48ba57023e6bd31e482537bfd927d212bf81dfb7308669aa817a7a460:d95e8b9ef22648ecd7937959fa4f1c9d8d235b85aeb6dd60c45c93efefaa4013:736b696c6c732f6e657861696775792f6e65782d6672616d652d69742d657874:97a96256e8beed1ca6fe7a7232664039","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All eight static findings are false positives: promotional links, screenshot-framing descriptions, and development guidance do not demonstrate uploads or system reconnaissance. No evidence found of prompt injection, credential access, or malicious execution in the supplied guide. Extension source is absent, so runtime behavior and production-readiness claims cannot be verified.","remediation":[{"issue":"The guide claims full source delivery and shows a deployment result, but explicitly states that extension source is absent.","severity":"low","suggestion":"Label the package as documentation-only and the deployment response as illustrative. Remove unsupported delivery claims or include reviewable extension source."},{"issue":"Production-readiness and Chrome Web Store security claims cannot be verified from the guide.","severity":"low","suggestion":"Qualify these claims until source review confirms permissions, capture boundaries, local processing, and any network destinations."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":81,"line_start":81}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":82,"audit_model":"codex","audited_at":"2026-11-02T11:40:38.841+00:00","created_at":"2026-11-02T17:05:15.843999+00:00","static_findings":[{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Free skill by [Nex AI](https://nex-ai.be). This file is the public guide from [Agensi](https://www","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:32:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by Nex AI. More skills and info at [nex-ai.be](https://nex-ai.be) and [slopsome.com](https://s","category":"network","line_end":32,"severity":"low","line_start":32},{"id":"network:SKILL.md:81:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"network","line_end":81,"severity":"low","line_start":81},{"id":"blocker:SKILL.md:18:screen-capture-upload","file":"SKILL.md","pattern":"Screen capture upload","snippet":"Nex Frame It is a production-ready Chrome Extension (Manifest V3) that transforms browser screenshot","category":"blocker","line_end":18,"severity":"high","line_start":18},{"id":"blocker:SKILL.md:73:screen-capture-upload","file":"SKILL.md","pattern":"Screen capture upload","snippet":"Nex Frame It solves the 'screenshot-to-presentation' workflow by programmatically wrapping captures ","category":"blocker","line_end":73,"severity":"high","line_start":73},{"id":"blocker:SKILL.md:39:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Learn the no-build extension development loop for rapid prototyping.","category":"blocker","line_end":39,"severity":"low","line_start":39},{"id":"blocker:SKILL.md:65:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"This is a \"no-build\" skill designed for rapid deployment. Because it uses Vanilla JS, HTML, and CSS,","category":"blocker","line_end":65,"severity":"low","line_start":65},{"id":"blocker:SKILL.md:81:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"blocker","line_end":81,"severity":"low","line_start":81}],"finding_verdicts":[{"id":"network:SKILL.md:14:hardcoded-url","reason":"Line 14 contains attribution and a public catalog link, not an executable request or upload instruction. No sensitive-data transfer is described.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:32:hardcoded-url","reason":"Line 32 links to author information and other skills. These promotional hyperlinks do not instruct automated network access or data transmission.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:81:hardcoded-url","reason":"Line 81 is an attribution footer linking to the author and paid catalog. It does not specify a collection endpoint or transmit captured content.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:18:screen-capture-upload","reason":"Line 18 describes active-tab capture and Canvas device framing, which are the stated product purpose. No upload destination or transmission instruction appears.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:73:screen-capture-upload","reason":"Line 73 describes wrapping screenshots in device frames to reduce manual editing. It contains no upload behavior or external data destination.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:39:system-reconnaissance","reason":"Line 39 discusses learning a no-build development workflow. It contains no command or instruction to enumerate systems, accounts, or environment details.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:65:system-reconnaissance","reason":"Line 65 describes manually loading a Chrome extension through Developer Mode without build tools. It does not inspect the host or collect system information.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:81:system-reconnaissance","reason":"Line 81 contains only author attribution and catalog links. No system inspection, fingerprinting, or reconnaissance instruction appears.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","subject_content_hash":"7b8c82b48ba57023e6bd31e482537bfd927d212bf81dfb7308669aa817a7a460","subject_tree_hash":"d95e8b9ef22648ecd7937959fa4f1c9d8d235b85aeb6dd60c45c93efefaa4013","subject_plugin_path":"skills/nexaiguy/nex-frame-it-ext","audit_payload_hash":"97a96256e8beed1ca6fe7a7232664039","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","contentHash":"7b8c82b48ba57023e6bd31e482537bfd927d212bf81dfb7308669aa817a7a460","treeHash":"d95e8b9ef22648ecd7937959fa4f1c9d8d235b85aeb6dd60c45c93efefaa4013","pluginPath":"skills/nexaiguy/nex-frame-it-ext","auditPayloadHash":"97a96256e8beed1ca6fe7a7232664039"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/nexaiguy-nex-frame-it-ext/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}