{"data":{"skill":{"slug":"nexaiguy-nex-govcon-capture-pack","name":"nex-govcon-capture-pack","icon":"📦","repo":"https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/nex-govcon-capture-pack","status":"approved","author":"nexaiguy","authorVersion":"1.0","skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"9ae06a06-7c17-423b-88a1-1f83ceb9827d","skill_id":"298211d7-9efc-4ff2-ae54-baead4d9934f","version":1,"content_hash":"v3:3ddfdca559084abffbfdd188f2ba14b597dcfd9c:a1be8c8e9e1063260aaeb9b2c4650706d8a9c39b280dd0236938ac2338918a5a:473cf90cd317b74d211cb8e4cff73cc32395221e99b256ac68b6e841a5c580d6:736b696c6c732f6e657861696775792f6e65782d676f76636f6e2d636170747572652d7061636b:6ba7ea51b36d6fb2de82aee26f42585f","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All four static findings are false positives: attribution URLs and procurement terminology do not establish malicious network activity or system reconnaissance. The reviewed file contains guidance only, with no evidence found of executable commands, data exfiltration, or prompt injection. External destinations were not independently assessed.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":64,"line_start":64}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":65,"audit_model":"codex","audited_at":"2026-11-02T11:49:31.7+00:00","created_at":"2026-11-02T17:05:43.120696+00:00","static_findings":[{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Free skill by [Nex AI](https://nex-ai.be). This file is the public guide from [Agensi](https://www","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:64:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"network","line_end":64,"severity":"low","line_start":64},{"id":"blocker:SKILL.md:48:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"It covers the UEI, CAGE code, NAICS selection, and EFT banking steps, while warning against common p","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"blocker:SKILL.md:64:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"blocker","line_end":64,"severity":"low","line_start":64}],"finding_verdicts":[{"id":"network:SKILL.md:14:hardcoded-url","reason":"Line 14 contains Markdown attribution and source links, alongside a disclosure that package assets are absent. No instruction sends user data to these destinations.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:64:hardcoded-url","reason":"Line 64 is an author attribution and catalog footer. It contains no request execution, payload construction, or instruction to transmit user information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:48:system-reconnaissance","reason":"Line 48 describes UEI, CAGE, NAICS, and EFT registration topics, not host inspection. No command or instruction collects system information.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:64:system-reconnaissance","reason":"Line 64 only credits the author and links to a catalog. There is no system discovery command or reconnaissance instruction.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","subject_content_hash":"a1be8c8e9e1063260aaeb9b2c4650706d8a9c39b280dd0236938ac2338918a5a","subject_tree_hash":"473cf90cd317b74d211cb8e4cff73cc32395221e99b256ac68b6e841a5c580d6","subject_plugin_path":"skills/nexaiguy/nex-govcon-capture-pack","audit_payload_hash":"6ba7ea51b36d6fb2de82aee26f42585f","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","contentHash":"a1be8c8e9e1063260aaeb9b2c4650706d8a9c39b280dd0236938ac2338918a5a","treeHash":"473cf90cd317b74d211cb8e4cff73cc32395221e99b256ac68b6e841a5c580d6","pluginPath":"skills/nexaiguy/nex-govcon-capture-pack","auditPayloadHash":"6ba7ea51b36d6fb2de82aee26f42585f"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/nexaiguy-nex-govcon-capture-pack/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}