{"data":{"skill":{"slug":"nexaiguy-nex-page-watch","name":"nex-page-watch","icon":"📦","repo":"https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/nex-page-watch","status":"approved","author":"nexaiguy","authorVersion":"1.2","skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"fbf21382-0223-4bac-90f0-7737c9abdc54","skill_id":"9a4c2de9-f82b-477c-bea0-275eb4fdf3db","version":1,"content_hash":"v3:3ddfdca559084abffbfdd188f2ba14b597dcfd9c:01a1b1b6559070ec431e75d4643fc8e53d85fbc13c946f39f77839f7bae179a8:bbdd4636a7bbfaccac8a425f1e74e13bd6d4614e03eb862c9e6cf6e69b5c94ad:736b696c6c732f6e657861696775792f6e65782d706167652d7761746368:9a19329f092716582eab37c75c9c461a","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All ten static findings are false positives involving Markdown formatting, attribution links, or descriptive prose. No evidence found of executable payloads, reconnaissance, exfiltration, or prompt injection in the supplied guide. The extension implementation is absent, so its runtime behavior and permissions cannot be assessed.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":63,"line_start":63}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":91,"line_start":91}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":92,"audit_model":"codex","audited_at":"2026-11-02T11:58:51.882+00:00","created_at":"2026-11-02T18:05:07.087971+00:00","static_findings":[{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"You receive the complete `assets/extension/` source directory containing the manifest, background sc","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"I've generated the Nex Page Watch extension in `/assets/extension/`.","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `manifest.json`: Manifest V3 config","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `background.js`: Alarm-based scheduler","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `diff.js`: Visual diffing engine","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Free skill by [Nex AI](https://nex-ai.be). This file is the public guide from [Agensi](https://www","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:35:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by Nex AI. More skills and info at [nex-ai.be](https://nex-ai.be) and [slopsome.com](https://s","category":"network","line_end":35,"severity":"low","line_start":35},{"id":"network:SKILL.md:91:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"network","line_end":91,"severity":"low","line_start":91},{"id":"blocker:SKILL.md:22:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Unlike basic scaffolding prompts, this skill delivers a fully functional, shipped product. It bypass","category":"blocker","line_end":22,"severity":"low","line_start":22},{"id":"blocker:SKILL.md:91:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"blocker","line_end":91,"severity":"low","line_start":91}],"finding_verdicts":[{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Line 33 uses Markdown backticks to format a source directory name. It contains no shell command or executable Ruby context.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"Line 58 is an example response with a directory path formatted as inline code. The backticks do not execute anything.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"Line 61 formats a manifest filename in a Markdown list. There is no interpreter invocation or command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"Line 62 formats a background script filename in a Markdown list. It describes a component rather than executing a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"Line 63 formats a diffing script filename in a Markdown list. No executable code or shell context accompanies the backticks.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:14:hardcoded-url","reason":"Line 14 links to the author and original package as attribution. It does not instruct automatic requests or transmission of user data.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:35:hardcoded-url","reason":"Line 35 contains promotional reference links only. No command, network client, or data submission instruction is present.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:91:hardcoded-url","reason":"Line 91 is a footer linking to the author and a paid catalog. It specifies no automated request or exfiltration destination.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:22:system-reconnaissance","reason":"Line 22 discusses build tooling, unpacked installation, and offscreen processing. It requests no host enumeration, system inspection, or credential collection.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:91:system-reconnaissance","reason":"Line 91 contains author attribution and a catalog URL. No reconnaissance commands or instructions appear in this footer.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","subject_content_hash":"01a1b1b6559070ec431e75d4643fc8e53d85fbc13c946f39f77839f7bae179a8","subject_tree_hash":"bbdd4636a7bbfaccac8a425f1e74e13bd6d4614e03eb862c9e6cf6e69b5c94ad","subject_plugin_path":"skills/nexaiguy/nex-page-watch","audit_payload_hash":"9a19329f092716582eab37c75c9c461a","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","contentHash":"01a1b1b6559070ec431e75d4643fc8e53d85fbc13c946f39f77839f7bae179a8","treeHash":"bbdd4636a7bbfaccac8a425f1e74e13bd6d4614e03eb862c9e6cf6e69b5c94ad","pluginPath":"skills/nexaiguy/nex-page-watch","auditPayloadHash":"9a19329f092716582eab37c75c9c461a"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/nexaiguy-nex-page-watch/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}