{"data":{"skill":{"slug":"nexaiguy-nex-syndicus-vme-pack","name":"nex-syndicus-vme-pack","icon":"📦","repo":"https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/nex-syndicus-vme-pack","status":"approved","author":"nexaiguy","authorVersion":"1.2","skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"02e2f3d6-c4bc-45cb-ba49-d84617dc85d1","skill_id":"ac5a36e9-fc76-46c7-b55b-1409b0d29950","version":1,"content_hash":"v3:3ddfdca559084abffbfdd188f2ba14b597dcfd9c:78b7f7d29a9168217414e626e65089c28d0184005196384b776f962970431e13:142678d555438b27b9373c0308c64016a9cc5ac400c580ee2d0caa09e8df17ae:736b696c6c732f6e657861696775792f6e65782d73796e64696375732d766d652d7061636b:f80abc846bcd11c7e14adba79f8f2a4f","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All five static findings are false positives involving attribution links, a catalog link, and meeting terminology. No evidence found of system reconnaissance, credential access, data exfiltration, or prompt injection in SKILL.md. The reviewed folder contains a public drafting guide, not the scripts or templates described for the paid package.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":86,"line_start":86}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":87,"audit_model":"codex","audited_at":"2026-11-02T11:44:12.655+00:00","created_at":"2026-11-02T18:06:17.298407+00:00","static_findings":[{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Free skill by [Nex AI](https://nex-ai.be). This file is the public guide from [Agensi](https://www","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:34:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by Nex AI. More skills and info at [nex-ai.be](https://nex-ai.be) and [slopsome.com](https://s","category":"network","line_end":34,"severity":"low","line_start":34},{"id":"network:SKILL.md:86:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"network","line_end":86,"severity":"low","line_start":86},{"id":"blocker:SKILL.md:42:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Create 15-day notice invitations with valid quorums and proxies","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:SKILL.md:86:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"blocker","line_end":86,"severity":"low","line_start":86}],"finding_verdicts":[{"id":"network:SKILL.md:14:hardcoded-url","reason":"Line 14 contains publisher attribution and a product reference in Markdown. It does not request browsing, transmit information, or instruct execution.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:34:hardcoded-url","reason":"Line 34 lists informational publisher links without commands or data submission instructions. No evidence found of an outbound data transfer.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:86:hardcoded-url","reason":"Line 86 is a publisher attribution and paid catalog link. It contains no network operation or instruction to upload user information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:42:system-reconnaissance","reason":"Line 42 concerns meeting invitations, quorums, and voting proxies. These are co-ownership procedures, not instructions to inspect a computer or network.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:86:system-reconnaissance","reason":"Line 86 only credits the publisher and links to a catalog. No evidence found of host enumeration, environment inspection, or reconnaissance instructions.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","subject_content_hash":"78b7f7d29a9168217414e626e65089c28d0184005196384b776f962970431e13","subject_tree_hash":"142678d555438b27b9373c0308c64016a9cc5ac400c580ee2d0caa09e8df17ae","subject_plugin_path":"skills/nexaiguy/nex-syndicus-vme-pack","audit_payload_hash":"f80abc846bcd11c7e14adba79f8f2a4f","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","contentHash":"78b7f7d29a9168217414e626e65089c28d0184005196384b776f962970431e13","treeHash":"142678d555438b27b9373c0308c64016a9cc5ac400c580ee2d0caa09e8df17ae","pluginPath":"skills/nexaiguy/nex-syndicus-vme-pack","auditPayloadHash":"f80abc846bcd11c7e14adba79f8f2a4f"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/nexaiguy-nex-syndicus-vme-pack/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}