{"data":{"skill":{"slug":"nexaiguy-nex-tab-cost-ext","name":"nex-tab-cost-ext","icon":"📦","repo":"https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/nex-tab-cost-ext","status":"approved","author":"nexaiguy","authorVersion":"1.2","skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"c575a3b7-4346-477b-82de-10da15b606fe","skill_id":"787a9b02-ec05-437a-887e-d3cf37ada1bc","version":1,"content_hash":"v3:3ddfdca559084abffbfdd188f2ba14b597dcfd9c:5976c4167480e4c3f81f01d149f74397b06a1f584bcc3b2fc0f62d1c227d1339:3875efdf370b4c6178d2ba60f0e15f34c7ccdeb56a9c94e4c8ae62b4a5a1199f:736b696c6c732f6e657861696775792f6e65782d7461622d636f73742d657874:af523e26e71268b74f7e7f7c1c345464","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All five static findings are false positives: Markdown formatting and promotional links do not execute commands or perform system reconnaissance. No evidence found of prompt injection, credential access, or data exfiltration in the supplied guide. Extension source is absent, so its runtime behavior and security cannot be assessed.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":54,"line_start":54}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":87,"line_start":87}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":88,"audit_model":"codex","audited_at":"2026-11-02T11:46:54.106+00:00","created_at":"2026-11-02T18:06:24.980787+00:00","static_findings":[{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"I've generated the Nex Tab Cost extension in `assets/extension/`.","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Free skill by [Nex AI](https://nex-ai.be). This file is the public guide from [Agensi](https://www","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:32:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by Nex AI. More skills and info at [nex-ai.be](https://nex-ai.be) and [slopsome.com](https://s","category":"network","line_end":32,"severity":"low","line_start":32},{"id":"network:SKILL.md:87:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"network","line_end":87,"severity":"low","line_start":87},{"id":"blocker:SKILL.md:87:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"blocker","line_end":87,"severity":"low","line_start":87}],"finding_verdicts":[{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"Line 54 uses Markdown backticks around an example output path. This is documentation, not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:14:hardcoded-url","reason":"Line 14 contains attribution and public guide links, alongside an explicit notice that extension source is absent. No automated request or data transmission appears.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:32:hardcoded-url","reason":"Line 32 contains promotional Markdown links to public websites. These links neither execute network requests automatically nor instruct the agent to transmit information.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:87:hardcoded-url","reason":"Line 87 provides author attribution and a paid catalog link. There is no instruction to fetch remote code or send private data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:87:system-reconnaissance","reason":"Line 87 is a promotional footer containing public URLs. It contains no system inspection commands or reconnaissance instructions.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","subject_content_hash":"5976c4167480e4c3f81f01d149f74397b06a1f584bcc3b2fc0f62d1c227d1339","subject_tree_hash":"3875efdf370b4c6178d2ba60f0e15f34c7ccdeb56a9c94e4c8ae62b4a5a1199f","subject_plugin_path":"skills/nexaiguy/nex-tab-cost-ext","audit_payload_hash":"af523e26e71268b74f7e7f7c1c345464","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","contentHash":"5976c4167480e4c3f81f01d149f74397b06a1f584bcc3b2fc0f62d1c227d1339","treeHash":"3875efdf370b4c6178d2ba60f0e15f34c7ccdeb56a9c94e4c8ae62b4a5a1199f","pluginPath":"skills/nexaiguy/nex-tab-cost-ext","auditPayloadHash":"af523e26e71268b74f7e7f7c1c345464"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/nexaiguy-nex-tab-cost-ext/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}