{"data":{"skill":{"slug":"nexaiguy-nex-trust-check","name":"nex-trust-check","icon":"📦","repo":"https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/nex-trust-check","status":"approved","author":"nexaiguy","authorVersion":"1.2","skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"a88d66b6-ba5c-457d-9661-3ad6180161a5","skill_id":"dccb7666-c315-4189-b2e7-0cccc076820f","version":1,"content_hash":"v3:3ddfdca559084abffbfdd188f2ba14b597dcfd9c:9bc1e5b10c72fbdb4be86bac607c75055e7b81c2703a5940e623f83523888c39:ddc4399ac79a3eb69891a7317e9fcaac5bc2917668f8389ecf3e64d72ede5180:736b696c6c732f6e657861696775792f6e65782d74727573742d636865636b:c426ad4b4bd54b10394494f974df3aee","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All six static findings are false positives involving Markdown formatting, informational links, or ordinary product descriptions. No evidence found of executable commands, reconnaissance, data exfiltration, or prompt injection in the supplied guide. Extension source is absent, so its advertised security and runtime behavior cannot be verified.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":58,"line_start":58}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":84,"line_start":84}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":85,"audit_model":"codex","audited_at":"2026-11-02T11:52:43.863+00:00","created_at":"2026-11-02T18:06:40.209832+00:00","static_findings":[{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"I've generated the complete Manifest V3 source in `assets/extension/`. You can load this into Chrome","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Free skill by [Nex AI](https://nex-ai.be). This file is the public guide from [Agensi](https://www","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:35:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by Nex AI. More skills and info at [nex-ai.be](https://nex-ai.be) and [slopsome.com](https://s","category":"network","line_end":35,"severity":"low","line_start":35},{"id":"network:SKILL.md:84:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"network","line_end":84,"severity":"low","line_start":84},{"id":"blocker:SKILL.md:33:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"You receive the full source code (manifest, content scripts, background workers, and UI components) ","category":"blocker","line_end":33,"severity":"low","line_start":33},{"id":"blocker:SKILL.md:84:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"blocker","line_end":84,"severity":"low","line_start":84}],"finding_verdicts":[{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"Line 58 uses Markdown backticks to format an example directory and filenames. No shell command or Ruby execution appears.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:14:hardcoded-url","reason":"Line 14 links to the author and public product guide and explicitly discloses missing package assets. These informational links perform no automated requests.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:35:hardcoded-url","reason":"Line 35 contains author attribution and promotional links only. No instruction sends user data or credentials to these sites.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:84:hardcoded-url","reason":"Line 84 links to the author and paid catalog in a documentation footer. No executable request or data transmission is specified.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:33:system-reconnaissance","reason":"Line 33 describes advertised extension components and a development workflow. It neither requests system information nor invokes reconnaissance commands.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:84:system-reconnaissance","reason":"Line 84 is an author attribution and catalog URL, not a system inspection instruction. No host enumeration or reconnaissance behavior appears.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","subject_content_hash":"9bc1e5b10c72fbdb4be86bac607c75055e7b81c2703a5940e623f83523888c39","subject_tree_hash":"ddc4399ac79a3eb69891a7317e9fcaac5bc2917668f8389ecf3e64d72ede5180","subject_plugin_path":"skills/nexaiguy/nex-trust-check","audit_payload_hash":"c426ad4b4bd54b10394494f974df3aee","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","contentHash":"9bc1e5b10c72fbdb4be86bac607c75055e7b81c2703a5940e623f83523888c39","treeHash":"ddc4399ac79a3eb69891a7317e9fcaac5bc2917668f8389ecf3e64d72ede5180","pluginPath":"skills/nexaiguy/nex-trust-check","auditPayloadHash":"c426ad4b4bd54b10394494f974df3aee"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/nexaiguy-nex-trust-check/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}