{"data":{"skill":{"slug":"nexaiguy-nex-uk-mtd-pack","name":"nex-uk-mtd-pack","icon":"📦","repo":"https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/nex-uk-mtd-pack","status":"approved","author":"nexaiguy","authorVersion":"1.0","skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"4673ca06-b4d4-442e-b7d9-58b5ad8ad5c8","skill_id":"503664a9-b389-471d-8f89-1c531cddc4cb","version":1,"content_hash":"v3:3ddfdca559084abffbfdd188f2ba14b597dcfd9c:59532cc1e04e8cd743917b4787dc71df1210ab12a5daf4c144caaf6a0cde723a:2bf83b6d756b60c0340545330ffeae18d0b3abaf919d00b1c585cae8fdce5d98:736b696c6c732f6e657861696775792f6e65782d756b2d6d74642d7061636b:2ecafcda999b0b90a53b3d33470d4fff","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All four static findings are false positives: attribution links and tax-planning prose do not demonstrate network execution or system reconnaissance. No evidence found of prompt injection, credential access, exfiltration, or executable payloads in the reviewed SKILL.md. The package is a written guide; its automation and regulatory currency claims are not supported by included implementation files.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":83,"line_start":83}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":84,"audit_model":"codex","audited_at":"2026-11-02T11:58:05.812+00:00","created_at":"2026-11-02T18:06:55.427451+00:00","static_findings":[{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Free skill by [Nex AI](https://nex-ai.be). This file is the public guide from [Agensi](https://www","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:83:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"network","line_end":83,"severity":"low","line_start":83},{"id":"blocker:SKILL.md:36:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Generate a deadline schedule for a sole trader to avoid accruing penalty points.","category":"blocker","line_end":36,"severity":"low","line_start":36},{"id":"blocker:SKILL.md:83:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"blocker","line_end":83,"severity":"low","line_start":83}],"finding_verdicts":[{"id":"network:SKILL.md:14:hardcoded-url","reason":"Line 14 contains Markdown attribution and product links, alongside an explicit notice that scripts and templates are absent. It does not request network execution or transmission of user data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:83:hardcoded-url","reason":"Line 83 is an author attribution and catalog link, not a network operation. No instruction sends tax records, credentials, or other user data to these destinations.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:36:system-reconnaissance","reason":"Line 36 describes generating a tax deadline schedule to avoid penalty points. It contains no host inspection command or instruction to collect system information.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:83:system-reconnaissance","reason":"Line 83 contains publisher attribution and a paid catalog URL only. Neither the prose nor the URL instructs the agent to enumerate or inspect the host system.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","subject_content_hash":"59532cc1e04e8cd743917b4787dc71df1210ab12a5daf4c144caaf6a0cde723a","subject_tree_hash":"2bf83b6d756b60c0340545330ffeae18d0b3abaf919d00b1c585cae8fdce5d98","subject_plugin_path":"skills/nexaiguy/nex-uk-mtd-pack","audit_payload_hash":"2ecafcda999b0b90a53b3d33470d4fff","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","contentHash":"59532cc1e04e8cd743917b4787dc71df1210ab12a5daf4c144caaf6a0cde723a","treeHash":"2bf83b6d756b60c0340545330ffeae18d0b3abaf919d00b1c585cae8fdce5d98","pluginPath":"skills/nexaiguy/nex-uk-mtd-pack","auditPayloadHash":"2ecafcda999b0b90a53b3d33470d4fff"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/nexaiguy-nex-uk-mtd-pack/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}