{"data":{"skill":{"slug":"nexaiguy-nex-us-construction-payapps","name":"nex-us-construction-payapps","icon":"📦","repo":"https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/nex-us-construction-payapps","status":"approved","author":"nexaiguy","authorVersion":"1.0","skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"8dc2110a-a89b-4e7c-9864-c2f7e69d1b04","skill_id":"6cff4acf-9670-42e4-9515-db5e017bc06d","version":1,"content_hash":"v3:3ddfdca559084abffbfdd188f2ba14b597dcfd9c:6fd588f3d1c20013234b06d91b88932b43e7d4a186dbad799f225d41bcacdbf5:f35c464470f7908cce556fc3bea1b19d13971f5c455ff01f6964db39d0a457d6:736b696c6c732f6e657861696775792f6e65782d75732d636f6e737472756374696f6e2d70617961707073:3c6f1827c088424987b5863f894863a4","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All four static findings are false positives: the URLs are attribution links, and the reconnaissance matches contain no system inspection instructions. No evidence found of prompt injection, data exfiltration, or executable behavior in the supplied guide. Scripts and templates mentioned by the guide are absent and were not assessed.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":92,"line_start":92}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":93,"audit_model":"codex","audited_at":"2026-11-02T12:00:42.987+00:00","created_at":"2026-11-02T18:07:03.260435+00:00","static_findings":[{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Free skill by [Nex AI](https://nex-ai.be). This file is the public guide from [Agensi](https://www","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:92:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"network","line_end":92,"severity":"low","line_start":92},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: 'Generate US construction pay applications, G702/G703 structures, lien waivers, and cer","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:SKILL.md:92:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Built by [Nex AI](https://nex-ai.be). More skills, including the paid catalog: https://www.agensi.io","category":"blocker","line_end":92,"severity":"low","line_start":92}],"finding_verdicts":[{"id":"network:SKILL.md:14:hardcoded-url","reason":"Line 14 contains publisher attribution and a product page link, not a network request or instruction to upload data. The surrounding text explicitly describes a public guide without bundled scripts.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:92:hardcoded-url","reason":"Line 92 is a publisher and catalog footer containing ordinary hyperlinks. It contains no instruction to transmit project information, credentials, or local files.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"Line 3 describes construction billing, lien waivers, and certified payroll drafting. It contains no command or instruction to inspect the host, enumerate users, or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:92:system-reconnaissance","reason":"The complete line is publisher attribution and a catalog URL. No system reconnaissance action or request for environment information appears there.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","subject_content_hash":"6fd588f3d1c20013234b06d91b88932b43e7d4a186dbad799f225d41bcacdbf5","subject_tree_hash":"f35c464470f7908cce556fc3bea1b19d13971f5c455ff01f6964db39d0a457d6","subject_plugin_path":"skills/nexaiguy/nex-us-construction-payapps","audit_payload_hash":"3c6f1827c088424987b5863f894863a4","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3ddfdca559084abffbfdd188f2ba14b597dcfd9c","contentHash":"6fd588f3d1c20013234b06d91b88932b43e7d4a186dbad799f225d41bcacdbf5","treeHash":"f35c464470f7908cce556fc3bea1b19d13971f5c455ff01f6964db39d0a457d6","pluginPath":"skills/nexaiguy/nex-us-construction-payapps","auditPayloadHash":"3c6f1827c088424987b5863f894863a4"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/nexaiguy-nex-us-construction-payapps/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}