{"data":{"skill":{"slug":"pixijs-pixijs-html-source","name":"pixijs-html-source","icon":"📦","repo":"https://github.com/pixijs/pixijs-skills/tree/83760c6f53462ca9cecd68055041f5a8c94758ce/skills/pixijs-html-source","status":"approved","author":"pixijs","authorVersion":null,"skillstoreRevision":1,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"d0f592ca-9691-4cba-af79-325dad341468","skill_id":"7d771adc-a351-483d-a586-7cb31a0a19a2","version":1,"content_hash":"v3:12f3d8d7050431cd941106781d57d5084b3342a4:8061235e80fad00c23ca274d67e0198246b49c6093511fa983ca347ba2ceb492:d22ba6ecc4090af1149c851760d4e821e2a9ac567cb825656f4b30d05e3d13a0:736b696c6c732f706978696a732f706978696a732d68746d6c2d736f75726365:61d11cf6fdb11fa722084417cf5b8f96","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 66 static findings are false positives in this documentation-only skill. Markdown backticks are not shell execution, fixed HTML introduces no untrusted input, and reference links do not transmit captured content. No evidence found of prompt injection, credential access, or data exfiltration; texture uploads target the local GPU.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"SKILL.md","line_end":25,"line_start":25}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":35,"line_start":15},{"file":"SKILL.md","line_end":37,"line_start":35},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":47,"line_start":43},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":57,"line_start":53},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":69,"line_start":66},{"file":"SKILL.md","line_end":71,"line_start":69},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":87,"line_start":79},{"file":"SKILL.md","line_end":89,"line_start":87},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":91,"line_start":91},{"file":"SKILL.md","line_end":101,"line_start":95},{"file":"SKILL.md","line_end":103,"line_start":101},{"file":"SKILL.md","line_end":103,"line_start":103},{"file":"SKILL.md","line_end":115,"line_start":107},{"file":"SKILL.md","line_end":117,"line_start":115},{"file":"SKILL.md","line_end":117,"line_start":117},{"file":"SKILL.md","line_end":130,"line_start":121},{"file":"SKILL.md","line_end":132,"line_start":130},{"file":"SKILL.md","line_end":132,"line_start":132},{"file":"SKILL.md","line_end":136,"line_start":136},{"file":"SKILL.md","line_end":149,"line_start":138},{"file":"SKILL.md","line_end":153,"line_start":149},{"file":"SKILL.md","line_end":156,"line_start":153},{"file":"SKILL.md","line_end":158,"line_start":156},{"file":"SKILL.md","line_end":158,"line_start":158},{"file":"SKILL.md","line_end":168,"line_start":166},{"file":"SKILL.md","line_end":172,"line_start":168},{"file":"SKILL.md","line_end":174,"line_start":172},{"file":"SKILL.md","line_end":176,"line_start":174},{"file":"SKILL.md","line_end":176,"line_start":176},{"file":"SKILL.md","line_end":187,"line_start":182},{"file":"SKILL.md","line_end":191,"line_start":187},{"file":"SKILL.md","line_end":194,"line_start":191},{"file":"SKILL.md","line_end":196,"line_start":194},{"file":"SKILL.md","line_end":196,"line_start":196}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":223,"line_start":223},{"file":"SKILL.md","line_end":224,"line_start":224},{"file":"SKILL.md","line_end":225,"line_start":225},{"file":"SKILL.md","line_end":226,"line_start":226},{"file":"SKILL.md","line_end":227,"line_start":227},{"file":"SKILL.md","line_end":228,"line_start":228}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":229,"audit_model":"codex","audited_at":"2026-11-04T15:55:31.98+00:00","created_at":"2026-11-05T02:22:37.745223+00:00","static_findings":[{"id":"scripts:SKILL.md:25:innerhtml-assignment-xss-risk","file":"SKILL.md","pattern":"innerHTML assignment (XSS risk)","snippet":"form.innerHTML = '<input value=\"still editable\" />';","category":"scripts","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`HTMLSource` and `ElementImageSource` turn a DOM element into a `TextureSource` you can use anywhere","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:9:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> These sources rely on the experimental HTML-in-Canvas browser proposal and are marked EXPERIMENTAL","category":"external_commands","line_end":9,"severity":"medium","line_start":9},{"id":"external_commands:SKILL.md:11:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Assumes familiarity with `pixijs-scene-sprite` and textures. These are texture *sources*, not displa","category":"external_commands","line_end":11,"severity":"medium","line_start":11},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":35,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":37,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Related skills:** `pixijs-scene-sprite` (display the texture), `pixijs-scene-mesh` (map onto geome","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Both sources extend `TextureSource`, so all `TextureSourceOptions` (`resolution`, `scaleMode`, `addr","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`HTMLSourceOptions` (live element):","category":"external_commands","line_end":47,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `resource`         | `Element`          | —       | Required. The live DOM element to render. Must","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `canvas`           | `HTMLSourceCanvas` | —       | The canvas that owns the element's layout subt","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `autoLayout`       | `boolean`          | `true`  | Set the `layoutsubtree` attribute on the ownin","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `autoUpdate`       | `boolean`          | `true`  | Listen for the canvas `paint` event and re-upl","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `autoRequestPaint` | `boolean`          | `true`  | Request one initial paint after construction. ","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`ElementImageSourceOptions` (immutable snapshot):","category":"external_commands","line_end":57,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `resource`   | `ElementImage` | —       | Required. A snapshot from `canvas.captureElementImage(el","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `autoClose`  | `boolean`      | `false` | Call `snapshot.close()` when the source is destroyed. Le","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Change the defaults for every `HTMLSource` through the static `HTMLSource.defaultOptions` object, fo","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":69,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":71,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`pixi.js/html-source` calls `extensions.add(...)` to register `HTMLSource`, `ElementImageSource`, an","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Importing a named export from `pixi.js/html-source` also triggers the side effect, so a bare `import","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":87,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":89,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Cast `app.canvas` to `HTMLSourceCanvas` for the typed `requestPaint` and `captureElementImage` membe","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"When the API is missing the first upload throws `[HTMLSource] WebGLRenderingContext.texElementImage2","category":"external_commands","line_end":91,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":101,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":103,"severity":"medium","line_start":101},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The element must be a direct child of the renderer's `<canvas>`; the source infers the owning canvas","category":"external_commands","line_end":103,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":115,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":117,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The browser only repaints canvas children on demand. For an element whose content changes every fram","category":"external_commands","line_end":117,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":130,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":132,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`captureElementImage()` freezes an element's current pixels into an immutable `ElementImage`. There ","category":"external_commands","line_end":132,"severity":"medium","line_start":132},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Both sources are normal `TextureSource`s. Wrap them with `Sprite.from(source)` / `Texture.from(sourc","category":"external_commands","line_end":136,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":149,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":153,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":156,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":158,"severity":"medium","line_start":156},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"A generic HTML element or an `ElementImage` passed to `Texture.from`/`Sprite.from` resolves to these","category":"external_commands","line_end":158,"severity":"medium","line_start":158},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":168,"severity":"medium","line_start":166},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":172,"severity":"medium","line_start":168},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":174,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":176,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`HTMLSource`, `ElementImageSource`, and the `'html'` uploaders live only in `pixi.js/html-source`. I","category":"external_commands","line_end":176,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":187,"severity":"medium","line_start":182},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":191,"severity":"medium","line_start":187},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":194,"severity":"medium","line_start":191},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":196,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`HTMLSource` requires the element to be a direct child of the owning canvas (`app.canvas.appendChild","category":"external_commands","line_end":196,"severity":"medium","line_start":196},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"A non-animating element updates automatically on browser `paint` events (`autoUpdate: true`). Conten","category":"external_commands","line_end":200,"severity":"medium","line_start":200},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":208,"severity":"medium","line_start":204},{"id":"external_commands:SKILL.md:208:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"source.destroy(); // closes the snapshot — `other` is now a use-after-free","category":"external_commands","line_end":209,"severity":"medium","line_start":208},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":211,"severity":"medium","line_start":209},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Only set `autoClose: true` when the source owns the snapshot exclusively. For a shared snapshot, lea","category":"external_commands","line_end":211,"severity":"medium","line_start":211},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ts","category":"external_commands","line_end":217,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":219,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:219:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`HTMLSource.destroy()` detaches the canvas `paint` listener and nulls its canvas reference. `Element","category":"external_commands","line_end":219,"severity":"medium","line_start":219},{"id":"network:SKILL.md:223:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [HTMLSource](https://pixijs.download/release/docs/rendering.HTMLSource.html.md)","category":"network","line_end":223,"severity":"low","line_start":223},{"id":"network:SKILL.md:224:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [HTMLSourceOptions](https://pixijs.download/release/docs/rendering.HTMLSourceOptions.html.md)","category":"network","line_end":224,"severity":"low","line_start":224},{"id":"network:SKILL.md:225:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [ElementImageSource](https://pixijs.download/release/docs/rendering.ElementImageSource.html.md)","category":"network","line_end":225,"severity":"low","line_start":225},{"id":"network:SKILL.md:226:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [ElementImageSourceOptions](https://pixijs.download/release/docs/rendering.ElementImageSourceOptio","category":"network","line_end":226,"severity":"low","line_start":226},{"id":"network:SKILL.md:227:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [HTMLSourceCanvas](https://pixijs.download/release/docs/rendering.HTMLSourceCanvas.html.md)","category":"network","line_end":227,"severity":"low","line_start":227},{"id":"network:SKILL.md:228:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [ElementImage](https://pixijs.download/release/docs/rendering.ElementImage.html.md)","category":"network","line_end":228,"severity":"low","line_start":228},{"id":"blocker:SKILL.md:11:screen-capture-upload","file":"SKILL.md","pattern":"Screen capture upload","snippet":"Assumes familiarity with `pixijs-scene-sprite` and textures. These are texture *sources*, not displa","category":"blocker","line_end":11,"severity":"high","line_start":11}],"finding_verdicts":[{"id":"scripts:SKILL.md:25:innerhtml-assignment-xss-risk","reason":"The innerHTML assignment uses a fixed input element string with no interpolation, event handlers, or untrusted data. No injection vector is demonstrated.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"Backticks format API names in Markdown prose about DOM texture sources. There is no Ruby or shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:9:ruby-shell-backtick-execution","reason":"The backticks identify canvas.requestPaint in a browser compatibility warning. They are Markdown formatting, not executable shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:11:ruby-shell-backtick-execution","reason":"Inline backticks identify related skills and PixiJS classes. The prose describes display objects and worker limitations, not command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"This fenced TypeScript example creates a form, texture source, and sprite using browser APIs. The fence does not execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The match spans a closing Markdown code fence and related-skill references. Neither contains Ruby or shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"Backticks format related skill identifiers and PerspectiveMesh in a reference list. They are not command substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"This sentence uses Markdown code spans for texture option names. It provides no executable shell or Ruby code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The match covers an options-table heading and table formatting. Backticks label HTMLSourceOptions, not executable commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The resource table row formats a property and its Element type. It documents DOM parent requirements without executing commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"Backticks identify the canvas option, its type, and resource.parentElement. This is a Markdown API table, not shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"This table row documents the autoLayout boolean and layoutsubtree attribute. Its backticks only format browser API terms.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The row describes autoUpdate and local GPU texture refresh on paint events. Markdown code spans do not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The autoRequestPaint option row explains initial paint scheduling. Backticks format identifiers and boolean values, not shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The match covers the ElementImageSourceOptions heading and snapshot options table. This is Markdown documentation with no command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"Inline code labels the resource property and local captureElementImage API. Capturing a DOM element here does not execute shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"This option row explains snapshot ownership and warns against premature closure. Backticks format API calls and do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The inline example changes a JavaScript default option on HTMLSource. Markdown backticks are not Ruby or shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The fenced TypeScript block contains ordinary PixiJS module imports. There are no shell commands or process execution APIs.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The closing code fence precedes prose about extension registration. These Markdown delimiters do not execute the imported module through a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The sentence documents local renderer extension registration and module exports. Backticks format API names, not executable commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The inline import example explains JavaScript module registration side effects. It contains no shell substitution or process launch.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"This fenced TypeScript example checks whether canvas.requestPaint exists. It performs browser feature detection, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The match spans a closing Markdown fence and type-casting guidance. No Ruby or shell code appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"Backticks identify TypeScript types, browser APIs, and return values in prose. They do not invoke a command interpreter.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The code spans quote WebGL and WebGPU error messages for unavailable browser APIs. Quoted diagnostics are not executable shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The TypeScript example appends a form to a canvas and constructs a source and sprite. Its Markdown fence is not shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"This closing code fence precedes documentation about DOM ownership and paint readiness. It does not execute external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"Inline code identifies canvas attributes, source properties, and dimensions. The paragraph only explains local DOM and rendering behavior.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The fenced TypeScript ticker example updates clock.textContent and requests a local repaint. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The closing Markdown fence leads into paint-scheduling guidance. These formatting delimiters do not execute a shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"The backticks label autoRequestPaint and source.requestPaint in explanatory prose. No external command is requested or run.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The TypeScript block captures a DOM element into an ElementImage and wraps it as a sprite. It contains no shell execution or network transmission.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The closing code fence precedes snapshot lifecycle documentation. The backticks are Markdown, not executable command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","reason":"The paragraph describes immutable snapshots and explicit resource cleanup. Its inline API names do not invoke Ruby or shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"The code spans show PixiJS texture conversion calls in prose. They do not execute an external process.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"This fenced TypeScript block demonstrates texture framing and mesh mapping. Its backticks delimit documentation rather than shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"The match covers a closing code fence and the next example heading. There are no Ruby or shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"The fenced TypeScript example calls Sprite.from on an existing canvas child. This is a rendering API call, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","reason":"The match spans a closing Markdown fence and source-selection documentation. It does not contain executable command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","reason":"Inline backticks label texture factories, priority values, and source options. The paragraph explains fallback selection, not process execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","reason":"This TypeScript block is explicitly marked Wrong and demonstrates an incorrect module import. It is documentation, not an external command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","reason":"The closing Markdown fence separates incorrect and corrected import examples. It has no shell execution semantics.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"The fenced TypeScript example shows the correct pixi.js/html-source import. A module import in documentation is not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"This is a closing code fence followed by module export guidance. The delimiters and inline identifiers are Markdown formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","reason":"The paragraph explains class exports and bundler retention of renderer registration. Backticks are code spans, not external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","reason":"This TypeScript example checks for a missing requestPaint API and suggests a fallback. It does not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","reason":"The match covers Markdown code fences and a common-mistake heading. Neither executes a Ruby or shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","reason":"The TypeScript example deliberately shows an incorrect DOM parent and the resulting constructor error. Its fence is not shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"The closing code fence precedes DOM parent correction guidance. No command execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","reason":"Inline backticks identify HTMLSource, appendChild, and the canvas option. This explains browser DOM ownership without invoking external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"The paragraph formats paint events and repaint options as inline code. It describes local texture refresh, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","reason":"The fenced TypeScript example illustrates the documented mistake of closing a shared snapshot too early. It contains no shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:208:ruby-shell-backtick-execution","reason":"The backticks around other appear inside an explanatory comment warning about premature snapshot closure. They do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","reason":"The closing Markdown fence precedes explicit safe ownership guidance for snapshots. No Ruby or shell execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","reason":"The paragraph advises disabling autoClose for shared snapshots and closing only after final use. Backticks format JavaScript API references.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"The fenced TypeScript example calls source.destroy for resource cleanup. No shell command or external process is involved.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"The closing Markdown fence leads into cleanup documentation. These backticks are formatting delimiters, not command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:219:ruby-shell-backtick-execution","reason":"The prose documents detaching paint listeners and closing snapshots. Inline API names do not invoke a shell or Ruby interpreter.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:223:hardcoded-url","reason":"This is a Markdown link to the HTMLSource API reference on pixijs.download. It is not a request or data upload instruction.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:224:hardcoded-url","reason":"The URL links to the HTMLSourceOptions API reference. The skill provides no payload, credential, or automatic network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:225:hardcoded-url","reason":"The ElementImageSource documentation link is a static reference. It does not transmit captured DOM pixels or other data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:226:hardcoded-url","reason":"This is a static link to ElementImageSourceOptions documentation on pixijs.download. No executable request or exfiltration behavior is specified.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:227:hardcoded-url","reason":"The HTMLSourceCanvas URL is an API reference citation. It includes no user data or instruction to upload content.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:228:hardcoded-url","reason":"This static ElementImage reference link is relevant to the documented snapshot API. It does not initiate a network transfer.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:11:screen-capture-upload","reason":"Line 11 discusses display objects and the absence of DOM capture in workers. The examples capture specific DOM elements for local GPU textures, with no screen capture or remote upload.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"12f3d8d7050431cd941106781d57d5084b3342a4","subject_content_hash":"8061235e80fad00c23ca274d67e0198246b49c6093511fa983ca347ba2ceb492","subject_tree_hash":"d22ba6ecc4090af1149c851760d4e821e2a9ac567cb825656f4b30d05e3d13a0","subject_plugin_path":"skills/pixijs/pixijs-html-source","audit_payload_hash":"61d11cf6fdb11fa722084417cf5b8f96","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"12f3d8d7050431cd941106781d57d5084b3342a4","contentHash":"8061235e80fad00c23ca274d67e0198246b49c6093511fa983ca347ba2ceb492","treeHash":"d22ba6ecc4090af1149c851760d4e821e2a9ac567cb825656f4b30d05e3d13a0","pluginPath":"skills/pixijs/pixijs-html-source","auditPayloadHash":"61d11cf6fdb11fa722084417cf5b8f96"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/pixijs-pixijs-html-source/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}