{"data":{"skill":{"slug":"roin-orca-simple-brainstorm","name":"simple-brainstorm","icon":"📦","repo":"https://github.com/roin-orca/skills/tree/main/skills/simple-brainstorm/","status":"approved","author":"roin-orca","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"ab64534f-796a-4815-a73d-dc0608825be5","skill_id":"0ad96454-40bf-4f8c-add5-d62afa4a1666","version":3,"content_hash":"v2:e397ce5a135369cd6def89cb6400d013e2f68f2f:4ba888f0962ab29d0eef01145e974f9221d094af0acb1734800915161c55a16e:8a41e87fb1d9ebed20cf9b2f62dab417be0743c252a3933c38b863168b5bf572:5999473e02d9e25de3b7cef963c3297c","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The single static finding is a false positive from a fenced Graphviz diagram in SKILL.md lines 17-30. No executable code, shell instruction, prompt injection, or malicious intent was found in the reviewed files.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":30,"line_start":17}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":3,"total_lines":53,"audit_model":"codex","audited_at":"2026-07-06T20:40:39.758+00:00","created_at":"2026-07-06T21:37:21.332253+00:00","static_findings":[{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```dot","category":"external_commands","line_end":30,"severity":"medium","line_start":17}],"finding_verdicts":[{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"SKILL.md lines 17-30 contain a fenced dot graph describing workflow steps. It is markdown documentation, not shell or Ruby execution.","verdict":"false_positive","confidence":0.97}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}