{"data":{"skill":{"slug":"ruvnet-sparc-methodology","name":"sparc-methodology","icon":"📦","repo":"https://github.com/ruvnet/claude-flow/tree/main/.claude/skills/sparc-methodology","status":"approved","author":"ruvnet","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"f0a484d6-2e64-47fc-ada3-73338ae85d0f","skill_id":"c8721217-40c7-456c-87b6-ccb3486337eb","version":9,"content_hash":"v3:ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006:eb858ef5f83ea9bdd6c2811df4afc869a2767bc2e374a3c5a9258d449fe193dc:4c1d254fb42d1b2a37ff8afe8b9cb5d2a2e956cad0aac96406c965b89e07c98e:736b696c6c732f7275766e65742f73706172632d6d6574686f646f6c6f6779:1711d2482cc26d539bda0dfb9e7c98c1","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static alerts are false positives caused by Markdown backticks and fenced examples. Eight command blocks are confirmed because they invoke Claude Flow through unpinned npx or a local binary. No prompt injection or malicious intent was found.","remediation":[{"issue":"Npx examples execute an unpinned package or the moving alpha tag.","severity":"medium","suggestion":"Pin an exact trusted Claude Flow version, document integrity verification, and require user approval before package execution."},{"issue":"CLI examples can cause agents to launch external processes.","severity":"medium","suggestion":"Label each command as optional and require users to review substituted arguments before execution."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":103,"line_start":103},{"file":"SKILL.md","line_end":111,"line_start":111},{"file":"SKILL.md","line_end":128,"line_start":122},{"file":"SKILL.md","line_end":130,"line_start":128},{"file":"SKILL.md","line_end":140,"line_start":130},{"file":"SKILL.md","line_end":150,"line_start":140},{"file":"SKILL.md","line_end":164,"line_start":150},{"file":"SKILL.md","line_end":182,"line_start":164},{"file":"SKILL.md","line_end":192,"line_start":182},{"file":"SKILL.md","line_end":194,"line_start":192},{"file":"SKILL.md","line_end":218,"line_start":194},{"file":"SKILL.md","line_end":228,"line_start":218},{"file":"SKILL.md","line_end":230,"line_start":228},{"file":"SKILL.md","line_end":255,"line_start":230},{"file":"SKILL.md","line_end":265,"line_start":255},{"file":"SKILL.md","line_end":267,"line_start":265},{"file":"SKILL.md","line_end":294,"line_start":267},{"file":"SKILL.md","line_end":304,"line_start":294},{"file":"SKILL.md","line_end":310,"line_start":304},{"file":"SKILL.md","line_end":335,"line_start":310},{"file":"SKILL.md","line_end":345,"line_start":335},{"file":"SKILL.md","line_end":347,"line_start":345},{"file":"SKILL.md","line_end":357,"line_start":347},{"file":"SKILL.md","line_end":371,"line_start":357},{"file":"SKILL.md","line_end":381,"line_start":371},{"file":"SKILL.md","line_end":391,"line_start":381},{"file":"SKILL.md","line_end":401,"line_start":391},{"file":"SKILL.md","line_end":411,"line_start":401},{"file":"SKILL.md","line_end":421,"line_start":411},{"file":"SKILL.md","line_end":439,"line_start":421},{"file":"SKILL.md","line_end":467,"line_start":439},{"file":"SKILL.md","line_end":473,"line_start":467},{"file":"SKILL.md","line_end":497,"line_start":473},{"file":"SKILL.md","line_end":503,"line_start":497},{"file":"SKILL.md","line_end":506,"line_start":503},{"file":"SKILL.md","line_end":516,"line_start":506},{"file":"SKILL.md","line_end":534,"line_start":516},{"file":"SKILL.md","line_end":540,"line_start":534},{"file":"SKILL.md","line_end":546,"line_start":540},{"file":"SKILL.md","line_end":552,"line_start":546},{"file":"SKILL.md","line_end":564,"line_start":552},{"file":"SKILL.md","line_end":570,"line_start":564},{"file":"SKILL.md","line_end":581,"line_start":570},{"file":"SKILL.md","line_end":587,"line_start":581},{"file":"SKILL.md","line_end":593,"line_start":587},{"file":"SKILL.md","line_end":601,"line_start":593}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":1060,"line_start":1060},{"file":"SKILL.md","line_end":1061,"line_start":1061},{"file":"SKILL.md","line_end":1062,"line_start":1062}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":497,"line_start":473}],"confidence":0.96,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":506,"line_start":503}],"confidence":0.93,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The shell example directly runs the local ./claude-flow executable with substituted mode and task values. This is intentional external process execution."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":730,"line_start":721}],"confidence":0.96,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":927,"line_start":912}],"confidence":0.96,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":943,"line_start":931}],"confidence":0.96,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":959,"line_start":947}],"confidence":0.96,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":975,"line_start":963}],"confidence":0.96,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":1086,"line_start":1071}],"confidence":0.96,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":1107,"audit_model":"codex","audited_at":"2026-07-23T19:26:48.311+00:00","created_at":"2026-07-26T00:11:35.565241+00:00","static_findings":[{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Key Modes**: `researcher`, `analyzer`, `memory-manager`","category":"external_commands","line_end":59,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Key Modes**: `architect`, `designer`, `orchestrator`","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Key Modes**: `tdd`, `coder`, `tester`","category":"external_commands","line_end":81,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Key Modes**: `reviewer`, `optimizer`, `debugger`","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Key Modes**: `workflow-manager`, `documenter`, `memory-manager`","category":"external_commands","line_end":103,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `orchestrator`","category":"external_commands","line_end":111,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":128,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":130,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `swarm-coordinator`","category":"external_commands","line_end":140,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `workflow-manager`","category":"external_commands","line_end":150,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `batch-executor`","category":"external_commands","line_end":164,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `coder`","category":"external_commands","line_end":182,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":192,"severity":"medium","line_start":182},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":194,"severity":"medium","line_start":192},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `architect`","category":"external_commands","line_end":218,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:218:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":228,"severity":"medium","line_start":218},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":230,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `tdd`","category":"external_commands","line_end":255,"severity":"medium","line_start":230},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":265,"severity":"medium","line_start":255},{"id":"external_commands:SKILL.md:265:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":267,"severity":"medium","line_start":265},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `reviewer`","category":"external_commands","line_end":294,"severity":"medium","line_start":267},{"id":"external_commands:SKILL.md:294:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":304,"severity":"medium","line_start":294},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":310,"severity":"medium","line_start":304},{"id":"external_commands:SKILL.md:310:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `researcher`","category":"external_commands","line_end":335,"severity":"medium","line_start":310},{"id":"external_commands:SKILL.md:335:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":345,"severity":"medium","line_start":335},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":347,"severity":"medium","line_start":345},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `analyzer`","category":"external_commands","line_end":357,"severity":"medium","line_start":347},{"id":"external_commands:SKILL.md:357:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `optimizer`","category":"external_commands","line_end":371,"severity":"medium","line_start":357},{"id":"external_commands:SKILL.md:371:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `designer`","category":"external_commands","line_end":381,"severity":"medium","line_start":371},{"id":"external_commands:SKILL.md:381:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `innovator`","category":"external_commands","line_end":391,"severity":"medium","line_start":381},{"id":"external_commands:SKILL.md:391:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `documenter`","category":"external_commands","line_end":401,"severity":"medium","line_start":391},{"id":"external_commands:SKILL.md:401:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `debugger`","category":"external_commands","line_end":411,"severity":"medium","line_start":401},{"id":"external_commands:SKILL.md:411:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `tester`","category":"external_commands","line_end":421,"severity":"medium","line_start":411},{"id":"external_commands:SKILL.md:421:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"#### `memory-manager`","category":"external_commands","line_end":439,"severity":"medium","line_start":421},{"id":"external_commands:SKILL.md:439:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":467,"severity":"medium","line_start":439},{"id":"external_commands:SKILL.md:467:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":473,"severity":"medium","line_start":467},{"id":"external_commands:SKILL.md:473:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":497,"severity":"medium","line_start":473},{"id":"external_commands:SKILL.md:497:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":503,"severity":"medium","line_start":497},{"id":"external_commands:SKILL.md:503:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":506,"severity":"medium","line_start":503},{"id":"external_commands:SKILL.md:506:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":516,"severity":"medium","line_start":506},{"id":"external_commands:SKILL.md:516:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":534,"severity":"medium","line_start":516},{"id":"external_commands:SKILL.md:534:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":540,"severity":"medium","line_start":534},{"id":"external_commands:SKILL.md:540:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":546,"severity":"medium","line_start":540},{"id":"external_commands:SKILL.md:546:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":552,"severity":"medium","line_start":546},{"id":"external_commands:SKILL.md:552:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":564,"severity":"medium","line_start":552},{"id":"external_commands:SKILL.md:564:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":570,"severity":"medium","line_start":564},{"id":"external_commands:SKILL.md:570:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":581,"severity":"medium","line_start":570},{"id":"external_commands:SKILL.md:581:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":587,"severity":"medium","line_start":581},{"id":"external_commands:SKILL.md:587:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":593,"severity":"medium","line_start":587},{"id":"external_commands:SKILL.md:593:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":601,"severity":"medium","line_start":593},{"id":"external_commands:SKILL.md:601:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":646,"severity":"medium","line_start":601},{"id":"external_commands:SKILL.md:646:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":650,"severity":"medium","line_start":646},{"id":"external_commands:SKILL.md:650:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":671,"severity":"medium","line_start":650},{"id":"external_commands:SKILL.md:671:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":681,"severity":"medium","line_start":671},{"id":"external_commands:SKILL.md:681:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":697,"severity":"medium","line_start":681},{"id":"external_commands:SKILL.md:697:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":703,"severity":"medium","line_start":697},{"id":"external_commands:SKILL.md:703:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":715,"severity":"medium","line_start":703},{"id":"external_commands:SKILL.md:715:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":721,"severity":"medium","line_start":715},{"id":"external_commands:SKILL.md:721:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":730,"severity":"medium","line_start":721},{"id":"external_commands:SKILL.md:730:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":756,"severity":"medium","line_start":730},{"id":"external_commands:SKILL.md:756:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":764,"severity":"medium","line_start":756},{"id":"external_commands:SKILL.md:764:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":772,"severity":"medium","line_start":764},{"id":"external_commands:SKILL.md:772:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":828,"severity":"medium","line_start":772},{"id":"external_commands:SKILL.md:828:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":832,"severity":"medium","line_start":828},{"id":"external_commands:SKILL.md:832:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":868,"severity":"medium","line_start":832},{"id":"external_commands:SKILL.md:868:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":872,"severity":"medium","line_start":868},{"id":"external_commands:SKILL.md:872:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":904,"severity":"medium","line_start":872},{"id":"external_commands:SKILL.md:904:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":912,"severity":"medium","line_start":904},{"id":"external_commands:SKILL.md:912:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":927,"severity":"medium","line_start":912},{"id":"external_commands:SKILL.md:927:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":931,"severity":"medium","line_start":927},{"id":"external_commands:SKILL.md:931:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":943,"severity":"medium","line_start":931},{"id":"external_commands:SKILL.md:943:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":947,"severity":"medium","line_start":943},{"id":"external_commands:SKILL.md:947:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":959,"severity":"medium","line_start":947},{"id":"external_commands:SKILL.md:959:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":963,"severity":"medium","line_start":959},{"id":"external_commands:SKILL.md:963:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":975,"severity":"medium","line_start":963},{"id":"external_commands:SKILL.md:975:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":983,"severity":"medium","line_start":975},{"id":"external_commands:SKILL.md:983:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":990,"severity":"medium","line_start":983},{"id":"external_commands:SKILL.md:990:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":994,"severity":"medium","line_start":990},{"id":"external_commands:SKILL.md:994:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":1004,"severity":"medium","line_start":994},{"id":"external_commands:SKILL.md:1004:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":1008,"severity":"medium","line_start":1004},{"id":"external_commands:SKILL.md:1008:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":1021,"severity":"medium","line_start":1008},{"id":"external_commands:SKILL.md:1021:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":1025,"severity":"medium","line_start":1021},{"id":"external_commands:SKILL.md:1025:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":1043,"severity":"medium","line_start":1025},{"id":"external_commands:SKILL.md:1043:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":1071,"severity":"medium","line_start":1043},{"id":"external_commands:SKILL.md:1071:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":1086,"severity":"medium","line_start":1071},{"id":"external_commands:SKILL.md:1086:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":1090,"severity":"medium","line_start":1086},{"id":"external_commands:SKILL.md:1090:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":1102,"severity":"medium","line_start":1090},{"id":"network:SKILL.md:1060:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Documentation**: https://github.com/ruvnet/claude-flow","category":"network","line_end":1060,"severity":"low","line_start":1060},{"id":"network:SKILL.md:1061:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Issues**: https://github.com/ruvnet/claude-flow/issues","category":"network","line_end":1061,"severity":"low","line_start":1061},{"id":"network:SKILL.md:1062:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **NPM Package**: https://www.npmjs.com/package/claude-flow","category":"network","line_end":1062,"severity":"low","line_start":1062},{"id":"blocker:SKILL.md:729:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"npx claude-flow@alpha hooks post-task --task-id \"task-123\"","category":"blocker","line_end":729,"severity":"low","line_start":729},{"id":"blocker:SKILL.md:77:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- Make tests pass","category":"blocker","line_end":78,"severity":"low","line_start":77}],"finding_verdicts":[{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:218:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:265:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:294:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:310:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:335:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:357:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:371:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:381:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:391:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:401:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:411:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:421:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:439:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:467:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:473:ruby-shell-backtick-execution","reason":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill.","verdict":"confirmed","confidence":0.96},{"id":"external_commands:SKILL.md:497:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:503:ruby-shell-backtick-execution","reason":"The shell example directly runs the local ./claude-flow executable with substituted mode and task values. This is intentional external process execution.","verdict":"confirmed","confidence":0.93},{"id":"external_commands:SKILL.md:506:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:516:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:534:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:540:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:546:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:552:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:564:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:570:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:581:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:587:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:593:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:601:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:646:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:650:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:671:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:681:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:697:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:703:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:715:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:721:ruby-shell-backtick-execution","reason":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill.","verdict":"confirmed","confidence":0.96},{"id":"external_commands:SKILL.md:730:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:756:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:764:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:772:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:828:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:832:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:868:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:872:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:904:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:912:ruby-shell-backtick-execution","reason":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill.","verdict":"confirmed","confidence":0.96},{"id":"external_commands:SKILL.md:927:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:931:ruby-shell-backtick-execution","reason":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill.","verdict":"confirmed","confidence":0.96},{"id":"external_commands:SKILL.md:943:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:947:ruby-shell-backtick-execution","reason":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill.","verdict":"confirmed","confidence":0.96},{"id":"external_commands:SKILL.md:959:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:963:ruby-shell-backtick-execution","reason":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill.","verdict":"confirmed","confidence":0.96},{"id":"external_commands:SKILL.md:975:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:983:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:990:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:994:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:1004:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:1008:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:1021:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:1025:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:1043:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:1071:ruby-shell-backtick-execution","reason":"The shell block invokes claude-flow through npx without an exact package version. Npx can download and execute dependency code outside the skill.","verdict":"confirmed","confidence":0.96},{"id":"external_commands:SKILL.md:1086:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:1090:ruby-shell-backtick-execution","reason":"The reported token is Markdown formatting around a mode name, heading, fenced example, or file tree. It does not use Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:1060:hardcoded-url","reason":"The URL is a visible support link to the project GitHub or NPM page. The Markdown text does not initiate a request or transmit data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:1061:hardcoded-url","reason":"The URL is a visible support link to the project GitHub or NPM page. The Markdown text does not initiate a request or transmit data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:1062:hardcoded-url","reason":"The URL is a visible support link to the project GitHub or NPM page. The Markdown text does not initiate a request or transmit data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:729:system-reconnaissance","reason":"The line documents a post-task hook with a fixed example task identifier. It does not collect system information or enumerate the environment.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:77:network-reconnaissance","reason":"The text is the development step \"Make tests pass.\" It performs no network discovery and contains no networking operation.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","subject_content_hash":"eb858ef5f83ea9bdd6c2811df4afc869a2767bc2e374a3c5a9258d449fe193dc","subject_tree_hash":"4c1d254fb42d1b2a37ff8afe8b9cb5d2a2e956cad0aac96406c965b89e07c98e","subject_plugin_path":"skills/ruvnet/sparc-methodology","audit_payload_hash":"1711d2482cc26d539bda0dfb9e7c98c1","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","contentHash":"eb858ef5f83ea9bdd6c2811df4afc869a2767bc2e374a3c5a9258d449fe193dc","treeHash":"4c1d254fb42d1b2a37ff8afe8b9cb5d2a2e956cad0aac96406c965b89e07c98e","pluginPath":"skills/ruvnet/sparc-methodology","auditPayloadHash":"1711d2482cc26d539bda0dfb9e7c98c1"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/ruvnet-sparc-methodology/audits/9/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":8,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}