{"data":{"skill":{"slug":"samber-developer-tutorial","name":"developer-tutorial","icon":"📦","repo":"https://github.com/samber/developer-relations-skills/tree/b8cf857a6069b89252445c82a36fcb9491fd6b20/skills/developer-tutorial","status":"approved","author":"samber","authorVersion":"1.0.1","skillstoreRevision":1},"audit":{"id":"57307f6f-d9d2-4616-a4d4-3b72007e12cc","skill_id":"5e89a9dd-a7b2-4f60-bed6-6ba73f7f58c8","version":1,"content_hash":"v3:822e3dba9741acaaf6f314f359544e822a82edee:087a3c49d0ce562ac71c118c1639ae5029176f354d400818334d0c8a5b84a580:5f931d9043facddb459673a62ea6bc3d9d8fa181b037368fc8aba0947919adf6:736b696c6c732f73616d6265722f646576656c6f7065722d7475746f7269616c:ce0de5862ebccc615d0a4d26dbf4c689","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 20 static findings are false positives involving documentation formatting, evaluation text, fixed local imports, or educational terminology. No evidence found of credential theft, data exfiltration, malicious execution, or prompt injection targeting the audit. The skill includes ordinary task-context persistence and tutorial command verification, not a bundled executable tool.","remediation":[],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"evals/evals.json","line_end":20,"line_start":20},{"file":"evals/evals.json","line_end":35,"line_start":35},{"file":"references/worked-examples.md","line_end":68,"line_start":68}]},{"factor":"external_commands","evidence":[{"file":"references/tutorial-outline-template.md","line_end":87,"line_start":61},{"file":"references/tutorial-outline-template.md","line_end":115,"line_start":87},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":117,"line_start":117},{"file":"SKILL.md","line_end":231,"line_start":231},{"file":"SKILL.md","line_end":233,"line_start":233},{"file":"SKILL.md","line_end":252,"line_start":252}]},{"factor":"scripts","evidence":[{"file":"references/worked-examples.md","line_end":45,"line_start":45}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":6,"total_lines":1443,"audit_model":"codex","audited_at":"2026-10-25T12:55:19.028+00:00","created_at":"2026-10-25T13:19:07.857184+00:00","static_findings":[{"id":"filesystem:evals/evals.json:20:path-traversal-sequence","file":"evals/evals.json","pattern":"Path traversal sequence","snippet":"\"Produces no outline section shaped as \\\"if you use X... if you use Y...\\\" on the main path.\",","category":"filesystem","line_end":20,"severity":"high","line_start":20},{"id":"filesystem:evals/evals.json:35:path-traversal-sequence","file":"evals/evals.json","pattern":"Path traversal sequence","snippet":"\"Uses the Good Docs Project phrasing \\\"By the end of this tutorial, you'll be able to...\\\" for the o","category":"filesystem","line_end":35,"severity":"high","line_start":35},{"id":"blocker:evals/evals.json:67:system-reconnaissance","file":"evals/evals.json","pattern":"System reconnaissance","snippet":"\"prompt\": \"Planning the tutorial for Brightwake's webhooks SDK: \\\"receive and verify a webhook\\\". Sc","category":"blocker","line_end":67,"severity":"low","line_start":67},{"id":"blocker:evals/evals.json:314:system-reconnaissance","file":"evals/evals.json","pattern":"System reconnaissance","snippet":"\"query\": \"Write the teaching page for our new streaming API, aimed at people who already did the qui","category":"blocker","line_end":314,"severity":"low","line_start":314},{"id":"blocker:references/published-findings.md:24:system-reconnaissance","file":"references/published-findings.md","pattern":"System reconnaissance","snippet":"| At most seven primary steps                                                                       ","category":"blocker","line_end":24,"severity":"low","line_start":24},{"id":"external_commands:references/tutorial-outline-template.md:61:ruby-shell-backtick-execution","file":"references/tutorial-outline-template.md","pattern":"Ruby/shell backtick execution","snippet":"| <tool>      | <min>   | `<command>` |","category":"external_commands","line_end":87,"severity":"medium","line_start":61},{"id":"external_commands:references/tutorial-outline-template.md:87:ruby-shell-backtick-execution","file":"references/tutorial-outline-template.md","pattern":"Ruby/shell backtick execution","snippet":"You've now <capability>. If the output differs, see <troubleshooting link> or reset to `<branch/tag/","category":"external_commands","line_end":115,"severity":"medium","line_start":87},{"id":"blocker:references/tutorial-outline-template.md:26:system-reconnaissance","file":"references/tutorial-outline-template.md","pattern":"System reconnaissance","snippet":"- At most seven primary steps (sourced: \"avoid writing procedures that are more than seven primary s","category":"blocker","line_end":26,"severity":"low","line_start":26},{"id":"blocker:references/tutorial-outline-template.md:125:system-reconnaissance","file":"references/tutorial-outline-template.md","pattern":"System reconnaissance","snippet":"**Before you begin.** Two lists, never one: software with a check command, and knowledge with a link","category":"blocker","line_end":125,"severity":"low","line_start":125},{"id":"blocker:references/verification-protocol.md:32:system-reconnaissance","file":"references/verification-protocol.md","pattern":"System reconnaissance","snippet":"| Concept gap         | The learner did the step but couldn't say what it did           | The step i","category":"blocker","line_end":32,"severity":"low","line_start":32},{"id":"scripts:references/worked-examples.md:45:dynamic-import-expression","file":"references/worked-examples.md","pattern":"Dynamic import() expression","snippet":"> node -e \"import('./db.js').then(({sql}) => sql\\`select 1 as ok\\`).then(console.log)\"","category":"scripts","line_end":45,"severity":"medium","line_start":45},{"id":"filesystem:references/worked-examples.md:68:path-traversal-sequence","file":"references/worked-examples.md","pattern":"Path traversal sequence","snippet":"> import { sql } from \"../db.js\";","category":"filesystem","line_end":68,"severity":"high","line_start":68},{"id":"blocker:references/worked-examples.md:180:system-reconnaissance","file":"references/worked-examples.md","pattern":"System reconnaissance","snippet":"> I read through the tutorial. Overall it's solid but a bit long, and the tone could be friendlier. ","category":"blocker","line_end":180,"severity":"low","line_start":180},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Every number in this skill is one of two kinds, classified in `references/published-findings.md`:","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Memory: Store a few info about the current task or project context. When memory lives in a file, u","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"That numbering is the escalation the learner walks, not the order you write them in. When you can on","category":"external_commands","line_end":117,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Greenfield.** Follow `references/tutorial-outline-template.md` section by section and hand back a ","category":"external_commands","line_end":231,"severity":"medium","line_start":231},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Audit.** Return a table, not prose: step number, what breaks, which of the four event kinds it is ","category":"external_commands","line_end":233,"severity":"medium","line_start":233},{"id":"external_commands:SKILL.md:252:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| A threshold from this skill quoted to the team as an industry standard    | Check `references/publ","category":"external_commands","line_end":252,"severity":"medium","line_start":252},{"id":"blocker:SKILL.md:189:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"5. The learner can perform the objective once more, unaided, on a variation you did not walk them th","category":"blocker","line_end":189,"severity":"low","line_start":189}],"finding_verdicts":[{"id":"filesystem:evals/evals.json:20:path-traversal-sequence","reason":"This evaluation expectation quotes alternative tutorial wording with an ellipsis. It contains no filesystem operation or path traversal.","verdict":"false_positive","confidence":1},{"id":"filesystem:evals/evals.json:35:path-traversal-sequence","reason":"The matched text is a quoted learning-objective phrase ending with an ellipsis. It is evaluation data, not a path or file access.","verdict":"false_positive","confidence":1},{"id":"blocker:evals/evals.json:67:system-reconnaissance","reason":"This test prompt describes tutorial scope, staffing, and a launch deadline. It requests an educational plan, not host inspection or system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:evals/evals.json:314:system-reconnaissance","reason":"This trigger-query fixture asks for a streaming API teaching page. No command, host enumeration, or reconnaissance instruction appears.","verdict":"false_positive","confidence":1},{"id":"blocker:references/published-findings.md:24:system-reconnaissance","reason":"The table row cites a seven-primary-step writing guideline from the Good Docs Project. It does not inspect a system.","verdict":"false_positive","confidence":1},{"id":"external_commands:references/tutorial-outline-template.md:61:ruby-shell-backtick-execution","reason":"Backticks format a prerequisite-check placeholder inside a Markdown tutorial skeleton. They are not Ruby execution or shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:references/tutorial-outline-template.md:87:ruby-shell-backtick-execution","reason":"The backticks mark a branch, tag, or seed-command placeholder in documentation. The surrounding Markdown skeleton contains no executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"blocker:references/tutorial-outline-template.md:26:system-reconnaissance","reason":"This line limits tutorial length to seven primary steps. It is a writing guideline, not a system query.","verdict":"false_positive","confidence":1},{"id":"blocker:references/tutorial-outline-template.md:125:system-reconnaissance","reason":"This section asks authors to list software checks and prerequisite knowledge. These checks support tutorial setup and do not request secret collection or host enumeration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/verification-protocol.md:32:system-reconnaissance","reason":"The concept-gap row classifies learner comprehension problems during usability testing. It contains no reconnaissance behavior.","verdict":"false_positive","confidence":1},{"id":"scripts:references/worked-examples.md:45:dynamic-import-expression","reason":"The sample imports a fixed local database module defined immediately above and executes a constant connection-check query. No attacker-controlled import or remote payload appears.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:references/worked-examples.md:68:path-traversal-sequence","reason":"The parent-relative import resolves the tutorial database module from the explicitly named routes subdirectory. This is normal module organization, not user-controlled traversal.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/worked-examples.md:180:system-reconnaissance","reason":"This quoted negative example gives vague editorial feedback on a tutorial. It is explicitly criticized as an inadequate audit, not used for reconnaissance.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Backticks identify the published-findings reference document in Markdown. No shell or Ruby execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Backticks identify an optional task-context memory filename, not an executable expression. The instruction concerns ordinary project notes and specifies no secret collection or external destination.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"The inline backticks format an ordering of educational hint types. The comparison symbols express authoring priorities and are not shell operators.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","reason":"The backticks format a local template reference. Nearby command-verification guidance supports tutorial accuracy and explicitly requires disclosing outputs that could not be verified.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","reason":"The backticks identify the verification-protocol reference in an audit-output instruction. They do not invoke a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:252:ruby-shell-backtick-execution","reason":"A Markdown table links to the source-classification reference using inline code formatting. There is no executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:189:system-reconnaissance","reason":"The acceptance criterion asks learners to repeat a skill independently on a variation. It tests learning transfer, not system information.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"822e3dba9741acaaf6f314f359544e822a82edee","subject_content_hash":"087a3c49d0ce562ac71c118c1639ae5029176f354d400818334d0c8a5b84a580","subject_tree_hash":"5f931d9043facddb459673a62ea6bc3d9d8fa181b037368fc8aba0947919adf6","subject_plugin_path":"skills/samber/developer-tutorial","audit_payload_hash":"ce0de5862ebccc615d0a4d26dbf4c689","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"822e3dba9741acaaf6f314f359544e822a82edee","contentHash":"087a3c49d0ce562ac71c118c1639ae5029176f354d400818334d0c8a5b84a580","treeHash":"5f931d9043facddb459673a62ea6bc3d9d8fa181b037368fc8aba0947919adf6","pluginPath":"skills/samber/developer-tutorial","auditPayloadHash":"ce0de5862ebccc615d0a4d26dbf4c689"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/samber-developer-tutorial/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}