{"data":{"skill":{"slug":"samlfair-vowel","name":"vowel","icon":"📦","repo":"https://github.com/samlfair/vowel/tree/37b246f4d13cb7c02ea9b08f1e07a39a1f300cd3/skills/vowel","status":"approved","author":"samlfair","authorVersion":null,"skillstoreRevision":1,"license":null},"licenseCorrection":null,"audit":{"id":"920f2768-ea67-407e-b8e3-9e7b231b1480","skill_id":"2966b59e-6674-4b29-93a7-b435a36c36ab","version":1,"content_hash":"v3:c993c6abcbffafea2683d7748b53b3dfaf438415:651ad52155927de9bd563e16a377d43abcc0de837a9bd27fb756c97a7be65a4a:192ae62d1ce711e341009aa6633701e6207c1cf32ae5d6358be89281fc4567d1:736b696c6c732f73616d6c666169722f766f77656c:b2fdd8913205da3610223b4e722d541d","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 41 static findings are false positives involving Markdown formatting, documented Vowel commands, documentation URLs, and a relative page link. No evidence found of prompt injection, credential theft, or unauthorized data transfer in SKILL.md. The Vowel package and linked documentation were not audited.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":48,"line_start":36},{"file":"SKILL.md","line_end":50,"line_start":48},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":53,"line_start":51},{"file":"SKILL.md","line_end":55,"line_start":53},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":66,"line_start":66},{"file":"SKILL.md","line_end":71,"line_start":67},{"file":"SKILL.md","line_end":73,"line_start":71},{"file":"SKILL.md","line_end":79,"line_start":73},{"file":"SKILL.md","line_end":81,"line_start":79},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":87,"line_start":83},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":89,"line_start":89}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":95,"line_start":95},{"file":"SKILL.md","line_end":96,"line_start":96},{"file":"SKILL.md","line_end":97,"line_start":97}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":61,"line_start":61}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":98,"audit_model":"codex","audited_at":"2026-11-06T16:22:57.803+00:00","created_at":"2026-11-09T15:35:54.603442+00:00","static_findings":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Vowel turns a folder of markdown files into a website. Each `.md` file is a page, each folder is a s","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Vowel needs Node.js 26 or later; check with `node --version`. Run it with `npx vowel@latest`, or `vo","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`vowel check`** builds the site once and lists every problem as `file:line:column: message`, the","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`vowel` on its own** builds the site, serves a preview at `http://localhost:8000` and rebuilds a","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`vowel export <folder>`** builds the site into a new or empty folder outside the project.","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`vowel --command deploy`** builds the site and deploys it to Cloudflare Pages. **Ask before you ","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The first run in a terminal offers a setup wizard. You have no terminal, so it is skipped: write `se","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `home.md` is the homepage. `about.md` is `/about`; `blog/First Post.md` is `/blog/first-post` (low","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `blog.md` beside `blog/` is the section's index page. Without one, Vowel generates a page listing ","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `settings.md` holds settings for its folder and every folder below it. It is not a page.","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- A file or folder whose name starts with `$` is not published, but pages can use it.","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":48,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":50,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Title:** the `#` heading on the first line; without one, the filename. Only the first `#` is the","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Date:** a line that is only a date, near the top, or a `YYYY-MM-DD` filename prefix. A dated pag","category":"external_commands","line_end":53,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Description:** a paragraph followed by `---`, with a blank line between them; without one, the f","category":"external_commands","line_end":55,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Frontmatter sets the same properties explicitly, and a few more: `title`, `date`, `description`, `im","category":"external_commands","line_end":55,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Links to pages** by file: `[text](./post.md)`, `../about.md`, `/blog/post.md`, or by URL: `/abou","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Wikilinks:** `[[Hello World]]` finds `hello world.md` anywhere, by name and ignoring case; `[[No","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Listings:** a path alone on a line. `/blog/*` lists a folder's pages as cards, newest first, and","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Hashtags:** `#design` tags the page, and Vowel makes a page per tag at `/tags/design`.","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Alerts:** `> [!NOTE]`, `> [!WARNING]` or any word, with an optional title after it.","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Emoji and icons:** `:tada:` is 🎉; `:icons/github:` shows `icons/github.svg` from the project.","category":"external_commands","line_end":66,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Highlights:** `==text==`.","category":"external_commands","line_end":71,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The root `settings.md` holds the site's settings as frontmatter:","category":"external_commands","line_end":73,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":79,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":81,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The ones you'll use most: `name` (root only), `domain` (needed for the feed, the sitemap and absolut","category":"external_commands","line_end":81,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"A project's `styles.css` is linked on every page and overrides the theme. Change the look there, not","category":"external_commands","line_end":87,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Secret pages aren't private.** A `##` in a file or folder name (`notes##purple-moon.md`) hides t","category":"external_commands","line_end":87,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Settings that only work at the root** (`name`, `markdown_mirror`) do nothing in a subfolder's `s","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **A folder's name in menus** comes from its index page's title or `breadcrumb`, not from `settings","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"network:SKILL.md:8:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Vowel turns a folder of markdown files into a website. Each `.md` file is a page, each folder is a s","category":"network","line_end":8,"severity":"low","line_start":8},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **`vowel` on its own** builds the site, serves a preview at `http://localhost:8000` and rebuilds a","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:SKILL.md:81:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"The ones you'll use most: `name` (root only), `domain` (needed for the feed, the sitemap and absolut","category":"network","line_end":81,"severity":"low","line_start":81},{"id":"network:SKILL.md:93:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Files and pages: https://vowel.cc/docs/guides/files.md","category":"network","line_end":93,"severity":"low","line_start":93},{"id":"network:SKILL.md:94:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Markdown: https://vowel.cc/docs/guides/markdown.md","category":"network","line_end":94,"severity":"low","line_start":94},{"id":"network:SKILL.md:95:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Settings: https://vowel.cc/docs/guides/site.md","category":"network","line_end":95,"severity":"low","line_start":95},{"id":"network:SKILL.md:96:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Design and themes: https://vowel.cc/docs/guides/design.md","category":"network","line_end":96,"severity":"low","line_start":96},{"id":"network:SKILL.md:97:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- The command line: https://vowel.cc/docs/references/vowel.md","category":"network","line_end":97,"severity":"low","line_start":97},{"id":"filesystem:SKILL.md:61:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- **Links to pages** by file: `[text](./post.md)`, `../about.md`, `/blog/post.md`, or by URL: `/abou","category":"filesystem","line_end":61,"severity":"high","line_start":61}],"finding_verdicts":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","reason":"Backticks format the .md extension and a documentation URL suffix in prose. There is no Ruby code or shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"Inline code documents a Node version check and ordinary Vowel startup commands, including npx. No shell interpolation or injection payload appears; dependency integrity remains outside this file review.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"The documented vowel check command validates the site and reports errors. Its backticks are Markdown formatting, with no dangerous arguments or command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"This documents the intended local preview command and its localhost address. The text explicitly warns that it persists and requires background execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"This documents an export command targeting a new or empty folder. No destructive flags, injected arguments, or shell substitution are present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"Cloudflare Pages deployment is an intended feature, and the instruction explicitly requires asking before publication. The backticks do not represent covert execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"Backticks identify settings.md and home.md as files to create during setup. They are not executable expressions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The inline spans show page filenames and their resulting site routes. No command is executed by this Markdown.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks identify a section index file and its adjacent folder. This is a naming convention, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The inline settings.md filename explains configuration inheritance. There is no executable syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The dollar sign is a documented filename prefix for unpublished resources. It is not shell expansion or a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The fenced Markdown block contains an example article with a title, date, image, description, and tag. Its fence is not shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"This closes the example Markdown fence and precedes inline heading syntax. Neither element executes code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"Backticks display heading markers used for page titles and subheadings. These are literal Markdown tokens.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The span documents a date filename prefix and page metadata conventions. There is no shell or Ruby evaluation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The backticks show a Markdown separator and nearby metadata field names. They are documentation, not executable instructions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"Inline spans name frontmatter properties, publication states, and the validation command. No command substitution or injection is shown.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"Backticks enclose Markdown links and site paths as examples. No shell execution context exists.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The inline examples demonstrate wikilink syntax, including headings and aliases. They contain no executable shell statements.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The path patterns and query parameters describe page listings in Markdown. They are not shell globs executed by a process.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The backticks display a hashtag and its generated tag route. This is content syntax rather than command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The inline spans illustrate Markdown alert markers. No shell redirection or execution context exists.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The examples show emoji notation and a local SVG icon path. They do not invoke commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"This range contains inline highlight syntax and a settings filename. The matched backticks are Markdown formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The text introduces settings.md and opens a YAML example fence. Neither element is a shell expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The fenced YAML example sets a site name, example domain, and logo filename. It contains configuration data, not executable commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The range closes a YAML fence and lists configuration keys. Its backticks do not trigger command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"Inline spans name supported settings, including domain and deployment configuration. They contain no shell invocation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"This range discusses a stylesheet filename and warns against treating hashed URLs as private. No executable shell content appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The inline filename and marker explain hashed page URLs. The instruction explicitly prohibits using this mechanism for sensitive content.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"Backticks identify root-only settings, a configuration filename, and a validation command. This is normal configuration guidance.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The inline examples explain folder menu labels and index filenames. There is no shell execution.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:8:hardcoded-url","reason":"The vowel.cc URL points to product documentation and explains Markdown copies. No data submission or secret-bearing request is instructed.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:17:hardcoded-url","reason":"The URL is the documented localhost preview address, not an external recipient. No exfiltration behavior is described.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:81:hardcoded-url","reason":"The hardcoded URL links to Vowel settings documentation. It contains no embedded credentials or instruction to transmit project data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:93:hardcoded-url","reason":"This is a Vowel documentation reference for files and pages. No upload operation or sensitive request parameters are present.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:94:hardcoded-url","reason":"This is a product documentation link for Markdown syntax. No data transfer beyond potential documentation retrieval is requested.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:95:hardcoded-url","reason":"This URL references Vowel site settings documentation. No credential access, upload, or unrelated endpoint appears.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:96:hardcoded-url","reason":"The URL is a design and themes documentation reference. It does not instruct transmission of files or secrets.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:97:hardcoded-url","reason":"The link points to Vowel command-line documentation. No exfiltration destination or sensitive payload is specified.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:61:path-traversal-sequence","reason":"The parent-directory segment is an example Markdown link to a page. No filesystem API, untrusted path processing, or access outside the project is demonstrated.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"c993c6abcbffafea2683d7748b53b3dfaf438415","subject_content_hash":"651ad52155927de9bd563e16a377d43abcc0de837a9bd27fb756c97a7be65a4a","subject_tree_hash":"192ae62d1ce711e341009aa6633701e6207c1cf32ae5d6358be89281fc4567d1","subject_plugin_path":"skills/samlfair/vowel","audit_payload_hash":"b2fdd8913205da3610223b4e722d541d","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"c993c6abcbffafea2683d7748b53b3dfaf438415","contentHash":"651ad52155927de9bd563e16a377d43abcc0de837a9bd27fb756c97a7be65a4a","treeHash":"192ae62d1ce711e341009aa6633701e6207c1cf32ae5d6358be89281fc4567d1","pluginPath":"skills/samlfair/vowel","auditPayloadHash":"b2fdd8913205da3610223b4e722d541d"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/samlfair-vowel/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}