{"data":{"skill":{"slug":"shubhamsaboo-code-reviewer","name":"code-reviewer","icon":"📦","repo":"https://github.com/shubhamsaboo/awesome-llm-apps/tree/main/awesome_agent_skills/code-reviewer","status":"approved","author":"shubhamsaboo","authorVersion":"1.0","skillstoreRevision":1},"audit":{"id":"35ca46f2-cda3-476c-89c2-baae60bc1eab","skill_id":"467a06ff-e2b8-430d-94e2-9b13e84dcad3","version":3,"content_hash":"v3:3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88:c64ff6074b9c114a6d6e42bb1c8e9b28ce34e36fd5bc5f1dde11549f454b0d60:605c745968e0ed3c34dc284e4ea940a802e2a458605242a72b87552369d09dd9:736b696c6c732f7368756268616d7361626f6f2f636f64652d7265766965776572:f2ebd54af68ef41f4b9278826e8c5620","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Static analysis flagged scripts, network calls, command execution, and keylogger terms, but review found they are educational examples inside code review guidance. No evidence found of active execution, data exfiltration, prompt injection, or malicious intent in the skill files.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"AGENTS.md","line_end":76,"line_start":76},{"file":"AGENTS.md","line_end":87,"line_start":87},{"file":"rules/security-xss-prevention.md","line_end":181,"line_start":181},{"file":"rules/security-xss-prevention.md","line_end":34,"line_start":34},{"file":"rules/security-xss-prevention.md","line_end":78,"line_start":78},{"file":"rules/security-xss-prevention.md","line_end":156,"line_start":156}]},{"factor":"external_commands","evidence":[{"file":"AGENTS.md","line_end":266,"line_start":265},{"file":"AGENTS.md","line_end":272,"line_start":266},{"file":"AGENTS.md","line_end":273,"line_start":272},{"file":"AGENTS.md","line_end":275,"line_start":273},{"file":"AGENTS.md","line_end":284,"line_start":275},{"file":"rules/correctness-error-handling.md","line_end":117,"line_start":107},{"file":"rules/correctness-error-handling.md","line_end":133,"line_start":124},{"file":"rules/correctness-error-handling.md","line_end":138,"line_start":133},{"file":"rules/correctness-error-handling.md","line_end":140,"line_start":138},{"file":"rules/correctness-error-handling.md","line_end":147,"line_start":140},{"file":"rules/correctness-error-handling.md","line_end":153,"line_start":147},{"file":"rules/correctness-error-handling.md","line_end":169,"line_start":153},{"file":"rules/correctness-error-handling.md","line_end":196,"line_start":184},{"file":"rules/performance-n-plus-one.md","line_end":52,"line_start":49},{"file":"rules/performance-n-plus-one.md","line_end":106,"line_start":104},{"file":"rules/security-xss-prevention.md","line_end":38,"line_start":37},{"file":"rules/security-xss-prevention.md","line_end":125,"line_start":119},{"file":"rules/security-xss-prevention.md","line_end":127,"line_start":125},{"file":"rules/security-xss-prevention.md","line_end":150,"line_start":139},{"file":"rules/security-xss-prevention.md","line_end":160,"line_start":156},{"file":"rules/security-xss-prevention.md","line_end":161,"line_start":160}]},{"factor":"network","evidence":[{"file":"rules/correctness-error-handling.md","line_end":107,"line_start":107},{"file":"rules/correctness-error-handling.md","line_end":133,"line_start":133},{"file":"rules/correctness-error-handling.md","line_end":73,"line_start":73},{"file":"rules/correctness-error-handling.md","line_end":76,"line_start":76},{"file":"rules/correctness-error-handling.md","line_end":81,"line_start":81},{"file":"rules/security-xss-prevention.md","line_end":42,"line_start":42},{"file":"rules/security-xss-prevention.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":3,"line_start":3}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":8,"total_lines":1474,"audit_model":"codex","audited_at":"2026-07-09T08:31:39.56+00:00","created_at":"2026-07-17T19:33:48.902363+00:00","static_findings":[{"id":"scripts:AGENTS.md:76:innerhtml-assignment-xss-risk","file":"AGENTS.md","pattern":"innerHTML assignment (XSS risk)","snippet":"document.getElementById('username').innerHTML = userInput;","category":"scripts","line_end":76,"severity":"medium","line_start":76},{"id":"scripts:AGENTS.md:87:innerhtml-assignment-xss-risk","file":"AGENTS.md","pattern":"innerHTML assignment (XSS risk)","snippet":"element.innerHTML = DOMPurify.sanitize(userHtml);","category":"scripts","line_end":87,"severity":"medium","line_start":87},{"id":"external_commands:AGENTS.md:265:ruby-shell-backtick-execution","file":"AGENTS.md","pattern":"Ruby/shell backtick execution","snippet":"### CRITICAL: SQL Injection in `get_user()`","category":"external_commands","line_end":266,"severity":"medium","line_start":265},{"id":"external_commands:AGENTS.md:266:ruby-shell-backtick-execution","file":"AGENTS.md","pattern":"Ruby/shell backtick execution","snippet":"**File:** `api/users.py:45`","category":"external_commands","line_end":272,"severity":"medium","line_start":266},{"id":"external_commands:AGENTS.md:272:ruby-shell-backtick-execution","file":"AGENTS.md","pattern":"Ruby/shell backtick execution","snippet":"### HIGH: N+1 Query in `list_posts()`","category":"external_commands","line_end":273,"severity":"medium","line_start":272},{"id":"external_commands:AGENTS.md:273:ruby-shell-backtick-execution","file":"AGENTS.md","pattern":"Ruby/shell backtick execution","snippet":"**File:** `views/posts.py:23`","category":"external_commands","line_end":275,"severity":"medium","line_start":273},{"id":"external_commands:AGENTS.md:275:ruby-shell-backtick-execution","file":"AGENTS.md","pattern":"Ruby/shell backtick execution","snippet":"**Fix:** Add `.select_related('author')`","category":"external_commands","line_end":284,"severity":"medium","line_start":275},{"id":"blocker:AGENTS.md:14:system-reconnaissance","file":"AGENTS.md","pattern":"System reconnaissance","snippet":"3. [Avoid N+1 Query Problem](#avoid-n1-query-problem)","category":"blocker","line_end":14,"severity":"low","line_start":14},{"id":"blocker:AGENTS.md:45:system-reconnaissance","file":"AGENTS.md","pattern":"System reconnaissance","snippet":"query = f\"SELECT * FROM users WHERE id = {user_id}\"","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"blocker:AGENTS.md:57:system-reconnaissance","file":"AGENTS.md","pattern":"System reconnaissance","snippet":"query = \"SELECT * FROM users WHERE id = ?\"","category":"blocker","line_end":57,"severity":"low","line_start":57},{"id":"blocker:AGENTS.md:96:system-reconnaissance","file":"AGENTS.md","pattern":"System reconnaissance","snippet":"### Avoid N+1 Query Problem","category":"blocker","line_end":96,"severity":"low","line_start":96},{"id":"blocker:AGENTS.md:147:system-reconnaissance","file":"AGENTS.md","pattern":"System reconnaissance","snippet":"logger.error(f\"Invalid JSON in config file: {e}\")","category":"blocker","line_end":147,"severity":"low","line_start":147},{"id":"blocker:AGENTS.md:164:system-reconnaissance","file":"AGENTS.md","pattern":"System reconnaissance","snippet":"Choose descriptive, intention-revealing names. Avoid single letters (except loop counters), abbrevia","category":"blocker","line_end":164,"severity":"low","line_start":164},{"id":"external_commands:rules/correctness-error-handling.md:107:ruby-shell-backtick-execution","file":"rules/correctness-error-handling.md","pattern":"Ruby/shell backtick execution","snippet":"const response = await fetch(`/api/users/${id}`);","category":"external_commands","line_end":117,"severity":"medium","line_start":107},{"id":"external_commands:rules/correctness-error-handling.md:124:ruby-shell-backtick-execution","file":"rules/correctness-error-handling.md","pattern":"Ruby/shell backtick execution","snippet":"super(`User ${userId} not found`);","category":"external_commands","line_end":133,"severity":"medium","line_start":124},{"id":"external_commands:rules/correctness-error-handling.md:133:ruby-shell-backtick-execution","file":"rules/correctness-error-handling.md","pattern":"Ruby/shell backtick execution","snippet":"response = await fetch(`/api/users/${id}`, {","category":"external_commands","line_end":138,"severity":"medium","line_start":133},{"id":"external_commands:rules/correctness-error-handling.md:138:ruby-shell-backtick-execution","file":"rules/correctness-error-handling.md","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`Timeout fetching user ${id}`);","category":"external_commands","line_end":140,"severity":"medium","line_start":138},{"id":"external_commands:rules/correctness-error-handling.md:140:ruby-shell-backtick-execution","file":"rules/correctness-error-handling.md","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`Network error fetching user ${id}: ${error}`);","category":"external_commands","line_end":147,"severity":"medium","line_start":140},{"id":"external_commands:rules/correctness-error-handling.md:147:ruby-shell-backtick-execution","file":"rules/correctness-error-handling.md","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`HTTP ${response.status} fetching user ${id}`);","category":"external_commands","line_end":153,"severity":"medium","line_start":147},{"id":"external_commands:rules/correctness-error-handling.md:153:ruby-shell-backtick-execution","file":"rules/correctness-error-handling.md","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`Invalid JSON response for user ${id}`);","category":"external_commands","line_end":169,"severity":"medium","line_start":153},{"id":"external_commands:rules/correctness-error-handling.md:184:ruby-shell-backtick-execution","file":"rules/correctness-error-handling.md","pattern":"Ruby/shell backtick execution","snippet":"return { ok: false, error: new Error(`Invalid config: ${error}`) };","category":"external_commands","line_end":196,"severity":"medium","line_start":184},{"id":"network:rules/correctness-error-handling.md:107:fetch-api-call","file":"rules/correctness-error-handling.md","pattern":"Fetch API call","snippet":"const response = await fetch(`/api/users/${id}`);","category":"network","line_end":107,"severity":"low","line_start":107},{"id":"network:rules/correctness-error-handling.md:133:fetch-api-call","file":"rules/correctness-error-handling.md","pattern":"Fetch API call","snippet":"response = await fetch(`/api/users/${id}`, {","category":"network","line_end":133,"severity":"low","line_start":133},{"id":"network:rules/correctness-error-handling.md:73:python-http-libraries","file":"rules/correctness-error-handling.md","pattern":"Python HTTP libraries","snippet":"response = requests.get(f\"{API_URL}/users/{user_id}\", timeout=5)","category":"network","line_end":73,"severity":"low","line_start":73},{"id":"network:rules/correctness-error-handling.md:76:python-http-libraries","file":"rules/correctness-error-handling.md","pattern":"Python HTTP libraries","snippet":"except requests.Timeout:","category":"network","line_end":76,"severity":"low","line_start":76},{"id":"network:rules/correctness-error-handling.md:81:python-http-libraries","file":"rules/correctness-error-handling.md","pattern":"Python HTTP libraries","snippet":"except requests.HTTPError as e:","category":"network","line_end":81,"severity":"low","line_start":81},{"id":"blocker:rules/correctness-error-handling.md:60:system-reconnaissance","file":"rules/correctness-error-handling.md","pattern":"System reconnaissance","snippet":"logger.error(f\"Invalid JSON in config file: {e}\")","category":"blocker","line_end":60,"severity":"low","line_start":60},{"id":"blocker:rules/correctness-error-handling.md:86:system-reconnaissance","file":"rules/correctness-error-handling.md","pattern":"System reconnaissance","snippet":"raise ValueError(f\"Invalid JSON response for user {user_id}\")","category":"blocker","line_end":86,"severity":"low","line_start":86},{"id":"blocker:rules/correctness-error-handling.md:153:system-reconnaissance","file":"rules/correctness-error-handling.md","pattern":"System reconnaissance","snippet":"throw new Error(`Invalid JSON response for user ${id}`);","category":"blocker","line_end":153,"severity":"low","line_start":153},{"id":"blocker:rules/correctness-error-handling.md:184:system-reconnaissance","file":"rules/correctness-error-handling.md","pattern":"System reconnaissance","snippet":"return { ok: false, error: new Error(`Invalid config: ${error}`) };","category":"blocker","line_end":184,"severity":"low","line_start":184},{"id":"blocker:rules/correctness-error-handling.md:270:system-reconnaissance","file":"rules/correctness-error-handling.md","pattern":"System reconnaissance","snippet":"\"user_id\": order.user_id","category":"blocker","line_end":271,"severity":"low","line_start":270},{"id":"blocker:rules/maintainability-naming.md:10:system-reconnaissance","file":"rules/maintainability-naming.md","pattern":"System reconnaissance","snippet":"Choose descriptive, intention-revealing names. Avoid single letters (except loop counters), abbrevia","category":"blocker","line_end":10,"severity":"low","line_start":10},{"id":"blocker:rules/maintainability-naming.md:132:system-reconnaissance","file":"rules/maintainability-naming.md","pattern":"System reconnaissance","snippet":"## Avoid Ambiguity","category":"blocker","line_end":132,"severity":"low","line_start":132},{"id":"external_commands:rules/performance-n-plus-one.md:49:ruby-shell-backtick-execution","file":"rules/performance-n-plus-one.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`${post.title} by ${author.name}`);","category":"external_commands","line_end":52,"severity":"medium","line_start":49},{"id":"external_commands:rules/performance-n-plus-one.md:104:ruby-shell-backtick-execution","file":"rules/performance-n-plus-one.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`${post.title} by ${post.author.name}`); // No extra query!","category":"external_commands","line_end":106,"severity":"medium","line_start":104},{"id":"blocker:rules/performance-n-plus-one.md:2:system-reconnaissance","file":"rules/performance-n-plus-one.md","pattern":"System reconnaissance","snippet":"title: Avoid N+1 Query Problem","category":"blocker","line_end":2,"severity":"low","line_start":2},{"id":"blocker:rules/performance-n-plus-one.md:8:system-reconnaissance","file":"rules/performance-n-plus-one.md","pattern":"System reconnaissance","snippet":"# Avoid N+1 Query Problem","category":"blocker","line_end":8,"severity":"low","line_start":8},{"id":"blocker:rules/performance-n-plus-one.md:32:system-reconnaissance","file":"rules/performance-n-plus-one.md","pattern":"System reconnaissance","snippet":"# N queries (one per post): SELECT * FROM users WHERE id = ?","category":"blocker","line_end":32,"severity":"low","line_start":32},{"id":"blocker:rules/performance-n-plus-one.md:77:system-reconnaissance","file":"rules/performance-n-plus-one.md","pattern":"System reconnaissance","snippet":"# Single query: SELECT * FROM posts JOIN users ON posts.author_id = users.id","category":"blocker","line_end":77,"severity":"low","line_start":77},{"id":"blocker:rules/performance-n-plus-one.md:131:system-reconnaissance","file":"rules/performance-n-plus-one.md","pattern":"System reconnaissance","snippet":"return userIds.map(id => users.find(u => u.id === id));","category":"blocker","line_end":131,"severity":"low","line_start":131},{"id":"blocker:rules/performance-n-plus-one.md:151:system-reconnaissance","file":"rules/performance-n-plus-one.md","pattern":"System reconnaissance","snippet":"author_ids = {post.author_id for post in posts}","category":"blocker","line_end":151,"severity":"low","line_start":151},{"id":"blocker:rules/performance-n-plus-one.md:185:system-reconnaissance","file":"rules/performance-n-plus-one.md","pattern":"System reconnaissance","snippet":"# 2. SELECT * FROM tags WHERE post_id IN (1,2,3,...)","category":"blocker","line_end":185,"severity":"low","line_start":185},{"id":"blocker:rules/security-sql-injection.md:26:system-reconnaissance","file":"rules/security-sql-injection.md","pattern":"System reconnaissance","snippet":"query = f\"SELECT * FROM users WHERE id = {user_id}\"","category":"blocker","line_end":26,"severity":"low","line_start":26},{"id":"blocker:rules/security-sql-injection.md:31:system-reconnaissance","file":"rules/security-sql-injection.md","pattern":"System reconnaissance","snippet":"# Executes: SELECT * FROM users WHERE id = 1 OR 1=1","category":"blocker","line_end":31,"severity":"low","line_start":31},{"id":"blocker:rules/security-sql-injection.md:55:system-reconnaissance","file":"rules/security-sql-injection.md","pattern":"System reconnaissance","snippet":"query = \"SELECT * FROM users WHERE id = ?\"","category":"blocker","line_end":55,"severity":"low","line_start":55},{"id":"blocker:rules/security-sql-injection.md:59:system-reconnaissance","file":"rules/security-sql-injection.md","pattern":"System reconnaissance","snippet":"# Safe: user_id is treated as data, not code","category":"blocker","line_end":59,"severity":"low","line_start":59},{"id":"blocker:rules/security-sql-injection.md:76:system-reconnaissance","file":"rules/security-sql-injection.md","pattern":"System reconnaissance","snippet":"user = session.query(User).filter(User.id == user_id).first()","category":"blocker","line_end":76,"severity":"low","line_start":76},{"id":"blocker:rules/security-sql-injection.md:79:system-reconnaissance","file":"rules/security-sql-injection.md","pattern":"System reconnaissance","snippet":"query = select(users).where(users.c.id == user_id)","category":"blocker","line_end":79,"severity":"low","line_start":79},{"id":"blocker:rules/security-sql-injection.md:82:system-reconnaissance","file":"rules/security-sql-injection.md","pattern":"System reconnaissance","snippet":"query = text(\"SELECT * FROM users WHERE id = :id\")","category":"blocker","line_end":82,"severity":"low","line_start":82},{"id":"blocker:rules/security-sql-injection.md:92:system-reconnaissance","file":"rules/security-sql-injection.md","pattern":"System reconnaissance","snippet":"User.objects.raw(\"SELECT * FROM users WHERE id = %s\", [user_id])","category":"blocker","line_end":92,"severity":"low","line_start":92},{"id":"blocker:rules/security-sql-injection.md:99:system-reconnaissance","file":"rules/security-sql-injection.md","pattern":"System reconnaissance","snippet":"'SELECT * FROM users WHERE id = $1',","category":"blocker","line_end":99,"severity":"low","line_start":99},{"id":"blocker:rules/security-sql-injection.md:108:system-reconnaissance","file":"rules/security-sql-injection.md","pattern":"System reconnaissance","snippet":"'SELECT * FROM users WHERE id = ?',","category":"blocker","line_end":108,"severity":"low","line_start":108},{"id":"blocker:rules/security-sql-injection.md:119:system-reconnaissance","file":"rules/security-sql-injection.md","pattern":"System reconnaissance","snippet":"raise ValueError(\"user_id must be an integer\")","category":"blocker","line_end":119,"severity":"low","line_start":119},{"id":"scripts:rules/security-xss-prevention.md:181:dynamic-code-evaluation-with-eval","file":"rules/security-xss-prevention.md","pattern":"Dynamic code evaluation with eval()","snippet":"- eval() and similar dangerous functions","category":"scripts","line_end":181,"severity":"high","line_start":181},{"id":"scripts:rules/security-xss-prevention.md:34:innerhtml-assignment-xss-risk","file":"rules/security-xss-prevention.md","pattern":"innerHTML assignment (XSS risk)","snippet":"document.getElementById('username').innerHTML = userInput;","category":"scripts","line_end":34,"severity":"medium","line_start":34},{"id":"scripts:rules/security-xss-prevention.md:78:innerhtml-assignment-xss-risk","file":"rules/security-xss-prevention.md","pattern":"innerHTML assignment (XSS risk)","snippet":"element.innerHTML = DOMPurify.sanitize(userHtml);","category":"scripts","line_end":78,"severity":"medium","line_start":78},{"id":"scripts:rules/security-xss-prevention.md:156:innerhtml-assignment-xss-risk","file":"rules/security-xss-prevention.md","pattern":"innerHTML assignment (XSS risk)","snippet":"document.getElementById('welcome').innerHTML = `Hello ${username}`;","category":"scripts","line_end":156,"severity":"medium","line_start":156},{"id":"external_commands:rules/security-xss-prevention.md:37:ruby-shell-backtick-execution","file":"rules/security-xss-prevention.md","pattern":"Ruby/shell backtick execution","snippet":"const html = `
Hello ${username}
`;","category":"external_commands","line_end":38,"severity":"medium","line_start":37},{"id":"external_commands:rules/security-xss-prevention.md:119:ruby-shell-backtick-execution","file":"rules/security-xss-prevention.md","pattern":"Ruby/shell backtick execution","snippet":"res.send(`

Results for: ${query}

`);","category":"external_commands","line_end":125,"severity":"medium","line_start":119},{"id":"external_commands:rules/security-xss-prevention.md:125:ruby-shell-backtick-execution","file":"rules/security-xss-prevention.md","pattern":"Ruby/shell backtick execution","snippet":"res.send(`

Results for: ${query}

`);","category":"external_commands","line_end":127,"severity":"medium","line_start":125},{"id":"external_commands:rules/security-xss-prevention.md:139:ruby-shell-backtick-execution","file":"rules/security-xss-prevention.md","pattern":"Ruby/shell backtick execution","snippet":"const html = comments.map(c => `

${c.text}

`).join('');","category":"external_commands","line_end":150,"severity":"medium","line_start":139},{"id":"external_commands:rules/security-xss-prevention.md:156:ruby-shell-backtick-execution","file":"rules/security-xss-prevention.md","pattern":"Ruby/shell backtick execution","snippet":"document.getElementById('welcome').innerHTML = `Hello ${username}`;","category":"external_commands","line_end":160,"severity":"medium","line_start":156},{"id":"external_commands:rules/security-xss-prevention.md:160:ruby-shell-backtick-execution","file":"rules/security-xss-prevention.md","pattern":"Ruby/shell backtick execution","snippet":"document.getElementById('welcome').textContent = `Hello ${username}`;","category":"external_commands","line_end":161,"severity":"medium","line_start":160},{"id":"network:rules/security-xss-prevention.md:42:fetch-api-call","file":"rules/security-xss-prevention.md","pattern":"Fetch API call","snippet":"const maliciousInput = '';","category":"network","line_end":42,"severity":"low","line_start":42},{"id":"network:rules/security-xss-prevention.md:42:hardcoded-url","file":"rules/security-xss-prevention.md","pattern":"Hardcoded URL","snippet":"const maliciousInput = '';","category":"network","line_end":42,"severity":"low","line_start":42},{"id":"obfuscation:rules/security-xss-prevention.md:139:array-join-empty-string","file":"rules/security-xss-prevention.md","pattern":"Array join empty string","snippet":"const html = comments.map(c => `

${c.text}

`).join('');","category":"obfuscation","line_end":139,"severity":"low","line_start":139},{"id":"blocker:rules/security-xss-prevention.md:16:keylogger-keywords","file":"rules/security-xss-prevention.md","pattern":"Keylogger keywords","snippet":"- Credential theft (keylogging, form hijacking)","category":"blocker","line_end":16,"severity":"critical","line_start":16},{"id":"network:SKILL.md:3:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"description: Reviews code for security vulnerabilities, performance issues, and best practices. Use ","category":"network","line_end":3,"severity":"low","line_start":3}],"finding_verdicts":[{"id":"scripts:AGENTS.md:76:innerhtml-assignment-xss-risk","reason":"The innerHTML assignment appears in an explicitly labeled dangerous example for reviewers to flag. It is documentation, not executable skill code.","verdict":"false_positive","confidence":0.97},{"id":"scripts:AGENTS.md:87:innerhtml-assignment-xss-risk","reason":"The innerHTML assignment appears in a safe example that sanitizes with DOMPurify. It is documentation for reviewers and is not executed by the skill.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:AGENTS.md:265:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:AGENTS.md:266:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:AGENTS.md:272:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:AGENTS.md:273:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:AGENTS.md:275:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"blocker:AGENTS.md:14:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:AGENTS.md:45:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:AGENTS.md:57:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:AGENTS.md:96:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:AGENTS.md:147:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:AGENTS.md:164:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:rules/correctness-error-handling.md:107:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/correctness-error-handling.md:124:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/correctness-error-handling.md:133:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/correctness-error-handling.md:138:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/correctness-error-handling.md:140:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/correctness-error-handling.md:147:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/correctness-error-handling.md:153:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/correctness-error-handling.md:184:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"network:rules/correctness-error-handling.md:107:fetch-api-call","reason":"The network call appears only inside sample code used to teach error handling or security review. The skill has no runnable hook that sends data externally.","verdict":"false_positive","confidence":0.96},{"id":"network:rules/correctness-error-handling.md:133:fetch-api-call","reason":"The network call appears only inside sample code used to teach error handling or security review. The skill has no runnable hook that sends data externally.","verdict":"false_positive","confidence":0.96},{"id":"network:rules/correctness-error-handling.md:73:python-http-libraries","reason":"The network call appears only inside sample code used to teach error handling or security review. The skill has no runnable hook that sends data externally.","verdict":"false_positive","confidence":0.96},{"id":"network:rules/correctness-error-handling.md:76:python-http-libraries","reason":"The network call appears only inside sample code used to teach error handling or security review. The skill has no runnable hook that sends data externally.","verdict":"false_positive","confidence":0.96},{"id":"network:rules/correctness-error-handling.md:81:python-http-libraries","reason":"The network call appears only inside sample code used to teach error handling or security review. The skill has no runnable hook that sends data externally.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/correctness-error-handling.md:60:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/correctness-error-handling.md:86:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/correctness-error-handling.md:153:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/correctness-error-handling.md:184:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/correctness-error-handling.md:270:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/maintainability-naming.md:10:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/maintainability-naming.md:132:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:rules/performance-n-plus-one.md:49:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/performance-n-plus-one.md:104:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"blocker:rules/performance-n-plus-one.md:2:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/performance-n-plus-one.md:8:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/performance-n-plus-one.md:32:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/performance-n-plus-one.md:77:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/performance-n-plus-one.md:131:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/performance-n-plus-one.md:151:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/performance-n-plus-one.md:185:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/security-sql-injection.md:26:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/security-sql-injection.md:31:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/security-sql-injection.md:55:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/security-sql-injection.md:59:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/security-sql-injection.md:76:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/security-sql-injection.md:79:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/security-sql-injection.md:82:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/security-sql-injection.md:92:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/security-sql-injection.md:99:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/security-sql-injection.md:108:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:rules/security-sql-injection.md:119:system-reconnaissance","reason":"The matched text is educational review guidance or sample code, not a host reconnaissance instruction. It does not ask the agent to inspect systems or collect data.","verdict":"false_positive","confidence":0.96},{"id":"scripts:rules/security-xss-prevention.md:181:dynamic-code-evaluation-with-eval","reason":"The eval reference is a CSP education bullet explaining what CSP can prevent. There is no eval call or dynamic code execution path.","verdict":"false_positive","confidence":0.99},{"id":"scripts:rules/security-xss-prevention.md:34:innerhtml-assignment-xss-risk","reason":"The innerHTML assignment appears in an explicitly labeled dangerous example for reviewers to flag. It is documentation, not executable skill code.","verdict":"false_positive","confidence":0.97},{"id":"scripts:rules/security-xss-prevention.md:78:innerhtml-assignment-xss-risk","reason":"The innerHTML assignment appears in a safe example that sanitizes with DOMPurify. It is documentation for reviewers and is not executed by the skill.","verdict":"false_positive","confidence":0.97},{"id":"scripts:rules/security-xss-prevention.md:156:innerhtml-assignment-xss-risk","reason":"The innerHTML assignment appears in an explicitly labeled dangerous example for reviewers to flag. It is documentation, not executable skill code.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/security-xss-prevention.md:37:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/security-xss-prevention.md:119:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/security-xss-prevention.md:125:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/security-xss-prevention.md:139:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/security-xss-prevention.md:156:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:rules/security-xss-prevention.md:160:ruby-shell-backtick-execution","reason":"The match is Markdown inline code or a JavaScript template literal inside review documentation. It is not Ruby shell backtick execution or a command invocation.","verdict":"false_positive","confidence":0.97},{"id":"network:rules/security-xss-prevention.md:42:fetch-api-call","reason":"The URL appears in an attack example that demonstrates XSS cookie theft. It is warning documentation and not an outbound request made by the skill.","verdict":"false_positive","confidence":0.96},{"id":"network:rules/security-xss-prevention.md:42:hardcoded-url","reason":"The URL appears in an attack example that demonstrates XSS cookie theft. It is warning documentation and not an outbound request made by the skill.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:rules/security-xss-prevention.md:139:array-join-empty-string","reason":"The empty string join is normal rendering logic in a stored XSS example. It is not obfuscation and is not executed by the skill.","verdict":"false_positive","confidence":0.95},{"id":"blocker:rules/security-xss-prevention.md:16:keylogger-keywords","reason":"The keyword appears in a list explaining the impact of XSS attacks. It does not instruct credential capture or implement keylogging behavior.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:3:python-http-libraries","reason":"Line 3 is metadata describing security review capabilities, not a Python HTTP import or network call. The skill contains no executable network code.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88","subject_content_hash":"c64ff6074b9c114a6d6e42bb1c8e9b28ce34e36fd5bc5f1dde11549f454b0d60","subject_tree_hash":"605c745968e0ed3c34dc284e4ea940a802e2a458605242a72b87552369d09dd9","subject_plugin_path":"skills/shubhamsaboo/code-reviewer","audit_payload_hash":"f2ebd54af68ef41f4b9278826e8c5620","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88","contentHash":"c64ff6074b9c114a6d6e42bb1c8e9b28ce34e36fd5bc5f1dde11549f454b0d60","treeHash":"605c745968e0ed3c34dc284e4ea940a802e2a458605242a72b87552369d09dd9","pluginPath":"skills/shubhamsaboo/code-reviewer","auditPayloadHash":"f2ebd54af68ef41f4b9278826e8c5620"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}