{"data":{"skill":{"slug":"sickn33-agent-framework-azure-ai-py","name":"agent-framework-azure-ai-py","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/agent-framework-azure-ai-py","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"82c46dee-06b6-45a5-b4b6-89d106a3fde8","skill_id":"d9965bb2-128c-40c0-8d9a-d1dba9257e56","version":5,"content_hash":"v3:ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006:28348541cfd86c2528924e5f562d76c9f3698c941a2f9c28c7d54debbaa23bdb:6ac7a6024f019be2c50dee6e41a4fdf7cfb6181a4a2eef06c20b1c5f3d6ddbcc:736b696c6c732f7369636b6e33332f6167656e742d6672616d65776f726b2d617a7572652d61692d7079:d114318afd033bfba67c57f5f1819afe","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static alerts are false positives caused by Markdown fences, inline code, Python imports, and Python async context managers. The installation example presents one medium supply-chain risk because it installs unpinned prerelease packages.","remediation":[{"issue":"The installation commands select the latest prerelease package without a version pin.","severity":"medium","suggestion":"Pin reviewed package versions and hashes, and remove --pre when a stable release supports the documented API."}],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"SKILL.md","line_end":121,"line_start":117},{"file":"SKILL.md","line_end":254,"line_start":250},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":100,"line_start":100},{"file":"SKILL.md","line_end":126,"line_start":126},{"file":"SKILL.md","line_end":147,"line_start":147},{"file":"SKILL.md","line_end":170,"line_start":170},{"file":"SKILL.md","line_end":211,"line_start":211},{"file":"SKILL.md","line_end":273,"line_start":273}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":23,"line_start":15},{"file":"SKILL.md","line_end":27,"line_start":23},{"file":"SKILL.md","line_end":33,"line_start":27},{"file":"SKILL.md","line_end":37,"line_start":33},{"file":"SKILL.md","line_end":41,"line_start":37},{"file":"SKILL.md","line_end":45,"line_start":41},{"file":"SKILL.md","line_end":53,"line_start":45},{"file":"SKILL.md","line_end":59,"line_start":53},{"file":"SKILL.md","line_end":78,"line_start":59},{"file":"SKILL.md","line_end":82,"line_start":78},{"file":"SKILL.md","line_end":112,"line_start":82},{"file":"SKILL.md","line_end":116,"line_start":112},{"file":"SKILL.md","line_end":141,"line_start":116},{"file":"SKILL.md","line_end":145,"line_start":141},{"file":"SKILL.md","line_end":161,"line_start":145},{"file":"SKILL.md","line_end":165,"line_start":161},{"file":"SKILL.md","line_end":193,"line_start":165},{"file":"SKILL.md","line_end":197,"line_start":193},{"file":"SKILL.md","line_end":224,"line_start":197},{"file":"SKILL.md","line_end":230,"line_start":224},{"file":"SKILL.md","line_end":231,"line_start":230},{"file":"SKILL.md","line_end":232,"line_start":231},{"file":"SKILL.md","line_end":238,"line_start":232},{"file":"SKILL.md","line_end":238,"line_start":238},{"file":"SKILL.md","line_end":239,"line_start":239},{"file":"SKILL.md","line_end":240,"line_start":240},{"file":"SKILL.md","line_end":241,"line_start":241},{"file":"SKILL.md","line_end":242,"line_start":242},{"file":"SKILL.md","line_end":320,"line_start":246},{"file":"SKILL.md","line_end":324,"line_start":320},{"file":"SKILL.md","line_end":325,"line_start":324},{"file":"SKILL.md","line_end":326,"line_start":325},{"file":"SKILL.md","line_end":327,"line_start":326},{"file":"SKILL.md","line_end":328,"line_start":327},{"file":"SKILL.md","line_end":328,"line_start":328}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":277,"line_start":277}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":33,"line_start":27}],"confidence":0.96,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced bash example installs unpinned prerelease packages with pip. Executing it downloads and runs package installation code without a reviewed version lock."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":344,"audit_model":"codex","audited_at":"2026-07-23T20:09:48.291+00:00","created_at":"2026-07-26T00:13:15.936555+00:00","static_findings":[{"id":"scripts:SKILL.md:117:dynamic-import-expression","file":"SKILL.md","pattern":"Dynamic import() expression","snippet":"from agent_framework import (","category":"scripts","line_end":121,"severity":"medium","line_start":117},{"id":"scripts:SKILL.md:250:dynamic-import-expression","file":"SKILL.md","pattern":"Dynamic import() expression","snippet":"from agent_framework import (","category":"scripts","line_end":254,"severity":"medium","line_start":250},{"id":"scripts:SKILL.md:65:with-statement-deprecated-scope-confusion","file":"SKILL.md","pattern":"with statement (deprecated, scope confusion)","snippet":"async with (","category":"scripts","line_end":65,"severity":"medium","line_start":65},{"id":"scripts:SKILL.md:100:with-statement-deprecated-scope-confusion","file":"SKILL.md","pattern":"with statement (deprecated, scope confusion)","snippet":"async with (","category":"scripts","line_end":100,"severity":"medium","line_start":100},{"id":"scripts:SKILL.md:126:with-statement-deprecated-scope-confusion","file":"SKILL.md","pattern":"with statement (deprecated, scope confusion)","snippet":"async with (","category":"scripts","line_end":126,"severity":"medium","line_start":126},{"id":"scripts:SKILL.md:147:with-statement-deprecated-scope-confusion","file":"SKILL.md","pattern":"with statement (deprecated, scope confusion)","snippet":"async with (","category":"scripts","line_end":147,"severity":"medium","line_start":147},{"id":"scripts:SKILL.md:170:with-statement-deprecated-scope-confusion","file":"SKILL.md","pattern":"with statement (deprecated, scope confusion)","snippet":"async with (","category":"scripts","line_end":170,"severity":"medium","line_start":170},{"id":"scripts:SKILL.md:211:with-statement-deprecated-scope-confusion","file":"SKILL.md","pattern":"with statement (deprecated, scope confusion)","snippet":"async with (","category":"scripts","line_end":211,"severity":"medium","line_start":211},{"id":"scripts:SKILL.md:273:with-statement-deprecated-scope-confusion","file":"SKILL.md","pattern":"with statement (deprecated, scope confusion)","snippet":"async with (","category":"scripts","line_end":273,"severity":"medium","line_start":273},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":23,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":27,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":33,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":37,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":41,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":45,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":53,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":59,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":78,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":82,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":112,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":116,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":141,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":145,"severity":"medium","line_start":141},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":161,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":165,"severity":"medium","line_start":161},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":193,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":197,"severity":"medium","line_start":193},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":224,"severity":"medium","line_start":197},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":230,"severity":"medium","line_start":224},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `create_agent()` | Create new agent on Azure AI service |","category":"external_commands","line_end":231,"severity":"medium","line_start":230},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `get_agent(agent_id)` | Retrieve existing agent by ID |","category":"external_commands","line_end":232,"severity":"medium","line_start":231},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `as_agent(sdk_agent)` | Wrap SDK Agent object (no HTTP call) |","category":"external_commands","line_end":238,"severity":"medium","line_start":232},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `HostedCodeInterpreterTool` | `from agent_framework import HostedCodeInterpreterTool` | Execute Py","category":"external_commands","line_end":238,"severity":"medium","line_start":238},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `HostedFileSearchTool` | `from agent_framework import HostedFileSearchTool` | Search vector stores","category":"external_commands","line_end":239,"severity":"medium","line_start":239},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `HostedWebSearchTool` | `from agent_framework import HostedWebSearchTool` | Bing web search |","category":"external_commands","line_end":240,"severity":"medium","line_start":240},{"id":"external_commands:SKILL.md:241:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `HostedMCPTool` | `from agent_framework import HostedMCPTool` | Service-managed MCP |","category":"external_commands","line_end":241,"severity":"medium","line_start":241},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `MCPStreamableHTTPTool` | `from agent_framework import MCPStreamableHTTPTool` | Client-managed MCP","category":"external_commands","line_end":242,"severity":"medium","line_start":242},{"id":"external_commands:SKILL.md:246:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":320,"severity":"medium","line_start":246},{"id":"external_commands:SKILL.md:320:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":324,"severity":"medium","line_start":320},{"id":"external_commands:SKILL.md:324:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Always use async context managers: `async with provider:`","category":"external_commands","line_end":325,"severity":"medium","line_start":324},{"id":"external_commands:SKILL.md:325:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Pass functions directly to `tools=` parameter (auto-converted to AIFunction)","category":"external_commands","line_end":326,"severity":"medium","line_start":325},{"id":"external_commands:SKILL.md:326:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `Annotated[type, Field(description=...)]` for function parameters","category":"external_commands","line_end":327,"severity":"medium","line_start":326},{"id":"external_commands:SKILL.md:327:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `get_new_thread()` for multi-turn conversations","category":"external_commands","line_end":328,"severity":"medium","line_start":327},{"id":"external_commands:SKILL.md:328:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Prefer `HostedMCPTool` for service-managed MCP, `MCPStreamableHTTPTool` for client-managed","category":"external_commands","line_end":328,"severity":"medium","line_start":328},{"id":"network:SKILL.md:38:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"export AZURE_AI_PROJECT_ENDPOINT=\"https://<project>.services.ai.azure.com/api/projects/<project-id>\"","category":"network","line_end":38,"severity":"low","line_start":38},{"id":"network:SKILL.md:277:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"url=\"https://learn.microsoft.com/api/mcp\",","category":"network","line_end":277,"severity":"low","line_start":277}],"finding_verdicts":[{"id":"scripts:SKILL.md:117:dynamic-import-expression","reason":"Lines 117-121 contain a static multiline Python from-import. No dynamic module name or runtime import expression is present.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:250:dynamic-import-expression","reason":"Lines 250-254 contain a static multiline Python from-import. The imported symbols are fixed in the example.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:65:with-statement-deprecated-scope-confusion","reason":"Line 65 uses Python async context-manager syntax. It is unrelated to the deprecated JavaScript with statement.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:100:with-statement-deprecated-scope-confusion","reason":"Line 100 uses Python async context-manager syntax for credential and provider cleanup. It does not create JavaScript scope confusion.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:126:with-statement-deprecated-scope-confusion","reason":"Line 126 is a Python async with statement managing SDK resources. This is normal Python resource-lifecycle syntax.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:147:with-statement-deprecated-scope-confusion","reason":"Line 147 is a Python async context manager in a streaming example. The deprecated JavaScript construct is not used.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:170:with-statement-deprecated-scope-confusion","reason":"Line 170 uses Python async context managers for Azure resources. It has no scope-confusion behavior.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:211:with-statement-deprecated-scope-confusion","reason":"Line 211 is valid Python async with syntax. It safely scopes asynchronous credentials and the provider.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:273:with-statement-deprecated-scope-confusion","reason":"Line 273 uses Python async context managers for three SDK resources. It is not the deprecated JavaScript with statement.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The matched backticks delimit a Markdown architecture diagram. They do not execute Ruby or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"This match covers a Markdown fence boundary and section headings. No command is executed at the matched text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The fenced bash example installs unpinned prerelease packages with pip. Executing it downloads and runs package installation code without a reviewed version lock.","verdict":"confirmed","severity":"medium","confidence":0.96},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Line 33 is a closing Markdown code fence. It is not Ruby backtick or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The matched Markdown block documents environment-variable assignments. It contains no command substitution or untrusted shell interpolation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"Line 41 is a closing Markdown fence. Backtick command execution is not present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The backticks open a documented Python example. They are Markdown syntax and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"Line 53 closes a Markdown Python block. It has no shell execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"This is a fenced Python SDK example. Markdown backticks are not interpreted as process execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"Line 78 is a closing Markdown fence, not a Ruby or shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The matched region is a Python function-tool example inside Markdown. It contains no shell or subprocess invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"Line 112 closes a Markdown block. It does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"This is a fenced Python example for hosted SDK tools. The Markdown delimiter itself cannot execute an external command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"Line 141 is a closing Markdown fence, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"The matched region documents Python response streaming. It contains no Ruby, shell, or subprocess call.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","reason":"Line 161 is a Markdown fence boundary with no execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"The matched block is Python documentation for conversation threads. It does not invoke system commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","reason":"Line 193 closes a Markdown code block. There is no shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","reason":"The fenced region is a Python structured-output example. It contains no process-spawning or shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","reason":"Line 224 is the closing delimiter for a Markdown Python block. It cannot execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","reason":"The backticks format a Python method name inside a Markdown table. They have no execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","reason":"The inline code formats a provider method signature in documentation. It is not a command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","reason":"This Markdown table row uses inline code formatting for an SDK method. No external process is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","reason":"The backticks format Python class and import names in a reference table. They are documentation, not executable shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","reason":"The matched backticks provide inline Python formatting in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","reason":"This is inline code formatting for a hosted web-search class and import. It is not a shell expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:241:ruby-shell-backtick-execution","reason":"The inline backticks format an MCP class and import statement in documentation. They do not execute anything.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","reason":"The match is Markdown inline code for a Python MCP class and import. It has no shell backtick behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:246:ruby-shell-backtick-execution","reason":"The matched backticks delimit a complete Python SDK example. The example uses documented cloud tools but does not invoke a local shell.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:320:ruby-shell-backtick-execution","reason":"Line 320 is a closing Markdown code fence. It is not executable backtick syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:324:ruby-shell-backtick-execution","reason":"The backticks format a Python async context-manager example in prose. They do not run an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:325:ruby-shell-backtick-execution","reason":"Inline backticks identify the Python tools parameter in documentation. There is no command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:326:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting for Python type annotations. They cannot execute shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:327:ruby-shell-backtick-execution","reason":"Inline code formatting names a Python SDK method. It is not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:328:ruby-shell-backtick-execution","reason":"The backticks format two Python MCP class names in prose. They have no command-execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:38:hardcoded-url","reason":"The URL is a placeholder Azure AI project endpoint containing explicit project tokens. It does not direct traffic to an author-controlled destination.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:277:hardcoded-url","reason":"The example points to the official Microsoft Learn MCP endpoint and labels it as documentation access. No credential or sensitive payload is sent by the shown code.","verdict":"false_positive","confidence":0.94}],"semantic_findings":[],"subject_marketplace_commit_sha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","subject_content_hash":"28348541cfd86c2528924e5f562d76c9f3698c941a2f9c28c7d54debbaa23bdb","subject_tree_hash":"6ac7a6024f019be2c50dee6e41a4fdf7cfb6181a4a2eef06c20b1c5f3d6ddbcc","subject_plugin_path":"skills/sickn33/agent-framework-azure-ai-py","audit_payload_hash":"d114318afd033bfba67c57f5f1819afe","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","contentHash":"28348541cfd86c2528924e5f562d76c9f3698c941a2f9c28c7d54debbaa23bdb","treeHash":"6ac7a6024f019be2c50dee6e41a4fdf7cfb6181a4a2eef06c20b1c5f3d6ddbcc","pluginPath":"skills/sickn33/agent-framework-azure-ai-py","auditPayloadHash":"d114318afd033bfba67c57f5f1819afe"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-agent-framework-azure-ai-py/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}