{"data":{"skill":{"slug":"sickn33-agent-manager-skill","name":"agent-manager-skill","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/agent-manager-skill","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"00b79d5f-c87f-4111-aaa3-096e2e487283","skill_id":"c386b388-2b9a-4519-85d4-c0bd0c07c848","version":5,"content_hash":"v3:ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006:481780bb51dbf46915b9f3aa1feaaac96f0294896c30be5a5e1f174cccb5a500:7dff54f7d1b023775e30a4e559fde1456891eda5b294aea02771434decf3f014:736b696c6c732f7369636b6e33332f6167656e742d6d616e616765722d736b696c6c:3029a0657f9e54757fee19f1593f17ae","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Six external-command findings are false positives caused by Markdown inline-code and fenced-code syntax; the document contains no shell backtick execution. The GitHub clone instruction is a confirmed low-severity supply-chain risk because it fetches mutable, unverified external content. No prompt injection or data-exfiltration intent was found.","remediation":[{"issue":"Unpinned external repository clone","severity":"low","suggestion":"Pin installation to a reviewed commit or release, document checksum verification, and align subsequent paths with the cloned directory."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":25,"line_start":23},{"file":"SKILL.md","line_end":29,"line_start":25},{"file":"SKILL.md","line_end":37,"line_start":29},{"file":"SKILL.md","line_end":41,"line_start":37},{"file":"SKILL.md","line_end":41,"line_start":41}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":24,"line_start":24}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":24,"line_start":24}],"confidence":0.84,"description":"git clone https://github.com/fractalmind-ai/agent-manager-skill.git","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The prerequisite clones a mutable external GitHub repository without pinning a commit or verifying integrity. Later documented commands depend on downloaded code, creating low supply-chain exposure."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":48,"audit_model":"codex","audited_at":"2026-07-23T20:13:31.747+00:00","created_at":"2026-07-26T00:13:25.080471+00:00","static_findings":[{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Install `agent-manager-skill` in your workspace:","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":25,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":29,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":37,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":41,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Requires `tmux` and `python3`.","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"network:SKILL.md:24:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"git clone https://github.com/fractalmind-ai/agent-manager-skill.git","category":"network","line_end":24,"severity":"low","line_start":24}],"finding_verdicts":[{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The backticks on line 21 delimit the package name as Markdown inline code. They do not invoke a shell or interpolate any value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The detected backticks open and close a fenced Bash example. Markdown fences are documentation syntax and do not execute the enclosed clone command automatically.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The detection begins at a closing Markdown fence and spans headings plus another opening fence. No backtick command substitution or executable Ruby syntax is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"Line 29 opens a fenced Bash example containing fixed agent-manager commands. The fence cannot execute commands, and no dynamic value is interpolated into a shell.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The detected backticks are the closing fence for the command example. The remaining lines are prose and inline dependency names, not execution syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The backticks only format the tmux and python3 dependency names as inline code. No command is invoked.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:24:hardcoded-url","reason":"The prerequisite clones a mutable external GitHub repository without pinning a commit or verifying integrity. Later documented commands depend on downloaded code, creating low supply-chain exposure.","verdict":"confirmed","severity":"low","confidence":0.84}],"semantic_findings":[],"subject_marketplace_commit_sha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","subject_content_hash":"481780bb51dbf46915b9f3aa1feaaac96f0294896c30be5a5e1f174cccb5a500","subject_tree_hash":"7dff54f7d1b023775e30a4e559fde1456891eda5b294aea02771434decf3f014","subject_plugin_path":"skills/sickn33/agent-manager-skill","audit_payload_hash":"3029a0657f9e54757fee19f1593f17ae","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","contentHash":"481780bb51dbf46915b9f3aa1feaaac96f0294896c30be5a5e1f174cccb5a500","treeHash":"7dff54f7d1b023775e30a4e559fde1456891eda5b294aea02771434decf3f014","pluginPath":"skills/sickn33/agent-manager-skill","auditPayloadHash":"3029a0657f9e54757fee19f1593f17ae"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-agent-manager-skill/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}