{"data":{"skill":{"slug":"sickn33-azure-ai-transcription-py","name":"azure-ai-transcription-py","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-ai-transcription-py","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"a5c5f637-742b-47e6-86d3-f4b7825ebc71","skill_id":"18e4a748-a428-4d4f-934f-c86ebe982f35","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:e2e957cc11a17776b13e2c01e2bcc2907d90840d72bad8d9503966bc8f308849:b50f7c93a12cf50081b2bf35a2873a475318d08d8ceef42f44880873eec10fd4:736b696c6c732f7369636b6e33332f617a7572652d61692d7472616e736372697074696f6e2d7079:662737d61d5eabd26dcb069c22693855","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The nine external-command alerts match Markdown code fences, not Ruby or shell backtick execution. The URLs are explicit Azure and storage placeholders, while environment access is limited to documented client configuration. No prompt injection, covert exfiltration, or malicious intent was found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":17,"line_start":15},{"file":"SKILL.md","line_end":21,"line_start":17},{"file":"SKILL.md","line_end":24,"line_start":21},{"file":"SKILL.md","line_end":30,"line_start":24},{"file":"SKILL.md","line_end":38,"line_start":30},{"file":"SKILL.md","line_end":42,"line_start":38},{"file":"SKILL.md","line_end":51,"line_start":42},{"file":"SKILL.md","line_end":55,"line_start":51},{"file":"SKILL.md","line_end":60,"line_start":55}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":46,"line_start":46}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":36,"line_start":36}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":78,"audit_model":"codex","audited_at":"2026-07-23T19:50:27.915+00:00","created_at":"2026-07-26T03:28:52.098205+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":17,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":21,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":24,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":38,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":42,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":51,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":55,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":60,"severity":"medium","line_start":55},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"TRANSCRIPTION_ENDPOINT=https://<resource>.cognitiveservices.azure.com","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:SKILL.md:46:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"content_urls=[\"https://<storage>/audio.wav\"],","category":"network","line_end":46,"severity":"low","line_start":46},{"id":"env_access:SKILL.md:35:python-environment-access","file":"SKILL.md","pattern":"Python environment access","snippet":"endpoint=os.environ[\"TRANSCRIPTION_ENDPOINT\"],","category":"env_access","line_end":35,"severity":"low","line_start":35},{"id":"env_access:SKILL.md:36:python-environment-access","file":"SKILL.md","pattern":"Python environment access","snippet":"credential=os.environ[\"TRANSCRIPTION_KEY\"]","category":"env_access","line_end":36,"severity":"low","line_start":36}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"Lines 15-17 are a fenced Bash example containing a transparent package installation command. The backticks delimit Markdown and do not perform Ruby or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"Line 17 is the closing delimiter of a Markdown code block. It is documentation syntax and cannot execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"Line 21 opens a fenced Bash block that documents two environment variable values. The backticks are Markdown syntax, with no command substitution or executable payload.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"Line 24 closes the environment variable example. It contains no Ruby expression, shell substitution, or command invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Line 30 opens a fenced Python example for constructing an Azure client. Markdown fencing is not external command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Line 38 is only the closing fence for a Python example. No backtick execution construct is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"Line 42 opens a fenced Python batch-transcription example. The code uses the documented client object and contains no shell or Ruby execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"Line 51 closes the batch-transcription example. The matched backticks are inert Markdown delimiters.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"Line 55 opens a fenced Python streaming example. It does not interpolate input into a shell command or invoke an external process.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:22:hardcoded-url","reason":"The value is an explicit placeholder for the user's Azure Cognitive Services endpoint. It is required service configuration, not a fixed third-party destination.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:46:hardcoded-url","reason":"The URL is a placeholder for user-controlled audio storage supplied to the transcription service. It does not identify an actual collection endpoint or covert destination.","verdict":"false_positive","confidence":0.97},{"id":"env_access:SKILL.md:35:python-environment-access","reason":"The example reads the documented transcription endpoint from a specifically named environment variable. It does not enumerate, expose, or transmit unrelated environment data.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:36:python-environment-access","reason":"The example reads the expected subscription key and passes it directly to the Azure client credential parameter. The key is not printed, logged, or sent to an unrelated service.","verdict":"false_positive","confidence":0.97}],"semantic_findings":[],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"e2e957cc11a17776b13e2c01e2bcc2907d90840d72bad8d9503966bc8f308849","subject_tree_hash":"b50f7c93a12cf50081b2bf35a2873a475318d08d8ceef42f44880873eec10fd4","subject_plugin_path":"skills/sickn33/azure-ai-transcription-py","audit_payload_hash":"662737d61d5eabd26dcb069c22693855","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"e2e957cc11a17776b13e2c01e2bcc2907d90840d72bad8d9503966bc8f308849","treeHash":"b50f7c93a12cf50081b2bf35a2873a475318d08d8ceef42f44880873eec10fd4","pluginPath":"skills/sickn33/azure-ai-transcription-py","auditPayloadHash":"662737d61d5eabd26dcb069c22693855"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-azure-ai-transcription-py/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}