{"data":{"skill":{"slug":"sickn33-azure-keyvault-keys-ts","name":"azure-keyvault-keys-ts","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-keyvault-keys-ts","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"f876d9e4-43ca-41f5-98ba-ef58d22c0e9e","skill_id":"93a99c44-e0c7-4dab-9931-538059bf58d8","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:c3b15180feaeb108ca97be8b584d59de8cc3a9959dc8b46b420ab4bf508d07bf:9c8d9640fecb8f1c9c37cf2618d1dcea62ce0d06e6e0145e5a657ee6163c6755:736b696c6c732f7369636b6e33332f617a7572652d6b65797661756c742d6b6579732d7473:14813a64d05db67828e17de4a3a6d312","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 44 static findings are false positives caused by Markdown fences, a TypeScript template literal, normal Azure URLs, and non-secret configuration access. However, the examples expose sensitive values in logs and show irreversible purge operations without confirmation safeguards.","remediation":[{"issue":"Examples print a retrieved secret and decrypted plaintext.","severity":"high","suggestion":"Remove sensitive console output and demonstrate redacted metadata or success indicators instead."},{"issue":"Examples purge deleted secrets and keys without a confirmation safeguard.","severity":"medium","suggestion":"Add explicit confirmation, permission checks, and a clear warning that purge permanently prevents recovery."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":18,"line_start":15},{"file":"SKILL.md","line_end":22,"line_start":18},{"file":"SKILL.md","line_end":26,"line_start":22},{"file":"SKILL.md","line_end":30,"line_start":26},{"file":"SKILL.md","line_end":35,"line_start":30},{"file":"SKILL.md","line_end":39,"line_start":35},{"file":"SKILL.md","line_end":45,"line_start":39},{"file":"SKILL.md","line_end":55,"line_start":45},{"file":"SKILL.md","line_end":59,"line_start":55},{"file":"SKILL.md","line_end":68,"line_start":59},{"file":"SKILL.md","line_end":72,"line_start":68},{"file":"SKILL.md","line_end":81,"line_start":72},{"file":"SKILL.md","line_end":85,"line_start":81},{"file":"SKILL.md","line_end":96,"line_start":85},{"file":"SKILL.md","line_end":102,"line_start":96},{"file":"SKILL.md","line_end":119,"line_start":102},{"file":"SKILL.md","line_end":123,"line_start":119},{"file":"SKILL.md","line_end":126,"line_start":123},{"file":"SKILL.md","line_end":130,"line_start":126},{"file":"SKILL.md","line_end":134,"line_start":130},{"file":"SKILL.md","line_end":138,"line_start":134},{"file":"SKILL.md","line_end":147,"line_start":138},{"file":"SKILL.md","line_end":151,"line_start":147},{"file":"SKILL.md","line_end":157,"line_start":151},{"file":"SKILL.md","line_end":163,"line_start":157},{"file":"SKILL.md","line_end":171,"line_start":163},{"file":"SKILL.md","line_end":175,"line_start":171},{"file":"SKILL.md","line_end":189,"line_start":175},{"file":"SKILL.md","line_end":193,"line_start":189},{"file":"SKILL.md","line_end":205,"line_start":193},{"file":"SKILL.md","line_end":209,"line_start":205},{"file":"SKILL.md","line_end":215,"line_start":209},{"file":"SKILL.md","line_end":219,"line_start":215},{"file":"SKILL.md","line_end":227,"line_start":219},{"file":"SKILL.md","line_end":231,"line_start":227},{"file":"SKILL.md","line_end":248,"line_start":231},{"file":"SKILL.md","line_end":252,"line_start":248},{"file":"SKILL.md","line_end":262,"line_start":252}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":35,"line_start":35}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":35,"line_start":35}]}],"critical_findings":[],"high_findings":[{"title":"Sensitive Values Printed to Logs","locations":[{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":188,"line_start":188}],"confidence":0.99,"description":"Examples print a retrieved secret and decrypted plaintext, which can expose sensitive data through logs, terminals, or captured agent output.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"Both lines directly pass sensitive values to console.log without redaction."}],"medium_findings":[{"title":"Irreversible Purge Without Confirmation","locations":[{"file":"SKILL.md","line_end":91,"line_start":90},{"file":"SKILL.md","line_end":156,"line_start":155}],"confidence":0.97,"description":"Examples permanently purge deleted secrets and keys without requiring confirmation or warning that recovery becomes impossible.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The documented purge calls are explicit and no nearby safeguard or recovery warning is provided."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":280,"audit_model":"codex","audited_at":"2026-07-23T20:30:01.482+00:00","created_at":"2026-07-26T05:22:33.797275+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":18,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":22,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":26,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":35,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"const vaultUrl = `https://${process.env.AZURE_KEYVAULT_NAME}.vault.azure.net`;","category":"external_commands","line_end":39,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":45,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":55,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":59,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":68,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":72,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":81,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":85,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":96,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":102,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":119,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":123,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":126,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":130,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":134,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":138,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":147,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":151,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":157,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":163,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":171,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":175,"severity":"medium","line_start":171},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":189,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":193,"severity":"medium","line_start":189},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":205,"severity":"medium","line_start":193},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":209,"severity":"medium","line_start":205},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":215,"severity":"medium","line_start":209},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":219,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:219:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":227,"severity":"medium","line_start":219},{"id":"external_commands:SKILL.md:227:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":231,"severity":"medium","line_start":227},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":248,"severity":"medium","line_start":231},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":252,"severity":"medium","line_start":248},{"id":"external_commands:SKILL.md:252:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":262,"severity":"medium","line_start":252},{"id":"network:SKILL.md:23:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"KEY_VAULT_URL=https://<vault-name>.vault.azure.net","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:SKILL.md:35:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"const vaultUrl = `https://${process.env.AZURE_KEYVAULT_NAME}.vault.azure.net`;","category":"network","line_end":35,"severity":"low","line_start":35},{"id":"env_access:SKILL.md:35:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"const vaultUrl = `https://${process.env.AZURE_KEYVAULT_NAME}.vault.azure.net`;","category":"env_access","line_end":35,"severity":"low","line_start":35},{"id":"env_access:SKILL.md:35:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"const vaultUrl = `https://${process.env.AZURE_KEYVAULT_NAME}.vault.azure.net`;","category":"env_access","line_end":35,"severity":"low","line_start":35},{"id":"sensitive:SKILL.md:35:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"const vaultUrl = `https://${process.env.AZURE_KEYVAULT_NAME}.vault.azure.net`;","category":"sensitive","line_end":35,"severity":"high","line_start":35},{"id":"sensitive:SKILL.md:125:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"console.log(key.name, key.keyType);","category":"sensitive","line_end":125,"severity":"high","line_start":125}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown bash example containing a fixed npm installation command; they do not execute a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown environment-variable example and have no execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"This is a TypeScript template literal that constructs an Azure vault URL; it does not execute a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:219:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:227:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown code fence, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:252:ruby-shell-backtick-execution","reason":"The matched backticks open a TypeScript documentation block and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:23:hardcoded-url","reason":"The URL is a documented placeholder for the official Azure Key Vault endpoint, not a fixed destination for data exfiltration.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:35:hardcoded-url","reason":"The URL is dynamically scoped to the configured vault under the official vault.azure.net domain.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:35:environment-variable-access-dot-notation","reason":"The code reads only a vault name for endpoint construction and does not access or disclose a credential.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:35:environment-variable-object","reason":"The process.env reference retrieves a non-secret Azure vault name and is a standard configuration pattern.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:35:environment-file-access","reason":"No environment file is opened; the TypeScript example reads one non-secret property from the process environment.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:125:certificate-key-files","reason":"The line prints a key name and key type metadata; it does not read a certificate or private-key file.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Sensitive Values Printed to Logs","severity":"high","locations":[{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":188,"line_start":188}],"confidence":0.99,"description":"Examples print a retrieved secret and decrypted plaintext, which can expose sensitive data through logs, terminals, or captured agent output.","confidence_reasoning":"Both lines directly pass sensitive values to console.log without redaction."},{"title":"Irreversible Purge Without Confirmation","severity":"medium","locations":[{"file":"SKILL.md","line_end":91,"line_start":90},{"file":"SKILL.md","line_end":156,"line_start":155}],"confidence":0.97,"description":"Examples permanently purge deleted secrets and keys without requiring confirmation or warning that recovery becomes impossible.","confidence_reasoning":"The documented purge calls are explicit and no nearby safeguard or recovery warning is provided."}],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"c3b15180feaeb108ca97be8b584d59de8cc3a9959dc8b46b420ab4bf508d07bf","subject_tree_hash":"9c8d9640fecb8f1c9c37cf2618d1dcea62ce0d06e6e0145e5a657ee6163c6755","subject_plugin_path":"skills/sickn33/azure-keyvault-keys-ts","audit_payload_hash":"14813a64d05db67828e17de4a3a6d312","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"c3b15180feaeb108ca97be8b584d59de8cc3a9959dc8b46b420ab4bf508d07bf","treeHash":"9c8d9640fecb8f1c9c37cf2618d1dcea62ce0d06e6e0145e5a657ee6163c6755","pluginPath":"skills/sickn33/azure-keyvault-keys-ts","auditPayloadHash":"14813a64d05db67828e17de4a3a6d312"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-azure-keyvault-keys-ts/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}