{"data":{"skill":{"slug":"sickn33-azure-security-keyvault-keys-java","name":"azure-security-keyvault-keys-java","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-security-keyvault-keys-java","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"6e08351b-9120-4113-afe8-bc63343d4986","skill_id":"b238867e-f519-4706-8fe4-d3f399a36bb8","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:fa713ba98760ee80f86dff6427fb180d9e92ac6bb26c4e408bbbd726adde1584:a69752a179730f810597913c85ff0a4533dc8ebf08ce56daea236224548bd738:736b696c6c732f7369636b6e33332f617a7572652d73656375726974792d6b65797661756c742d6b6579732d6a617661:0a0e9bad1e03aacdf2fe66d877b01fbd","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 71 static findings are false positives caused by Markdown backticks, placeholder Azure URLs, Java imports, and a signature-result print statement. The source contains no shell execution, embedded credentials, key files, arbitrary destinations, reconnaissance, or prompt injection. Two contextual issues remain: unprotected local key backup storage and direct logging of decrypted plaintext.","remediation":[{"issue":"Local key backup handling","severity":"medium","suggestion":"Store backup blobs in access-controlled, encrypted storage, restrict file permissions, and define cleanup and retention before using the backup example."},{"issue":"Decrypted plaintext logging","severity":"medium","suggestion":"Remove plaintext printing from the example and state that decrypted data must never be written to application logs."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":21,"line_start":15},{"file":"SKILL.md","line_end":25,"line_start":21},{"file":"SKILL.md","line_end":49,"line_start":25},{"file":"SKILL.md","line_end":55,"line_start":49},{"file":"SKILL.md","line_end":56,"line_start":55},{"file":"SKILL.md","line_end":57,"line_start":56},{"file":"SKILL.md","line_end":58,"line_start":57},{"file":"SKILL.md","line_end":59,"line_start":58},{"file":"SKILL.md","line_end":60,"line_start":59},{"file":"SKILL.md","line_end":66,"line_start":60},{"file":"SKILL.md","line_end":91,"line_start":66},{"file":"SKILL.md","line_end":95,"line_start":91},{"file":"SKILL.md","line_end":111,"line_start":95},{"file":"SKILL.md","line_end":115,"line_start":111},{"file":"SKILL.md","line_end":119,"line_start":115},{"file":"SKILL.md","line_end":123,"line_start":119},{"file":"SKILL.md","line_end":132,"line_start":123},{"file":"SKILL.md","line_end":136,"line_start":132},{"file":"SKILL.md","line_end":147,"line_start":136},{"file":"SKILL.md","line_end":151,"line_start":147},{"file":"SKILL.md","line_end":166,"line_start":151},{"file":"SKILL.md","line_end":170,"line_start":166},{"file":"SKILL.md","line_end":188,"line_start":170},{"file":"SKILL.md","line_end":194,"line_start":188},{"file":"SKILL.md","line_end":213,"line_start":194},{"file":"SKILL.md","line_end":217,"line_start":213},{"file":"SKILL.md","line_end":232,"line_start":217},{"file":"SKILL.md","line_end":236,"line_start":232},{"file":"SKILL.md","line_end":248,"line_start":236},{"file":"SKILL.md","line_end":252,"line_start":248},{"file":"SKILL.md","line_end":262,"line_start":252},{"file":"SKILL.md","line_end":266,"line_start":262},{"file":"SKILL.md","line_end":282,"line_start":266},{"file":"SKILL.md","line_end":286,"line_start":282},{"file":"SKILL.md","line_end":303,"line_start":286},{"file":"SKILL.md","line_end":309,"line_start":303},{"file":"SKILL.md","line_end":310,"line_start":309},{"file":"SKILL.md","line_end":311,"line_start":310},{"file":"SKILL.md","line_end":312,"line_start":311},{"file":"SKILL.md","line_end":313,"line_start":312},{"file":"SKILL.md","line_end":314,"line_start":313},{"file":"SKILL.md","line_end":315,"line_start":314},{"file":"SKILL.md","line_end":321,"line_start":315},{"file":"SKILL.md","line_end":322,"line_start":321},{"file":"SKILL.md","line_end":323,"line_start":322},{"file":"SKILL.md","line_end":324,"line_start":323},{"file":"SKILL.md","line_end":325,"line_start":324},{"file":"SKILL.md","line_end":326,"line_start":325},{"file":"SKILL.md","line_end":327,"line_start":326},{"file":"SKILL.md","line_end":331,"line_start":327}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":198,"line_start":198},{"file":"SKILL.md","line_end":348,"line_start":348}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Unprotected Local Key Backup Example","locations":[{"file":"SKILL.md","line_end":260,"line_start":252}],"confidence":0.92,"description":"The backup example writes an Azure key backup blob to a local file without access controls, secure storage guidance, or cleanup.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The documented Files.write call directly persists the backup blob, and the surrounding guidance provides no protection or retention controls."},{"title":"Decrypted Plaintext Logging","locations":[{"file":"SKILL.md","line_end":212,"line_start":211}],"confidence":0.94,"description":"The decryption example converts plaintext to a string and prints it. Reused with real data, this pattern can disclose sensitive content through logs.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The example directly passes the decrypted string to System.out.println, creating a clear plaintext logging pattern."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":373,"audit_model":"codex","audited_at":"2026-07-23T22:51:13.8+00:00","created_at":"2026-07-26T06:23:09.787603+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```xml","category":"external_commands","line_end":21,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":25,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":49,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":55,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `RSA` | RSA key (2048, 3072, 4096 bits) |","category":"external_commands","line_end":56,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `RSA_HSM` | RSA key in HSM |","category":"external_commands","line_end":57,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `EC` | Elliptic Curve key |","category":"external_commands","line_end":58,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `EC_HSM` | Elliptic Curve key in HSM |","category":"external_commands","line_end":59,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `OCT` | Symmetric key (Managed HSM only) |","category":"external_commands","line_end":60,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `OCT_HSM` | Symmetric key in HSM |","category":"external_commands","line_end":66,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":91,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":95,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":111,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":115,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":119,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":123,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":132,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":136,"severity":"medium","line_start":132},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":147,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":151,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":166,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":170,"severity":"medium","line_start":166},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":188,"severity":"medium","line_start":170},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":194,"severity":"medium","line_start":188},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":213,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:213:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":217,"severity":"medium","line_start":213},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":232,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":236,"severity":"medium","line_start":232},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":248,"severity":"medium","line_start":236},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":252,"severity":"medium","line_start":248},{"id":"external_commands:SKILL.md:252:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":262,"severity":"medium","line_start":252},{"id":"external_commands:SKILL.md:262:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":266,"severity":"medium","line_start":262},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":282,"severity":"medium","line_start":266},{"id":"external_commands:SKILL.md:282:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":286,"severity":"medium","line_start":282},{"id":"external_commands:SKILL.md:286:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":303,"severity":"medium","line_start":286},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":309,"severity":"medium","line_start":303},{"id":"external_commands:SKILL.md:309:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `RSA1_5` | RSA | RSAES-PKCS1-v1_5 |","category":"external_commands","line_end":310,"severity":"medium","line_start":309},{"id":"external_commands:SKILL.md:310:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `RSA_OAEP` | RSA | RSAES with OAEP (recommended) |","category":"external_commands","line_end":311,"severity":"medium","line_start":310},{"id":"external_commands:SKILL.md:311:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `RSA_OAEP_256` | RSA | RSAES with OAEP using SHA-256 |","category":"external_commands","line_end":312,"severity":"medium","line_start":311},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `A128GCM` | OCT | AES-GCM 128-bit |","category":"external_commands","line_end":313,"severity":"medium","line_start":312},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `A256GCM` | OCT | AES-GCM 256-bit |","category":"external_commands","line_end":314,"severity":"medium","line_start":313},{"id":"external_commands:SKILL.md:314:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `A128CBC` | OCT | AES-CBC 128-bit |","category":"external_commands","line_end":315,"severity":"medium","line_start":314},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `A256CBC` | OCT | AES-CBC 256-bit |","category":"external_commands","line_end":321,"severity":"medium","line_start":315},{"id":"external_commands:SKILL.md:321:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `RS256` | RSA | SHA-256 |","category":"external_commands","line_end":322,"severity":"medium","line_start":321},{"id":"external_commands:SKILL.md:322:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `RS384` | RSA | SHA-384 |","category":"external_commands","line_end":323,"severity":"medium","line_start":322},{"id":"external_commands:SKILL.md:323:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `RS512` | RSA | SHA-512 |","category":"external_commands","line_end":324,"severity":"medium","line_start":323},{"id":"external_commands:SKILL.md:324:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `PS256` | RSA | SHA-256 (PSS) |","category":"external_commands","line_end":325,"severity":"medium","line_start":324},{"id":"external_commands:SKILL.md:325:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `ES256` | EC P-256 | SHA-256 |","category":"external_commands","line_end":326,"severity":"medium","line_start":325},{"id":"external_commands:SKILL.md:326:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `ES384` | EC P-384 | SHA-384 |","category":"external_commands","line_end":327,"severity":"medium","line_start":326},{"id":"external_commands:SKILL.md:327:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `ES512` | EC P-521 | SHA-512 |","category":"external_commands","line_end":331,"severity":"medium","line_start":327},{"id":"external_commands:SKILL.md:331:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":343,"severity":"medium","line_start":331},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":347,"severity":"medium","line_start":343},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":349,"severity":"medium","line_start":347},{"id":"external_commands:SKILL.md:349:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":353,"severity":"medium","line_start":349},{"id":"external_commands:SKILL.md:353:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Use HSM Keys for Production** - Set `setHardwareProtected(true)` for sensitive keys","category":"external_commands","line_end":357,"severity":"medium","line_start":353},{"id":"network:SKILL.md:34:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":".vaultUrl(\"https://<vault-name>.vault.azure.net\")","category":"network","line_end":34,"severity":"low","line_start":34},{"id":"network:SKILL.md:40:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":".vaultUrl(\"https://<vault-name>.vault.azure.net\")","category":"network","line_end":40,"severity":"low","line_start":40},{"id":"network:SKILL.md:46:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":".keyIdentifier(\"https://<vault-name>.vault.azure.net/keys/<key-name>/<key-version>\")","category":"network","line_end":46,"severity":"low","line_start":46},{"id":"network:SKILL.md:198:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":".keyIdentifier(\"https://<vault>.vault.azure.net/keys/<key-name>\")","category":"network","line_end":198,"severity":"low","line_start":198},{"id":"network:SKILL.md:348:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net","category":"network","line_end":348,"severity":"low","line_start":348},{"id":"sensitive:SKILL.md:26:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.keys.KeyClient;","category":"sensitive","line_end":26,"severity":"high","line_start":26},{"id":"sensitive:SKILL.md:27:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.keys.KeyClientBuilder;","category":"sensitive","line_end":27,"severity":"high","line_start":27},{"id":"sensitive:SKILL.md:28:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.keys.cryptography.CryptographyClient;","category":"sensitive","line_end":28,"severity":"high","line_start":28},{"id":"sensitive:SKILL.md:29:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.keys.cryptography.CryptographyClientBuilder;","category":"sensitive","line_end":29,"severity":"high","line_start":29},{"id":"sensitive:SKILL.md:46:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":".keyIdentifier(\"https://<vault-name>.vault.azure.net/keys/<key-name>/<key-version>\")","category":"sensitive","line_end":46,"severity":"high","line_start":46},{"id":"sensitive:SKILL.md:67:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.keys.models.*;","category":"sensitive","line_end":67,"severity":"high","line_start":67},{"id":"sensitive:SKILL.md:195:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.keys.cryptography.models.*;","category":"sensitive","line_end":195,"severity":"high","line_start":195},{"id":"sensitive:SKILL.md:198:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":".keyIdentifier(\"https://<vault>.vault.azure.net/keys/<key-name>\")","category":"sensitive","line_end":198,"severity":"high","line_start":198},{"id":"sensitive:SKILL.md:287:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.keys.models.ImportKeyOptions;","category":"sensitive","line_end":287,"severity":"high","line_start":287},{"id":"sensitive:SKILL.md:288:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.keys.models.JsonWebKey;","category":"sensitive","line_end":288,"severity":"high","line_start":288},{"id":"blocker:SKILL.md:231:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"System.out.println(\"Valid signature: \" + verifyResult.isValid());","category":"blocker","line_end":231,"severity":"low","line_start":231}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 15-21 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 21-25 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 25-49 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 49-55 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 55-56 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 56-57 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 57-58 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 58-59 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 59-60 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 60-66 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 66-91 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 91-95 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 95-111 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 111-115 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 115-119 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 119-123 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 123-132 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 132-136 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 136-147 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 147-151 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 151-166 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 166-170 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 170-188 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 188-194 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 194-213 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:213:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 213-217 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 217-232 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 232-236 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 236-248 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 248-252 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:252:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 252-262 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:262:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 262-266 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 266-282 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:282:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 282-286 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:286:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 286-303 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 303-309 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:309:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 309-310 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:310:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 310-311 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:311:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 311-312 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 312-313 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 313-314 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:314:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 314-315 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 315-321 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:321:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 321-322 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:322:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 322-323 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:323:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 323-324 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:324:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 324-325 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:325:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 325-326 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:326:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 326-327 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:327:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 327-331 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:331:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 331-343 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 343-347 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 347-349 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:349:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 349-353 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:353:ruby-shell-backtick-execution","reason":"The flagged text at SKILL.md lines 353-357 is Markdown formatting for a code or table example. It is documentation and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:34:hardcoded-url","reason":"The URL at SKILL.md line 34 uses an angle-bracket placeholder under Azure's vault.azure.net service. It documents the required service endpoint and does not target an arbitrary or hidden host.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:40:hardcoded-url","reason":"The URL at SKILL.md line 40 uses an angle-bracket placeholder under Azure's vault.azure.net service. It documents the required service endpoint and does not target an arbitrary or hidden host.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:46:hardcoded-url","reason":"The URL at SKILL.md line 46 uses an angle-bracket placeholder under Azure's vault.azure.net service. It documents the required service endpoint and does not target an arbitrary or hidden host.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:198:hardcoded-url","reason":"The URL at SKILL.md line 198 uses an angle-bracket placeholder under Azure's vault.azure.net service. It documents the required service endpoint and does not target an arbitrary or hidden host.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:348:hardcoded-url","reason":"The URL at SKILL.md line 348 uses an angle-bracket placeholder under Azure's vault.azure.net service. It documents the required service endpoint and does not target an arbitrary or hidden host.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:26:certificate-key-files","reason":"The text at SKILL.md line 26 is a Java SDK import statement. It neither references a certificate or key file nor contains key material.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:27:certificate-key-files","reason":"The text at SKILL.md line 27 is a Java SDK import statement. It neither references a certificate or key file nor contains key material.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:28:certificate-key-files","reason":"The text at SKILL.md line 28 is a Java SDK import statement. It neither references a certificate or key file nor contains key material.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:29:certificate-key-files","reason":"The text at SKILL.md line 29 is a Java SDK import statement. It neither references a certificate or key file nor contains key material.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:46:certificate-key-files","reason":"The text at SKILL.md line 46 is a placeholder Azure Key Vault key identifier. It is not a local key file and contains no credential or private key material.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:67:certificate-key-files","reason":"The text at SKILL.md line 67 is a Java SDK import statement. It neither references a certificate or key file nor contains key material.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:195:certificate-key-files","reason":"The text at SKILL.md line 195 is a Java SDK import statement. It neither references a certificate or key file nor contains key material.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:198:certificate-key-files","reason":"The text at SKILL.md line 198 is a placeholder Azure Key Vault key identifier. It is not a local key file and contains no credential or private key material.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:287:certificate-key-files","reason":"The text at SKILL.md line 287 is a Java SDK import statement. It neither references a certificate or key file nor contains key material.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:288:certificate-key-files","reason":"The text at SKILL.md line 288 is a Java SDK import statement. It neither references a certificate or key file nor contains key material.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:231:system-reconnaissance","reason":"The statement prints only the boolean result of a signature verification. It does not inspect the host, enumerate resources, or collect system information.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Unprotected Local Key Backup Example","severity":"medium","locations":[{"file":"SKILL.md","line_end":260,"line_start":252}],"confidence":0.92,"description":"The backup example writes an Azure key backup blob to a local file without access controls, secure storage guidance, or cleanup.","confidence_reasoning":"The documented Files.write call directly persists the backup blob, and the surrounding guidance provides no protection or retention controls."},{"title":"Decrypted Plaintext Logging","severity":"medium","locations":[{"file":"SKILL.md","line_end":212,"line_start":211}],"confidence":0.94,"description":"The decryption example converts plaintext to a string and prints it. Reused with real data, this pattern can disclose sensitive content through logs.","confidence_reasoning":"The example directly passes the decrypted string to System.out.println, creating a clear plaintext logging pattern."}],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"fa713ba98760ee80f86dff6427fb180d9e92ac6bb26c4e408bbbd726adde1584","subject_tree_hash":"a69752a179730f810597913c85ff0a4533dc8ebf08ce56daea236224548bd738","subject_plugin_path":"skills/sickn33/azure-security-keyvault-keys-java","audit_payload_hash":"0a0e9bad1e03aacdf2fe66d877b01fbd","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"fa713ba98760ee80f86dff6427fb180d9e92ac6bb26c4e408bbbd726adde1584","treeHash":"a69752a179730f810597913c85ff0a4533dc8ebf08ce56daea236224548bd738","pluginPath":"skills/sickn33/azure-security-keyvault-keys-java","auditPayloadHash":"0a0e9bad1e03aacdf2fe66d877b01fbd"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-azure-security-keyvault-keys-java/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}