{"data":{"skill":{"slug":"sickn33-azure-security-keyvault-secrets-java","name":"azure-security-keyvault-secrets-java","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-security-keyvault-secrets-java","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"caea2e3f-3c54-4f2c-83d7-b729deec9d20","skill_id":"ce0778d3-4da7-4e62-b6ee-46ae74354d9c","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:52cbba71acb2402cc598cbb3ff2a9d1667ec6630a635701a27ff87189a93c51f:38ba3cfcef5411903daf40595add7066c0e59aeafb72fcc77a77d1848a0e18f0:736b696c6c732f7369636b6e33332f617a7572652d73656375726974792d6b65797661756c742d736563726574732d6a617661:5035090f17b9be9a33491c8a77c5e1b0","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 57 static findings are false positives caused by Markdown syntax, Azure endpoint examples, Java SDK package names, or placeholder text. Semantic review found unsafe secret logging, local backup persistence without protection guidance, and a rotation sequence that can disable the active version before replacement succeeds.","remediation":[{"issue":"Examples write complete or partial secret values to standard output.","severity":"high","suggestion":"Remove secret values and prefixes from logs. Log only non-sensitive names, version identifiers, status, and correlation data."},{"issue":"The backup example writes a secret backup blob with default filesystem handling.","severity":"medium","suggestion":"Avoid local persistence when possible. Otherwise, restrict file permissions, use protected storage, and delete backup artifacts after restoration."},{"issue":"The rotation example disables the current version before confirming the replacement.","severity":"medium","suggestion":"Create and validate the new version first, switch consumers, then disable the prior version with rollback support."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":21,"line_start":15},{"file":"SKILL.md","line_end":25,"line_start":21},{"file":"SKILL.md","line_end":41,"line_start":25},{"file":"SKILL.md","line_end":45,"line_start":41},{"file":"SKILL.md","line_end":67,"line_start":45},{"file":"SKILL.md","line_end":71,"line_start":67},{"file":"SKILL.md","line_end":84,"line_start":71},{"file":"SKILL.md","line_end":88,"line_start":84},{"file":"SKILL.md","line_end":100,"line_start":88},{"file":"SKILL.md","line_end":104,"line_start":100},{"file":"SKILL.md","line_end":128,"line_start":104},{"file":"SKILL.md","line_end":132,"line_start":128},{"file":"SKILL.md","line_end":145,"line_start":132},{"file":"SKILL.md","line_end":149,"line_start":145},{"file":"SKILL.md","line_end":162,"line_start":149},{"file":"SKILL.md","line_end":166,"line_start":162},{"file":"SKILL.md","line_end":174,"line_start":166},{"file":"SKILL.md","line_end":178,"line_start":174},{"file":"SKILL.md","line_end":189,"line_start":178},{"file":"SKILL.md","line_end":193,"line_start":189},{"file":"SKILL.md","line_end":214,"line_start":193},{"file":"SKILL.md","line_end":220,"line_start":214},{"file":"SKILL.md","line_end":250,"line_start":220},{"file":"SKILL.md","line_end":254,"line_start":250},{"file":"SKILL.md","line_end":267,"line_start":254},{"file":"SKILL.md","line_end":271,"line_start":267},{"file":"SKILL.md","line_end":290,"line_start":271},{"file":"SKILL.md","line_end":296,"line_start":290},{"file":"SKILL.md","line_end":297,"line_start":296},{"file":"SKILL.md","line_end":298,"line_start":297},{"file":"SKILL.md","line_end":299,"line_start":298},{"file":"SKILL.md","line_end":300,"line_start":299},{"file":"SKILL.md","line_end":301,"line_start":300},{"file":"SKILL.md","line_end":302,"line_start":301},{"file":"SKILL.md","line_end":303,"line_start":302},{"file":"SKILL.md","line_end":304,"line_start":303},{"file":"SKILL.md","line_end":305,"line_start":304},{"file":"SKILL.md","line_end":306,"line_start":305},{"file":"SKILL.md","line_end":310,"line_start":306},{"file":"SKILL.md","line_end":312,"line_start":310},{"file":"SKILL.md","line_end":318,"line_start":312},{"file":"SKILL.md","line_end":319,"line_start":318},{"file":"SKILL.md","line_end":319,"line_start":319},{"file":"SKILL.md","line_end":351,"line_start":326}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":195,"line_start":195},{"file":"SKILL.md","line_end":246,"line_start":246},{"file":"SKILL.md","line_end":311,"line_start":311},{"file":"SKILL.md","line_end":342,"line_start":342}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":342,"line_start":342}]}],"critical_findings":[],"high_findings":[{"title":"Secret Values Written to Standard Output","locations":[{"file":"SKILL.md","line_end":75,"line_start":73},{"file":"SKILL.md","line_end":119,"line_start":115},{"file":"SKILL.md","line_end":208,"line_start":207},{"file":"SKILL.md","line_end":277,"line_start":275}],"confidence":0.99,"description":"Several examples print complete secret values or a secret prefix. Application logs can expose credentials to operators, log processors, and retained telemetry.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The examples directly concatenate values returned by getValue() into System.out output, including complete values and a five-character prefix."}],"medium_findings":[{"title":"Secret Backup Persisted Without Protection Guidance","locations":[{"file":"SKILL.md","line_end":187,"line_start":178}],"confidence":0.9,"description":"The backup workflow writes a Key Vault secret backup blob to a local file without permissions, protected storage, retention, or cleanup guidance.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The example directly writes backup bytes to secret-backup.blob and later reads them, while providing no filesystem protection or cleanup controls."},{"title":"Rotation Can Disable the Active Secret Before Replacement","locations":[{"file":"SKILL.md","line_end":265,"line_start":255}],"confidence":0.97,"description":"The rotation workflow disables the current secret version before creating its replacement. A failed write can leave consumers without an enabled secret.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The sequence explicitly disables and updates the current version before setSecret creates the new version, with no rollback or validation path."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":367,"audit_model":"codex","audited_at":"2026-07-23T22:54:32.35+00:00","created_at":"2026-07-26T06:23:19.00684+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```xml","category":"external_commands","line_end":21,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":25,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":41,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":45,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":67,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":71,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":84,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":88,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":100,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":104,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":128,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":132,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":145,"severity":"medium","line_start":132},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":149,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":162,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":166,"severity":"medium","line_start":162},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":174,"severity":"medium","line_start":166},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":178,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":189,"severity":"medium","line_start":178},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":193,"severity":"medium","line_start":189},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":214,"severity":"medium","line_start":193},{"id":"external_commands:SKILL.md:214:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":220,"severity":"medium","line_start":214},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":250,"severity":"medium","line_start":220},{"id":"external_commands:SKILL.md:250:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":254,"severity":"medium","line_start":250},{"id":"external_commands:SKILL.md:254:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":267,"severity":"medium","line_start":254},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":271,"severity":"medium","line_start":267},{"id":"external_commands:SKILL.md:271:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":290,"severity":"medium","line_start":271},{"id":"external_commands:SKILL.md:290:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":296,"severity":"medium","line_start":290},{"id":"external_commands:SKILL.md:296:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `name` | Secret name |","category":"external_commands","line_end":297,"severity":"medium","line_start":296},{"id":"external_commands:SKILL.md:297:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `value` | Secret value (string) |","category":"external_commands","line_end":298,"severity":"medium","line_start":297},{"id":"external_commands:SKILL.md:298:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `id` | Full identifier URL |","category":"external_commands","line_end":299,"severity":"medium","line_start":298},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `contentType` | MIME type hint |","category":"external_commands","line_end":300,"severity":"medium","line_start":299},{"id":"external_commands:SKILL.md:300:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `enabled` | Whether secret can be retrieved |","category":"external_commands","line_end":301,"severity":"medium","line_start":300},{"id":"external_commands:SKILL.md:301:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `notBefore` | Activation time |","category":"external_commands","line_end":302,"severity":"medium","line_start":301},{"id":"external_commands:SKILL.md:302:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `expiresOn` | Expiration time |","category":"external_commands","line_end":303,"severity":"medium","line_start":302},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `createdOn` | Creation timestamp |","category":"external_commands","line_end":304,"severity":"medium","line_start":303},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `updatedOn` | Last update timestamp |","category":"external_commands","line_end":305,"severity":"medium","line_start":304},{"id":"external_commands:SKILL.md:305:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `recoveryLevel` | Soft-delete recovery level |","category":"external_commands","line_end":306,"severity":"medium","line_start":305},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `tags` | User-defined metadata |","category":"external_commands","line_end":310,"severity":"medium","line_start":306},{"id":"external_commands:SKILL.md:310:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":312,"severity":"medium","line_start":310},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":318,"severity":"medium","line_start":312},{"id":"external_commands:SKILL.md:318:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Set Expiration** - Use `setExpiresOn()` for credentials that should rotate","category":"external_commands","line_end":319,"severity":"medium","line_start":318},{"id":"external_commands:SKILL.md:319:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Content Type** - Set `contentType` to indicate format (e.g., `application/json`)","category":"external_commands","line_end":319,"severity":"medium","line_start":319},{"id":"external_commands:SKILL.md:326:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```java","category":"external_commands","line_end":351,"severity":"medium","line_start":326},{"id":"network:SKILL.md:32:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":".vaultUrl(\"https://<vault-name>.vault.azure.net\")","category":"network","line_end":32,"severity":"low","line_start":32},{"id":"network:SKILL.md:38:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":".vaultUrl(\"https://<vault-name>.vault.azure.net\")","category":"network","line_end":38,"severity":"low","line_start":38},{"id":"network:SKILL.md:195:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":".vaultUrl(\"https://<vault>.vault.azure.net\")","category":"network","line_end":195,"severity":"low","line_start":195},{"id":"network:SKILL.md:246:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"ConfigLoader loader = new ConfigLoader(\"https://my-vault.vault.azure.net\");","category":"network","line_end":246,"severity":"low","line_start":246},{"id":"network:SKILL.md:311:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net","category":"network","line_end":311,"severity":"low","line_start":311},{"id":"network:SKILL.md:342:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"{\\\"endpoint\\\":\\\"https://...\\\",\\\"key\\\":\\\"...\\\"}\")","category":"network","line_end":342,"severity":"low","line_start":342},{"id":"filesystem:SKILL.md:342:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"{\\\"endpoint\\\":\\\"https://...\\\",\\\"key\\\":\\\"...\\\"}\")","category":"filesystem","line_end":342,"severity":"high","line_start":342},{"id":"sensitive:SKILL.md:26:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.secrets.SecretClient;","category":"sensitive","line_end":26,"severity":"high","line_start":26},{"id":"sensitive:SKILL.md:27:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.secrets.SecretClientBuilder;","category":"sensitive","line_end":27,"severity":"high","line_start":27},{"id":"sensitive:SKILL.md:46:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.secrets.models.KeyVaultSecret;","category":"sensitive","line_end":46,"severity":"high","line_start":46},{"id":"sensitive:SKILL.md:106:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.secrets.models.SecretProperties;","category":"sensitive","line_end":106,"severity":"high","line_start":106},{"id":"sensitive:SKILL.md:134:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.secrets.models.DeletedSecret;","category":"sensitive","line_end":134,"severity":"high","line_start":134},{"id":"blocker:SKILL.md:255:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"public void rotateSecret(String secretName, String newValue) {","category":"blocker","line_end":255,"severity":"low","line_start":255}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown XML code fence for a Maven dependency and do not execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown XML code fence and are not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:214:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:250:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:254:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:271:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:290:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Java example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:296:ruby-shell-backtick-execution","reason":"The backticks format a property name in a Markdown table and do not execute any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:297:ruby-shell-backtick-execution","reason":"The backticks format a property name in a Markdown table and do not execute any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:298:ruby-shell-backtick-execution","reason":"The backticks format a property name in a Markdown table and do not execute any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","reason":"The backticks format a property name in a Markdown table and do not execute any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:300:ruby-shell-backtick-execution","reason":"The backticks format a property name in a Markdown table and do not execute any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:301:ruby-shell-backtick-execution","reason":"The backticks format a property name in a Markdown table and do not execute any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:302:ruby-shell-backtick-execution","reason":"The backticks format a property name in a Markdown table and do not execute any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","reason":"The backticks format a property name in a Markdown table and do not execute any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:304:ruby-shell-backtick-execution","reason":"The backticks format a property name in a Markdown table and do not execute any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:305:ruby-shell-backtick-execution","reason":"The backticks format a property name in a Markdown table and do not execute any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","reason":"The backticks format a property name in a Markdown table and do not execute any command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:310:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Bash fence containing an environment variable example, not a command invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown Bash example and are not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:318:ruby-shell-backtick-execution","reason":"The backticks format the Java method name setExpiresOn in prose and do not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:319:ruby-shell-backtick-execution","reason":"The backticks format contentType and application/json in prose and do not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:326:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown Java example and do not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:32:hardcoded-url","reason":"This is a documented Azure Key Vault endpoint template with a vault-name placeholder, not an unknown or covert destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:38:hardcoded-url","reason":"This is a documented Azure Key Vault endpoint template with a vault-name placeholder, not an unknown or covert destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:195:hardcoded-url","reason":"This is a documented Azure Key Vault endpoint template with a vault placeholder, used to configure the expected Azure SDK client.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:246:hardcoded-url","reason":"The URL is an illustrative vault.azure.net endpoint passed to the example configuration loader, with no suspicious external host.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:311:hardcoded-url","reason":"The URL is a placeholder value for the documented AZURE_KEYVAULT_URL environment variable and targets the standard Azure Key Vault domain.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:342:hardcoded-url","reason":"The URL is placeholder content inside an example secret value and does not direct data to a specific network destination.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:342:path-traversal-sequence","reason":"The two dots are ellipsis placeholders inside a JSON endpoint and key example, not a filesystem path or traversal sequence.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:26:certificate-key-files","reason":"The line imports Azure SecretClient by Java package name and does not reference or access a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:27:certificate-key-files","reason":"The line imports Azure SecretClientBuilder by Java package name and does not reference or access a certificate or private-key file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:46:certificate-key-files","reason":"The line imports the KeyVaultSecret model and contains no certificate path, key material, or file access.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:106:certificate-key-files","reason":"The line imports the SecretProperties model and contains no certificate path, key material, or file access.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:134:certificate-key-files","reason":"The line imports the DeletedSecret model and contains no certificate path, key material, or file access.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:255:system-reconnaissance","reason":"This is a Java secret-rotation method declaration that uses supplied parameters and performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Secret Values Written to Standard Output","severity":"high","locations":[{"file":"SKILL.md","line_end":75,"line_start":73},{"file":"SKILL.md","line_end":119,"line_start":115},{"file":"SKILL.md","line_end":208,"line_start":207},{"file":"SKILL.md","line_end":277,"line_start":275}],"confidence":0.99,"description":"Several examples print complete secret values or a secret prefix. Application logs can expose credentials to operators, log processors, and retained telemetry.","confidence_reasoning":"The examples directly concatenate values returned by getValue() into System.out output, including complete values and a five-character prefix."},{"title":"Secret Backup Persisted Without Protection Guidance","severity":"medium","locations":[{"file":"SKILL.md","line_end":187,"line_start":178}],"confidence":0.9,"description":"The backup workflow writes a Key Vault secret backup blob to a local file without permissions, protected storage, retention, or cleanup guidance.","confidence_reasoning":"The example directly writes backup bytes to secret-backup.blob and later reads them, while providing no filesystem protection or cleanup controls."},{"title":"Rotation Can Disable the Active Secret Before Replacement","severity":"medium","locations":[{"file":"SKILL.md","line_end":265,"line_start":255}],"confidence":0.97,"description":"The rotation workflow disables the current secret version before creating its replacement. A failed write can leave consumers without an enabled secret.","confidence_reasoning":"The sequence explicitly disables and updates the current version before setSecret creates the new version, with no rollback or validation path."}],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"52cbba71acb2402cc598cbb3ff2a9d1667ec6630a635701a27ff87189a93c51f","subject_tree_hash":"38ba3cfcef5411903daf40595add7066c0e59aeafb72fcc77a77d1848a0e18f0","subject_plugin_path":"skills/sickn33/azure-security-keyvault-secrets-java","audit_payload_hash":"5035090f17b9be9a33491c8a77c5e1b0","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"52cbba71acb2402cc598cbb3ff2a9d1667ec6630a635701a27ff87189a93c51f","treeHash":"38ba3cfcef5411903daf40595add7066c0e59aeafb72fcc77a77d1848a0e18f0","pluginPath":"skills/sickn33/azure-security-keyvault-secrets-java","auditPayloadHash":"5035090f17b9be9a33491c8a77c5e1b0"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-azure-security-keyvault-secrets-java/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":3,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}