{"data":{"skill":{"slug":"sickn33-azure-web-pubsub-ts","name":"azure-web-pubsub-ts","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-web-pubsub-ts","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"1fb15a53-a503-4af1-abcc-7eff0ab681c0","skill_id":"b0f718a7-cbc3-4fe0-a6d3-901c795a3470","version":5,"content_hash":"v3:5a26d1d61d694db29af9b138c661c1981076d9df:0730476e5afa55acd8dbf57ccb08e46e19947cada3e26bff5048e1c497a8e638:82a3570e610043be567f419dcc76c9e824ca9047cd995a34e83232eebb7aa0d1:736b696c6c732f7369636b6e33332f617a7572652d7765622d7075627375622d7473:9d44a168f503cdd55f0058de8c3729ba","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 47 static alerts are false positives caused by Markdown fences, TypeScript template literals, placeholder URLs, intended SDK networking, or named environment configuration. Semantic review found two high-risk documentation patterns: logging a bearer-token URL and showing a negotiation route without demonstrated authentication.","remediation":[{"issue":"The token-generation example logs the complete client access URL.","severity":"high","suggestion":"Remove the log statement and state that client access URLs must be treated as secrets and redacted from all telemetry."},{"issue":"The negotiation example can issue a token when no authenticated user is present.","severity":"high","suggestion":"Add explicit authentication and authorization checks before token generation, then issue short-lived tokens with least-privilege roles and groups."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":24,"line_start":15},{"file":"SKILL.md","line_end":28,"line_start":24},{"file":"SKILL.md","line_end":31,"line_start":28},{"file":"SKILL.md","line_end":37,"line_start":31},{"file":"SKILL.md","line_end":60,"line_start":37},{"file":"SKILL.md","line_end":64,"line_start":60},{"file":"SKILL.md","line_end":85,"line_start":64},{"file":"SKILL.md","line_end":89,"line_start":85},{"file":"SKILL.md","line_end":104,"line_start":89},{"file":"SKILL.md","line_end":108,"line_start":104},{"file":"SKILL.md","line_end":123,"line_start":108},{"file":"SKILL.md","line_end":127,"line_start":123},{"file":"SKILL.md","line_end":140,"line_start":127},{"file":"SKILL.md","line_end":146,"line_start":140},{"file":"SKILL.md","line_end":163,"line_start":146},{"file":"SKILL.md","line_end":167,"line_start":163},{"file":"SKILL.md","line_end":171,"line_start":167},{"file":"SKILL.md","line_end":175,"line_start":171},{"file":"SKILL.md","line_end":191,"line_start":175},{"file":"SKILL.md","line_end":195,"line_start":191},{"file":"SKILL.md","line_end":198,"line_start":195},{"file":"SKILL.md","line_end":202,"line_start":198},{"file":"SKILL.md","line_end":211,"line_start":202},{"file":"SKILL.md","line_end":215,"line_start":211},{"file":"SKILL.md","line_end":220,"line_start":215},{"file":"SKILL.md","line_end":222,"line_start":220},{"file":"SKILL.md","line_end":226,"line_start":222},{"file":"SKILL.md","line_end":250,"line_start":226},{"file":"SKILL.md","line_end":251,"line_start":250},{"file":"SKILL.md","line_end":256,"line_start":251},{"file":"SKILL.md","line_end":260,"line_start":256},{"file":"SKILL.md","line_end":275,"line_start":260},{"file":"SKILL.md","line_end":279,"line_start":275},{"file":"SKILL.md","line_end":303,"line_start":279},{"file":"SKILL.md","line_end":307,"line_start":303}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":155,"line_start":155},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":56,"line_start":56},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":56,"line_start":56}]}],"critical_findings":[],"high_findings":[{"title":"Client Access Token URL Logged","locations":[{"file":"SKILL.md","line_end":67,"line_start":67}],"confidence":0.96,"description":"The example logs token.url, whose own comment shows an access_token query parameter. Logs can expose this bearer credential to operators or log systems.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The documented value is a WebSocket URL containing access_token, and the next statement writes it to the console. This is direct credential disclosure."},{"title":"Negotiation Route Does Not Demonstrate Authentication","locations":[{"file":"SKILL.md","line_end":272,"line_start":267}],"confidence":0.88,"description":"The Express route issues a client access URL while using an optional user identity and showing no authentication check. Copied code could grant anonymous service access.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The complete route example calls getClientAccessToken without rejecting an absent user. External middleware could exist, but none is shown in this copyable example."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":321,"audit_model":"codex","audited_at":"2026-08-14T09:31:30.765+00:00","created_at":"2026-08-15T04:54:08.261693+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":24,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":28,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":31,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":37,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":60,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":64,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":85,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":89,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":104,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":108,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":123,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":127,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":140,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":146,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":163,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Connected: ${e.connectionId}`);","category":"external_commands","line_end":167,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`${e.message.group}: ${e.message.data}`);","category":"external_commands","line_end":171,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":175,"severity":"medium","line_start":171},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":191,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":195,"severity":"medium","line_start":191},{"id":"external_commands:SKILL.md:195:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":198,"severity":"medium","line_start":195},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Connected: ${e.connectionId}, User: ${e.userId}`);","category":"external_commands","line_end":202,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Disconnected: ${e.message}`);","category":"external_commands","line_end":211,"severity":"medium","line_start":202},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`[${e.message.group}] ${e.message.fromUserId}: ${e.message.data}`);","category":"external_commands","line_end":215,"severity":"medium","line_start":211},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Server: ${e.message.data}`);","category":"external_commands","line_end":220,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Failed to rejoin ${e.group}: ${e.error}`);","category":"external_commands","line_end":222,"severity":"medium","line_start":220},{"id":"external_commands:SKILL.md:222:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":226,"severity":"medium","line_start":222},{"id":"external_commands:SKILL.md:226:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":250,"severity":"medium","line_start":226},{"id":"external_commands:SKILL.md:250:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Event from ${req.context.userId}:`, req.data);","category":"external_commands","line_end":251,"severity":"medium","line_start":250},{"id":"external_commands:SKILL.md:251:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"res.success(`Received: ${req.data}`, \"text\");","category":"external_commands","line_end":256,"severity":"medium","line_start":251},{"id":"external_commands:SKILL.md:256:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Client connected: ${req.context.connectionId}`);","category":"external_commands","line_end":260,"severity":"medium","line_start":256},{"id":"external_commands:SKILL.md:260:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Client disconnected: ${req.context.connectionId}`);","category":"external_commands","line_end":275,"severity":"medium","line_start":260},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":279,"severity":"medium","line_start":275},{"id":"external_commands:SKILL.md:279:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":303,"severity":"medium","line_start":279},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":307,"severity":"medium","line_start":303},{"id":"network:SKILL.md:155:fetch-api-call","file":"SKILL.md","pattern":"Fetch API call","snippet":"const response = await fetch(\"/negotiate\");","category":"network","line_end":155,"severity":"low","line_start":155},{"id":"network:SKILL.md:29:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"WEBPUBSUB_CONNECTION_STRING=Endpoint=https://<resource>.webpubsub.azure.com;AccessKey=<key>;Version=","category":"network","line_end":29,"severity":"low","line_start":29},{"id":"network:SKILL.md:30:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"WEBPUBSUB_ENDPOINT=https://<resource>.webpubsub.azure.com","category":"network","line_end":30,"severity":"low","line_start":30},{"id":"env_access:SKILL.md:43:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.WEBPUBSUB_CONNECTION_STRING!,","category":"env_access","line_end":43,"severity":"low","line_start":43},{"id":"env_access:SKILL.md:49:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.WEBPUBSUB_ENDPOINT!,","category":"env_access","line_end":49,"severity":"low","line_start":49},{"id":"env_access:SKILL.md:56:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.WEBPUBSUB_ENDPOINT!,","category":"env_access","line_end":56,"severity":"low","line_start":56},{"id":"env_access:SKILL.md:43:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"process.env.WEBPUBSUB_CONNECTION_STRING!,","category":"env_access","line_end":43,"severity":"low","line_start":43},{"id":"env_access:SKILL.md:49:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"process.env.WEBPUBSUB_ENDPOINT!,","category":"env_access","line_end":49,"severity":"low","line_start":49},{"id":"env_access:SKILL.md:56:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"process.env.WEBPUBSUB_ENDPOINT!,","category":"env_access","line_end":56,"severity":"low","line_start":56},{"id":"sensitive:SKILL.md:43:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"process.env.WEBPUBSUB_CONNECTION_STRING!,","category":"sensitive","line_end":43,"severity":"high","line_start":43},{"id":"sensitive:SKILL.md:49:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"process.env.WEBPUBSUB_ENDPOINT!,","category":"sensitive","line_end":49,"severity":"high","line_start":49},{"id":"sensitive:SKILL.md:56:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"process.env.WEBPUBSUB_ENDPOINT!,","category":"sensitive","line_end":56,"severity":"high","line_start":56}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"The matched backticks form a TypeScript template literal used for logging or a response. No shell or command-execution API receives the interpolated value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"The matched backticks form a TypeScript template literal used for logging or a response. No shell or command-execution API receives the interpolated value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:195:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"The matched backticks form a TypeScript template literal used for logging or a response. No shell or command-execution API receives the interpolated value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","reason":"The matched backticks form a TypeScript template literal used for logging or a response. No shell or command-execution API receives the interpolated value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","reason":"The matched backticks form a TypeScript template literal used for logging or a response. No shell or command-execution API receives the interpolated value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"The matched backticks form a TypeScript template literal used for logging or a response. No shell or command-execution API receives the interpolated value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","reason":"The matched backticks form a TypeScript template literal used for logging or a response. No shell or command-execution API receives the interpolated value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:222:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:226:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:250:ruby-shell-backtick-execution","reason":"The matched backticks form a TypeScript template literal used for logging or a response. No shell or command-execution API receives the interpolated value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:251:ruby-shell-backtick-execution","reason":"The matched backticks form a TypeScript template literal used for logging or a response. No shell or command-execution API receives the interpolated value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:256:ruby-shell-backtick-execution","reason":"The matched backticks form a TypeScript template literal used for logging or a response. No shell or command-execution API receives the interpolated value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:260:ruby-shell-backtick-execution","reason":"The matched backticks form a TypeScript template literal used for logging or a response. No shell or command-execution API receives the interpolated value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:279:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","reason":"The matched text is a Markdown code fence delimiting an example. It does not invoke a shell or any command-execution API.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:155:fetch-api-call","reason":"The request targets the relative same-origin /negotiate route required by the documented Web PubSub client flow. It does not send data to an unknown external host.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:29:hardcoded-url","reason":"The Azure endpoint and access key are explicit angle-bracket placeholders in an environment-variable example. No real host or credential is hardcoded.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:30:hardcoded-url","reason":"The URL uses the documented Azure service domain with a resource-name placeholder. It is configuration guidance, not a concealed or untrusted destination.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:43:environment-variable-access-dot-notation","reason":"The named connection-string variable is passed directly to the Azure SDK client as intended. The example does not enumerate, print, or transmit environment data elsewhere.","verdict":"false_positive","confidence":0.97},{"id":"env_access:SKILL.md:49:environment-variable-access-dot-notation","reason":"The named endpoint variable supplies the Azure SDK service URL as intended. It is not secret collection, environment enumeration, or exfiltration.","verdict":"false_positive","confidence":0.97},{"id":"env_access:SKILL.md:56:environment-variable-access-dot-notation","reason":"The named endpoint variable supplies the Azure SDK service URL as intended. It is not secret collection, environment enumeration, or exfiltration.","verdict":"false_positive","confidence":0.97},{"id":"env_access:SKILL.md:43:environment-variable-object","reason":"The named connection-string variable is passed directly to the Azure SDK client as intended. The example does not enumerate, print, or transmit environment data elsewhere.","verdict":"false_positive","confidence":0.97},{"id":"env_access:SKILL.md:49:environment-variable-object","reason":"The named endpoint variable supplies the Azure SDK service URL as intended. It is not secret collection, environment enumeration, or exfiltration.","verdict":"false_positive","confidence":0.97},{"id":"env_access:SKILL.md:56:environment-variable-object","reason":"The named endpoint variable supplies the Azure SDK service URL as intended. It is not secret collection, environment enumeration, or exfiltration.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:SKILL.md:43:environment-file-access","reason":"This is process.env access to a specifically named Azure connection string, not environment-file access. The value is consumed by the intended Azure SDK client.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:49:environment-file-access","reason":"This is process.env access to a specifically named Azure endpoint, not an environment-file read. The endpoint value is not a credential.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:56:environment-file-access","reason":"This is process.env access to a specifically named Azure endpoint, not an environment-file read. The endpoint value is not a credential.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Client Access Token URL Logged","severity":"high","locations":[{"file":"SKILL.md","line_end":67,"line_start":67}],"confidence":0.96,"description":"The example logs token.url, whose own comment shows an access_token query parameter. Logs can expose this bearer credential to operators or log systems.","confidence_reasoning":"The documented value is a WebSocket URL containing access_token, and the next statement writes it to the console. This is direct credential disclosure."},{"title":"Negotiation Route Does Not Demonstrate Authentication","severity":"high","locations":[{"file":"SKILL.md","line_end":272,"line_start":267}],"confidence":0.88,"description":"The Express route issues a client access URL while using an optional user identity and showing no authentication check. Copied code could grant anonymous service access.","confidence_reasoning":"The complete route example calls getClientAccessToken without rejecting an absent user. External middleware could exist, but none is shown in this copyable example."}],"subject_marketplace_commit_sha":"5a26d1d61d694db29af9b138c661c1981076d9df","subject_content_hash":"0730476e5afa55acd8dbf57ccb08e46e19947cada3e26bff5048e1c497a8e638","subject_tree_hash":"82a3570e610043be567f419dcc76c9e824ca9047cd995a34e83232eebb7aa0d1","subject_plugin_path":"skills/sickn33/azure-web-pubsub-ts","audit_payload_hash":"9d44a168f503cdd55f0058de8c3729ba","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"5a26d1d61d694db29af9b138c661c1981076d9df","contentHash":"0730476e5afa55acd8dbf57ccb08e46e19947cada3e26bff5048e1c497a8e638","treeHash":"82a3570e610043be567f419dcc76c9e824ca9047cd995a34e83232eebb7aa0d1","pluginPath":"skills/sickn33/azure-web-pubsub-ts","auditPayloadHash":"9d44a168f503cdd55f0058de8c3729ba"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-azure-web-pubsub-ts/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}