{"data":{"skill":{"slug":"sickn33-context-management-context-restore","name":"context-management-context-restore","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/context-management-context-restore","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"a6fa90b6-285f-48fd-acf6-467207c1aefb","skill_id":"363ab179-a8f5-4cc3-a5ec-0f1c740d1fcc","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:f2ba7da72ef567f71a299da6d88cbba1cb7740e192ee7c3cdc43655e734b7cd1:66c0497b0ea46e5d71c6780ad6528128adc2394b00321d608304784f5d8411ff:736b696c6c732f7369636b6e33332f636f6e746578742d6d616e6167656d656e742d636f6e746578742d726573746f7265:cdb021b86c5929b7c2a44d98fa2faee3","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 16 static findings are false positives caused by Markdown inline code and fenced examples, not Ruby or shell backtick execution. The conceptual restoration workflow lacks explicit isolation for untrusted instructions embedded in stored context. This creates a moderate context-poisoning risk that needs documented guardrails.","remediation":[{"issue":"Restored context can contain untrusted instructions that influence later agent behavior.","severity":"medium","suggestion":"Treat retrieved content as data, ignore embedded directives, verify provenance, and require confirmation before privileged or irreversible actions."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":69,"line_start":59},{"file":"SKILL.md","line_end":76,"line_start":69},{"file":"SKILL.md","line_end":89,"line_start":76},{"file":"SKILL.md","line_end":96,"line_start":89},{"file":"SKILL.md","line_end":118,"line_start":96},{"file":"SKILL.md","line_end":161,"line_start":118},{"file":"SKILL.md","line_end":170,"line_start":161}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Restored Context Lacks Prompt-Injection Isolation","locations":[{"file":"SKILL.md","line_end":151,"line_start":147}],"confidence":0.86,"description":"The workflow restores stored project context without requiring embedded directives to remain untrusted data. Poisoned memory could influence subsequent agent actions.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"Lines 147-151 direct context retrieval and restoration, while the only scanned file provides no trust-boundary or embedded-instruction handling."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":188,"audit_model":"codex","audited_at":"2026-07-23T21:11:38.78+00:00","created_at":"2026-07-26T07:22:23.912337+00:00","static_findings":[{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If detailed examples are required, open `resources/implementation-playbook.md`.","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `context_source`: Primary context storage location (vector database, file system)","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `project_identifier`: Unique project namespace","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `restoration_mode`:","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `full`: Complete context restoration","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `incremental`: Partial context update","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `diff`: Compare and merge context versions","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `token_budget`: Maximum context tokens to restore (default: 8192)","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `relevance_threshold`: Semantic similarity cutoff for context components (default: 0.75)","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":69,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":76,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":89,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":96,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":118,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":161,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":170,"severity":"medium","line_start":161}],"finding_verdicts":[{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks only format a relative documentation path in Markdown; they do not invoke Ruby, a shell, or any executable.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The backticks format the input parameter name context_source in prose and contain no executable expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The backticks format the input parameter name project_identifier in prose and contain no executable expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The backticks format the restoration_mode parameter name in Markdown and are not shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The backticks format the literal mode name full in a parameter list and do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The backticks format the literal mode name incremental in a parameter list and do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The backticks format the literal mode name diff in a parameter list and do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The backticks format the token_budget parameter name in documentation and contain no command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The backticks format the relevance_threshold parameter name in documentation and contain no command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"This is an opening Markdown fence for conceptual Python retrieval code, with no Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"This is a closing Markdown code fence followed by explanatory prose, not an executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"This is an opening Markdown fence for conceptual Python ranking code, with no external command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"This is a closing Markdown code fence followed by explanatory prose, not shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"This is an opening Markdown fence for conceptual Python rehydration code, with no Ruby or shell invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"This is a closing Markdown code fence followed by design guidance, not an executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","reason":"This is a fenced Bash usage example; it neither directs automatic execution nor uses shell backtick substitution.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Restored Context Lacks Prompt-Injection Isolation","severity":"medium","locations":[{"file":"SKILL.md","line_end":151,"line_start":147}],"confidence":0.86,"description":"The workflow restores stored project context without requiring embedded directives to remain untrusted data. Poisoned memory could influence subsequent agent actions.","confidence_reasoning":"Lines 147-151 direct context retrieval and restoration, while the only scanned file provides no trust-boundary or embedded-instruction handling."}],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"f2ba7da72ef567f71a299da6d88cbba1cb7740e192ee7c3cdc43655e734b7cd1","subject_tree_hash":"66c0497b0ea46e5d71c6780ad6528128adc2394b00321d608304784f5d8411ff","subject_plugin_path":"skills/sickn33/context-management-context-restore","audit_payload_hash":"cdb021b86c5929b7c2a44d98fa2faee3","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"f2ba7da72ef567f71a299da6d88cbba1cb7740e192ee7c3cdc43655e734b7cd1","treeHash":"66c0497b0ea46e5d71c6780ad6528128adc2394b00321d608304784f5d8411ff","pluginPath":"skills/sickn33/context-management-context-restore","auditPayloadHash":"cdb021b86c5929b7c2a44d98fa2faee3"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-context-management-context-restore/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}