{"data":{"skill":{"slug":"sickn33-crewai","name":"crewai","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/crewai","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"cf7d7788-9db9-4af7-8897-9cfb926da22c","skill_id":"5c0295be-72dd-4190-8cbb-7872bea9ea08","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:a998d8a28f63207ff779f361f47f5d0a24477f80ac5a4123f1b8c0aa415a54e0:3ab6b3fe2a9b8f2a168b9c7db9d009620351e0ba953a53d7f00db78c5d6f5ac2:736b696c6c732f7369636b6e33332f637265776169:db70683827d5d96bfe65dd83325d1898","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All seven static command findings are false positives caused by Markdown fences or inline code, with no Ruby or shell execution present. Semantic review identified unrestricted agent-controlled SQL execution and untrusted web research flowing into a downstream agent. Add database controls and indirect prompt injection defenses before publication.","remediation":[{"issue":"The database tool executes agent-supplied SQL without validation or authorization controls.","severity":"high","suggestion":"Use parameterized read-only queries, allowlist operations and tables, apply a least-privilege database role, and require approval before any write."},{"issue":"Retrieved web content becomes downstream agent context without an explicit trust boundary.","severity":"medium","suggestion":"Treat retrieved text as data, isolate it from instructions, detect instruction-like content, verify sources, and restrict downstream tools."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":415,"line_start":410},{"file":"SKILL.md","line_end":423,"line_start":415},{"file":"SKILL.md","line_end":428,"line_start":423},{"file":"SKILL.md","line_end":436,"line_start":428},{"file":"SKILL.md","line_end":441,"line_start":436},{"file":"SKILL.md","line_end":445,"line_start":441},{"file":"SKILL.md","line_end":445,"line_start":445}]}],"critical_findings":[],"high_findings":[{"title":"Unrestricted Agent-Controlled SQL Execution","locations":[{"file":"SKILL.md","line_end":394,"line_start":383}],"confidence":0.97,"description":"The custom tool passes arbitrary SQL directly to db.execute and assigns the tool to an agent. Model-generated or injected SQL could expose, alter, or delete data.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The example directly connects an unrestricted SQL string to database execution and exposes that function as an agent tool. No validation, authorization, or read-only boundary is shown."}],"medium_findings":[{"title":"Untrusted Web Content Reaches a Downstream Agent","locations":[{"file":"SKILL.md","line_end":96,"line_start":86},{"file":"SKILL.md","line_end":139,"line_start":127}],"confidence":0.86,"description":"The research agent uses web tools, and its output becomes writing-task context without isolation or validation. Malicious pages could influence downstream instructions through indirect prompt injection.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The configuration explicitly combines web retrieval with downstream task context. The absence of a trust-boundary control is clear, although exploit impact depends on the deployed tools and prompts."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":459,"audit_model":"codex","audited_at":"2026-07-23T21:57:08.279+00:00","created_at":"2026-07-26T08:19:38.932693+00:00","static_findings":[{"id":"external_commands:SKILL.md:410:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":415,"severity":"medium","line_start":410},{"id":"external_commands:SKILL.md:415:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":423,"severity":"medium","line_start":415},{"id":"external_commands:SKILL.md:423:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":428,"severity":"medium","line_start":423},{"id":"external_commands:SKILL.md:428:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":436,"severity":"medium","line_start":428},{"id":"external_commands:SKILL.md:436:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":441,"severity":"medium","line_start":436},{"id":"external_commands:SKILL.md:441:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":445,"severity":"medium","line_start":441},{"id":"external_commands:SKILL.md:445:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Works well with: `langgraph`, `autonomous-agents`, `langfuse`, `structured-output`","category":"external_commands","line_end":445,"severity":"medium","line_start":445}],"finding_verdicts":[{"id":"external_commands:SKILL.md:410:ruby-shell-backtick-execution","reason":"Lines 410-415 are a Markdown fence around a numbered workflow. They contain no Ruby backtick expression or shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:415:ruby-shell-backtick-execution","reason":"Line 415 closes a Markdown block, and the following lines are prose headings. No command interpreter or executable command is involved.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:423:ruby-shell-backtick-execution","reason":"Line 423 opens a Markdown fence containing four workflow steps. The backticks format documentation and do not execute external commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:428:ruby-shell-backtick-execution","reason":"Line 428 is a closing Markdown fence followed by prose. There is no Ruby or shell execution context.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:436:ruby-shell-backtick-execution","reason":"Line 436 opens a fenced list of design steps. The block contains documentation only and invokes no external process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:441:ruby-shell-backtick-execution","reason":"Line 441 closes a Markdown fence before the related-skills section. It is not a shell or Ruby backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:445:ruby-shell-backtick-execution","reason":"Line 445 uses inline backticks to format related skill names. The text is documentation and cannot execute commands.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Unrestricted Agent-Controlled SQL Execution","severity":"high","locations":[{"file":"SKILL.md","line_end":394,"line_start":383}],"confidence":0.97,"description":"The custom tool passes arbitrary SQL directly to db.execute and assigns the tool to an agent. Model-generated or injected SQL could expose, alter, or delete data.","confidence_reasoning":"The example directly connects an unrestricted SQL string to database execution and exposes that function as an agent tool. No validation, authorization, or read-only boundary is shown."},{"title":"Untrusted Web Content Reaches a Downstream Agent","severity":"medium","locations":[{"file":"SKILL.md","line_end":96,"line_start":86},{"file":"SKILL.md","line_end":139,"line_start":127}],"confidence":0.86,"description":"The research agent uses web tools, and its output becomes writing-task context without isolation or validation. Malicious pages could influence downstream instructions through indirect prompt injection.","confidence_reasoning":"The configuration explicitly combines web retrieval with downstream task context. The absence of a trust-boundary control is clear, although exploit impact depends on the deployed tools and prompts."}],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"a998d8a28f63207ff779f361f47f5d0a24477f80ac5a4123f1b8c0aa415a54e0","subject_tree_hash":"3ab6b3fe2a9b8f2a168b9c7db9d009620351e0ba953a53d7f00db78c5d6f5ac2","subject_plugin_path":"skills/sickn33/crewai","audit_payload_hash":"db70683827d5d96bfe65dd83325d1898","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"a998d8a28f63207ff779f361f47f5d0a24477f80ac5a4123f1b8c0aa415a54e0","treeHash":"3ab6b3fe2a9b8f2a168b9c7db9d009620351e0ba953a53d7f00db78c5d6f5ac2","pluginPath":"skills/sickn33/crewai","auditPayloadHash":"db70683827d5d96bfe65dd83325d1898"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-crewai/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}