{"data":{"skill":{"slug":"sickn33-data-structure-protocol","name":"data-structure-protocol","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/data-structure-protocol","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"4a4694ef-b7e9-47c7-8c42-2dc4c17b0c15","skill_id":"48c7c1a2-706f-4cdb-93b0-d99588e72ccc","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:8253699188e1c92ea2eb2ba480dcaa318b14ca06ef2bfea73f980a5a8a70eade:cd3828bc3f285cc678a5974e3271e14581e1cae591c6c2fca3dee54eea9a8b0e:736b696c6c732f7369636b6e33332f646174612d7374727563747572652d70726f746f636f6c:756a592c8fef1e2f694f6628ec77ad64","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Two linked findings confirm one supply-chain risk: an unpinned Python CLI is downloaded from a mutable branch and later executed. The other 53 findings are safe Markdown, fixed local examples, metadata, or documentation links. No prompt injection or malicious intent was found.","remediation":[{"issue":"The setup downloads executable Python from an unpinned main-branch URL without integrity verification.","severity":"high","suggestion":"Bundle the reviewed CLI or pin its URL to an immutable commit, publish a SHA-256 checksum, and verify it before execution."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":43,"line_start":40},{"file":"SKILL.md","line_end":45,"line_start":43},{"file":"SKILL.md","line_end":48,"line_start":45},{"file":"SKILL.md","line_end":52,"line_start":48},{"file":"SKILL.md","line_end":56,"line_start":52},{"file":"SKILL.md","line_end":58,"line_start":56},{"file":"SKILL.md","line_end":74,"line_start":58},{"file":"SKILL.md","line_end":80,"line_start":74},{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":88,"line_start":86},{"file":"SKILL.md","line_end":90,"line_start":88},{"file":"SKILL.md","line_end":92,"line_start":90},{"file":"SKILL.md","line_end":96,"line_start":92},{"file":"SKILL.md","line_end":98,"line_start":96},{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":99,"line_start":99},{"file":"SKILL.md","line_end":102,"line_start":102},{"file":"SKILL.md","line_end":106,"line_start":106},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":117,"line_start":110},{"file":"SKILL.md","line_end":117,"line_start":117},{"file":"SKILL.md","line_end":118,"line_start":118},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":120,"line_start":120},{"file":"SKILL.md","line_end":121,"line_start":121},{"file":"SKILL.md","line_end":122,"line_start":122},{"file":"SKILL.md","line_end":128,"line_start":128},{"file":"SKILL.md","line_end":129,"line_start":129},{"file":"SKILL.md","line_end":131,"line_start":130},{"file":"SKILL.md","line_end":131,"line_start":131},{"file":"SKILL.md","line_end":133,"line_start":132},{"file":"SKILL.md","line_end":134,"line_start":133},{"file":"SKILL.md","line_end":135,"line_start":134},{"file":"SKILL.md","line_end":142,"line_start":135},{"file":"SKILL.md","line_end":154,"line_start":142},{"file":"SKILL.md","line_end":158,"line_start":154},{"file":"SKILL.md","line_end":164,"line_start":158},{"file":"SKILL.md","line_end":168,"line_start":164},{"file":"SKILL.md","line_end":174,"line_start":168},{"file":"SKILL.md","line_end":179,"line_start":174},{"file":"SKILL.md","line_end":180,"line_start":179},{"file":"SKILL.md","line_end":182,"line_start":180},{"file":"SKILL.md","line_end":183,"line_start":182},{"file":"SKILL.md","line_end":184,"line_start":183}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":5,"line_start":5},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":196,"line_start":196},{"file":"SKILL.md","line_end":197,"line_start":197},{"file":"SKILL.md","line_end":198,"line_start":198}]}],"critical_findings":[],"high_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":90,"line_start":88}],"confidence":0.98,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Lines 88-90 direct a shell to download an unpinned Python script from a mutable branch. The skill later invokes that file, creating a remote supply-chain execution risk."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":89,"line_start":89}],"confidence":0.98,"description":"curl -O https://raw.githubusercontent.com/k-kolomeitsev/data-structure-protocol/main/skills/data-str","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The URL downloads executable Python from the repository's mutable main branch without a checksum or signature. Later instructions run the downloaded file with project access."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":204,"audit_model":"codex","audited_at":"2026-07-23T22:22:51.074+00:00","created_at":"2026-07-26T08:21:58.110556+00:00","static_findings":[{"id":"external_commands:SKILL.md:11:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"LLM coding agents lose context between tasks. On large codebases they spend most of their tokens on ","category":"external_commands","line_end":11,"severity":"medium","line_start":11},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- The project has a `.dsp/` directory (DSP is already set up)","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- The user mentions DSP, dsp-cli, `.dsp`, or structure mapping","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Every entity gets a stable UID: `obj-<8hex>` for objects, `func-<8hex>` for functions. File paths ar","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":43,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":45,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":48,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":52,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"When an import is recorded, DSP stores a short reason explaining *why* that dependency exists. This ","category":"external_commands","line_end":56,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Each entity gets a small directory under `.dsp/`:","category":"external_commands","line_end":58,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":74,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Every file or artifact that is imported anywhere must be represented in `.dsp` as an Object — code, ","category":"external_commands","line_end":80,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The skill relies on a standalone Python CLI script `dsp-cli.py`. If it is missing from the project, ","category":"external_commands","line_end":88,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":90,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":92,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Requires **Python 3.10+**. All commands use `python dsp-cli.py --root <project-root> <command>`.","category":"external_commands","line_end":96,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If `.dsp/` is empty, traverse the project from root entrypoint(s) via DFS on imports:","category":"external_commands","line_end":98,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Identify root entrypoints (`package.json` main, framework entry, `main.py`, etc.)","category":"external_commands","line_end":98,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Document the root file: `create-object`, `create-function` for each export, `create-shared`, `add","category":"external_commands","line_end":99,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. External dependencies: `create-object --kind external`, add to TOC, but never descend into `node_","category":"external_commands","line_end":102,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Before changing code**: Find affected entities via `search`, `find-by-source`, or `read-toc`. Re","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **When creating a file/module**: Call `create-object`. For each exported function — `create-functi","category":"external_commands","line_end":107,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **When adding an import**: Call `add-import` with a brief `why`. For external deps — first `create","category":"external_commands","line_end":108,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **When removing import/export/file**: Call `remove-import`, `remove-shared`, `remove-entity`. Casc","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **When renaming/moving a file**: Call `move-entity`. UID does not change.","category":"external_commands","line_end":117,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Create** | `init`, `create-object`, `create-function`, `create-shared`, `add-import` |","category":"external_commands","line_end":117,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Update** | `update-description`, `update-import-why`, `move-entity` |","category":"external_commands","line_end":118,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Delete** | `remove-import`, `remove-shared`, `remove-entity` |","category":"external_commands","line_end":119,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Navigate** | `get-entity`, `get-children --depth N`, `get-parents --depth N`, `get-path`, `get-r","category":"external_commands","line_end":120,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Search** | `search <query>`, `find-by-source <path>` |","category":"external_commands","line_end":121,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Diagnostics** | `detect-cycles`, `get-orphans`, `get-stats` |","category":"external_commands","line_end":122,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| New file/module | `create-object` + `create-function` + `create-shared` + `add-import` |","category":"external_commands","line_end":128,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| New import added | `add-import` (+ `create-object --kind external` if new dep) |","category":"external_commands","line_end":129,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Import removed | `remove-import` |","category":"external_commands","line_end":131,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Export added | `create-shared` (+ `create-function` if new) |","category":"external_commands","line_end":131,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Export removed | `remove-shared` |","category":"external_commands","line_end":133,"severity":"medium","line_start":132},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| File renamed/moved | `move-entity` |","category":"external_commands","line_end":134,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| File deleted | `remove-entity` |","category":"external_commands","line_end":135,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Purpose changed | `update-description` |","category":"external_commands","line_end":142,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":154,"severity":"medium","line_start":142},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":158,"severity":"medium","line_start":154},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":164,"severity":"medium","line_start":158},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":168,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":174,"severity":"medium","line_start":168},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":179,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ **Do:** Always add a meaningful `why` reason when recording an import — this is where most of DS","category":"external_commands","line_end":180,"severity":"medium","line_start":179},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ **Do:** Use `kind: external` for third-party libraries without analyzing their internals","category":"external_commands","line_end":182,"severity":"medium","line_start":180},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ✅ **Do:** Treat `.dsp/` diffs like code diffs — review them, keep them accurate","category":"external_commands","line_end":183,"severity":"medium","line_start":182},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- ❌ **Don't:** Touch `.dsp/` for internal-only changes that don't affect purpose or dependencies","category":"external_commands","line_end":184,"severity":"medium","line_start":183},{"id":"network:SKILL.md:5:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"source: \"https://github.com/k-kolomeitsev/data-structure-protocol\"","category":"network","line_end":5,"severity":"low","line_start":5},{"id":"network:SKILL.md:89:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -O https://raw.githubusercontent.com/k-kolomeitsev/data-structure-protocol/main/skills/data-str","category":"network","line_end":89,"severity":"low","line_start":89},{"id":"network:SKILL.md:196:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Full architecture specification**: [ARCHITECTURE.md](https://github.com/k-kolomeitsev/data-struc","category":"network","line_end":196,"severity":"low","line_start":196},{"id":"network:SKILL.md:197:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **CLI source + reference docs**: [skills/data-structure-protocol](https://github.com/k-kolomeitsev","category":"network","line_end":197,"severity":"low","line_start":197},{"id":"network:SKILL.md:198:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Introduction article**: [article.md](https://github.com/k-kolomeitsev/data-structure-protocol/bl","category":"network","line_end":198,"severity":"low","line_start":198}],"finding_verdicts":[{"id":"external_commands:SKILL.md:11:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown fence delimiters around source or directory examples. They do not perform Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown fence delimiters around source or directory examples. They do not perform Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown fence delimiters around source or directory examples. They do not perform Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown fence delimiters around source or directory examples. They do not perform Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown fence delimiters around source or directory examples. They do not perform Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown fence delimiters around source or directory examples. They do not perform Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"Lines 88-90 direct a shell to download an unpinned Python script from a mutable branch. The skill later invokes that file, creating a remote supply-chain execution risk.","verdict":"confirmed","severity":"high","confidence":0.98},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","reason":"This range is a fenced usage example for the local DSP CLI. It uses fixed Python commands and contains no shell substitution or untrusted command construction.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","reason":"This range is a fenced usage example for the local DSP CLI. It uses fixed Python commands and contains no shell substitution or untrusted command construction.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","reason":"This range is a fenced usage example for the local DSP CLI. It uses fixed Python commands and contains no shell substitution or untrusted command construction.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"This range is a fenced usage example for the local DSP CLI. It uses fixed Python commands and contains no shell substitution or untrusted command construction.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","reason":"This range is a fenced usage example for the local DSP CLI. It uses fixed Python commands and contains no shell substitution or untrusted command construction.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"This range is a fenced usage example for the local DSP CLI. It uses fixed Python commands and contains no shell substitution or untrusted command construction.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"The detected backticks format paths, identifiers, or command names in Markdown. The cited text contains no Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:5:hardcoded-url","reason":"This URL is source metadata or a documentation reference to the declared GitHub project. The cited line does not request data or transmit sensitive information.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:89:hardcoded-url","reason":"The URL downloads executable Python from the repository's mutable main branch without a checksum or signature. Later instructions run the downloaded file with project access.","verdict":"confirmed","severity":"high","confidence":0.98},{"id":"network:SKILL.md:196:hardcoded-url","reason":"This URL is source metadata or a documentation reference to the declared GitHub project. The cited line does not request data or transmit sensitive information.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:197:hardcoded-url","reason":"This URL is source metadata or a documentation reference to the declared GitHub project. The cited line does not request data or transmit sensitive information.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:198:hardcoded-url","reason":"This URL is source metadata or a documentation reference to the declared GitHub project. The cited line does not request data or transmit sensitive information.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"8253699188e1c92ea2eb2ba480dcaa318b14ca06ef2bfea73f980a5a8a70eade","subject_tree_hash":"cd3828bc3f285cc678a5974e3271e14581e1cae591c6c2fca3dee54eea9a8b0e","subject_plugin_path":"skills/sickn33/data-structure-protocol","audit_payload_hash":"756a592c8fef1e2f694f6628ec77ad64","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"8253699188e1c92ea2eb2ba480dcaa318b14ca06ef2bfea73f980a5a8a70eade","treeHash":"cd3828bc3f285cc678a5974e3271e14581e1cae591c6c2fca3dee54eea9a8b0e","pluginPath":"skills/sickn33/data-structure-protocol","auditPayloadHash":"756a592c8fef1e2f694f6628ec77ad64"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-data-structure-protocol/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}