{"data":{"skill":{"slug":"sickn33-deployment-pipeline-design","name":"deployment-pipeline-design","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/deployment-pipeline-design","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"507ee1e9-a40f-4962-a1c2-8b6d82042079","skill_id":"20426079-2621-4471-aa2e-70c8fabd0ced","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:186729ad20953894a21cc253ac3934d90f74bbbd6ab691831429af8f63882166:0c3cf168b38d8cbd9af2f022a439dc677559e3f762af31f5dc2e016677d70efa:736b696c6c732f7369636b6e33332f6465706c6f796d656e742d706970656c696e652d64657369676e:c871ff8cbc0fa76587e361e0b6784a21","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 37 static findings are false positives caused by Markdown backticks, inert CI examples, placeholder domains, and a literal API_KEY placeholder. No code executes commands, reads environment secrets, or contacts external services, and no prompt injection or malicious intent was found.","remediation":[{"issue":"Command and workflow examples could be copied into production without environment-specific review.","severity":"low","suggestion":"Label every snippet as a template and require validation of commands, endpoints, permissions, and failure handling."},{"issue":"The feature flag example uses a literal API_KEY placeholder.","severity":"low","suggestion":"Demonstrate secret-store or environment-based injection so users do not replace the placeholder with a hardcoded credential."},{"issue":"The skill references resource and asset files that are absent from the package.","severity":"low","suggestion":"Include the referenced files or remove those references to prevent incomplete implementation guidance."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":45,"line_start":41},{"file":"SKILL.md","line_end":63,"line_start":45},{"file":"SKILL.md","line_end":75,"line_start":63},{"file":"SKILL.md","line_end":79,"line_start":75},{"file":"SKILL.md","line_end":91,"line_start":79},{"file":"SKILL.md","line_end":95,"line_start":91},{"file":"SKILL.md","line_end":113,"line_start":95},{"file":"SKILL.md","line_end":115,"line_start":113},{"file":"SKILL.md","line_end":121,"line_start":115},{"file":"SKILL.md","line_end":133,"line_start":121},{"file":"SKILL.md","line_end":143,"line_start":133},{"file":"SKILL.md","line_end":155,"line_start":143},{"file":"SKILL.md","line_end":165,"line_start":155},{"file":"SKILL.md","line_end":182,"line_start":165},{"file":"SKILL.md","line_end":192,"line_start":182},{"file":"SKILL.md","line_end":203,"line_start":192},{"file":"SKILL.md","line_end":215,"line_start":203},{"file":"SKILL.md","line_end":280,"line_start":215},{"file":"SKILL.md","line_end":299,"line_start":280},{"file":"SKILL.md","line_end":322,"line_start":299},{"file":"SKILL.md","line_end":326,"line_start":322},{"file":"SKILL.md","line_end":335,"line_start":326},{"file":"SKILL.md","line_end":350,"line_start":335},{"file":"SKILL.md","line_end":363,"line_start":350},{"file":"SKILL.md","line_end":367,"line_start":363},{"file":"SKILL.md","line_end":368,"line_start":367},{"file":"SKILL.md","line_end":372,"line_start":368},{"file":"SKILL.md","line_end":373,"line_start":372},{"file":"SKILL.md","line_end":374,"line_start":373},{"file":"SKILL.md","line_end":357,"line_start":357},{"file":"SKILL.md","line_end":359,"line_start":359},{"file":"SKILL.md","line_end":363,"line_start":350}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":275,"line_start":275},{"file":"SKILL.md","line_end":312,"line_start":312}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":195,"line_start":195}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":380,"audit_model":"codex","audited_at":"2026-07-23T22:00:03.184+00:00","created_at":"2026-07-26T09:22:40.336905+00:00","static_findings":[{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If detailed examples are required, open `resources/implementation-playbook.md`.","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":45,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":63,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":75,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":79,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":91,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":95,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":113,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":115,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Reference:** See `assets/approval-gate-template.yml`","category":"external_commands","line_end":121,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":133,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":143,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":155,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":165,"severity":"medium","line_start":155},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":182,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":192,"severity":"medium","line_start":182},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":203,"severity":"medium","line_start":192},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":215,"severity":"medium","line_start":203},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":280,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:280:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":299,"severity":"medium","line_start":280},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":322,"severity":"medium","line_start":299},{"id":"external_commands:SKILL.md:322:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":326,"severity":"medium","line_start":322},{"id":"external_commands:SKILL.md:326:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":335,"severity":"medium","line_start":326},{"id":"external_commands:SKILL.md:335:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":350,"severity":"medium","line_start":335},{"id":"external_commands:SKILL.md:350:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```yaml","category":"external_commands","line_end":363,"severity":"medium","line_start":350},{"id":"external_commands:SKILL.md:363:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":367,"severity":"medium","line_start":363},{"id":"external_commands:SKILL.md:367:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `references/pipeline-orchestration.md` - Complex pipeline patterns","category":"external_commands","line_end":368,"severity":"medium","line_start":367},{"id":"external_commands:SKILL.md:368:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `assets/approval-gate-template.yml` - Approval workflow templates","category":"external_commands","line_end":372,"severity":"medium","line_start":368},{"id":"external_commands:SKILL.md:372:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `github-actions-templates` - For GitHub Actions implementation","category":"external_commands","line_end":373,"severity":"medium","line_start":372},{"id":"external_commands:SKILL.md:373:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `gitlab-ci-patterns` - For GitLab CI implementation","category":"external_commands","line_end":374,"severity":"medium","line_start":373},{"id":"external_commands:SKILL.md:357:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"ERROR_RATE=$(curl -s \"$PROMETHEUS_URL/api/v1/query?query=rate(http_errors_total[5m])\" | jq '.data.re","category":"external_commands","line_end":357,"severity":"medium","line_start":357},{"id":"external_commands:SKILL.md:359:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"if (( $(echo \"$ERROR_RATE > 0.01\" | bc -l) )); then","category":"external_commands","line_end":359,"severity":"medium","line_start":359},{"id":"external_commands:SKILL.md:350:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"```yaml","category":"external_commands","line_end":363,"severity":"medium","line_start":350},{"id":"network:SKILL.md:69:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"url: https://app.example.com","category":"network","line_end":69,"severity":"low","line_start":69},{"id":"network:SKILL.md:275:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"run: curl -f https://app.example.com/health","category":"network","line_end":275,"severity":"low","line_start":275},{"id":"network:SKILL.md:312:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"if curl -sf https://app.example.com/health; then","category":"network","line_end":312,"severity":"low","line_start":312},{"id":"env_access:SKILL.md:195:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"flagsmith = Flagsmith(environment_key=\"API_KEY\")","category":"env_access","line_end":195,"severity":"high","line_start":195}],"finding_verdicts":[{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"Line 23 uses Markdown inline backticks around a referenced file path; it contains no Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"Lines 41-45 are a fenced Markdown diagram, so the backticks delimit documentation and do not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"Line 45 closes a fenced Markdown diagram; no interpreter or executable Ruby construct is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"Line 63 opens a YAML documentation fence for a GitHub Actions example, not a Ruby or shell execution context.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"Line 75 closes the preceding YAML example and has no command execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"Line 79 opens a fenced GitLab CI example; the Markdown backticks are not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"Line 91 only closes a Markdown code fence and does not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"Line 95 opens an inert Azure Pipelines YAML example within documentation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"Line 113 closes a Markdown YAML fence; no backtick command expression exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"Line 115 places a referenced asset path in Markdown inline code and does not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"Line 121 opens an illustrative Kubernetes YAML block, outside any executable Ruby or shell file.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"Line 133 is the closing delimiter for a Markdown YAML example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"Line 143 begins a documented blue-green deployment example; the backticks are only a Markdown fence.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","reason":"Line 155 closes the documented deployment example and cannot execute its contents.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"Line 165 opens an Argo Rollouts YAML example in Markdown, not an executable context.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","reason":"Line 182 only closes the preceding Markdown YAML fence.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","reason":"Line 192 opens a fenced Python feature-flag example; Markdown rendering does not run this code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","reason":"Line 203 closes an inert Python documentation block and contains no shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"Line 215 opens a documented GitHub Actions workflow; the fence itself does not execute workflow commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:280:ruby-shell-backtick-execution","reason":"Line 280 closes a Markdown workflow example and is not an executable backtick construct.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","reason":"Line 299 begins a fenced rollback workflow example in documentation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:322:ruby-shell-backtick-execution","reason":"Line 322 closes the rollback YAML example and has no command execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:326:ruby-shell-backtick-execution","reason":"Line 326 opens a fenced Bash example for manual rollback; the Markdown skill does not invoke it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:335:ruby-shell-backtick-execution","reason":"Line 335 closes an illustrative Bash block rather than executing a backtick command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:350:ruby-shell-backtick-execution","reason":"Line 350 opens an inert YAML example for post-deployment monitoring.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:363:ruby-shell-backtick-execution","reason":"Line 363 closes the monitoring example and contains no executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:367:ruby-shell-backtick-execution","reason":"Line 367 formats a reference path as Markdown inline code; it does not execute the path.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:368:ruby-shell-backtick-execution","reason":"Line 368 formats an asset path with Markdown backticks and has no command behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:372:ruby-shell-backtick-execution","reason":"Line 372 formats a related skill name as inline code; no shell or Ruby execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:373:ruby-shell-backtick-execution","reason":"Line 373 uses Markdown backticks around a related skill name, not an executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:357:shell-command-substitution","reason":"Line 357 is an inert monitoring example that queries a configured Prometheus endpoint and parses one response value; the skill does not execute it.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:359:shell-command-substitution","reason":"Line 359 documents a numeric threshold comparison using a quoted value; it is not executed by the Markdown skill.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:350:template-literal-with-command-substitution","reason":"Lines 350-363 are a fenced YAML example, not a JavaScript template literal or active interpolation context.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:69:hardcoded-url","reason":"Line 69 uses the reserved example.com domain as a placeholder environment URL and makes no request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:275:hardcoded-url","reason":"Line 275 documents a health-check command against the reserved example.com domain; the skill does not perform the request.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:312:hardcoded-url","reason":"Line 312 uses the reserved example.com domain in an illustrative rollback health check, with no active network behavior.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:195:generic-api-secret-keys","reason":"Line 195 passes the literal placeholder \"API_KEY\" to an inert Python example; it neither reads nor exposes a real secret.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"186729ad20953894a21cc253ac3934d90f74bbbd6ab691831429af8f63882166","subject_tree_hash":"0c3cf168b38d8cbd9af2f022a439dc677559e3f762af31f5dc2e016677d70efa","subject_plugin_path":"skills/sickn33/deployment-pipeline-design","audit_payload_hash":"c871ff8cbc0fa76587e361e0b6784a21","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"186729ad20953894a21cc253ac3934d90f74bbbd6ab691831429af8f63882166","treeHash":"0c3cf168b38d8cbd9af2f022a439dc677559e3f762af31f5dc2e016677d70efa","pluginPath":"skills/sickn33/deployment-pipeline-design","auditPayloadHash":"c871ff8cbc0fa76587e361e0b6784a21"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-deployment-pipeline-design/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}