{"data":{"skill":{"slug":"sickn33-documentation-generation-doc-generate","name":"documentation-generation-doc-generate","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/documentation-generation-doc-generate","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"0622206f-8ea4-4064-9fa0-3ef19f2d2165","skill_id":"e2859b82-3fb8-4574-aa16-d31d2887b4de","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:e67bf58cbb99d400ca5ead22ae5e0aed53f38c8129f40fabd75c5172a5c40576:1f7ea19a2b674530ee8c2ffb42d15b656b6e9bd7848fb05a5a947989e2cd82cf:736b696c6c732f7369636b6e33332f646f63756d656e746174696f6e2d67656e65726174696f6e2d646f632d67656e6572617465:4f41d7e16d0fe2a458f136b3407b93ec","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 30 static findings are false positives caused by prose, Markdown formatting, placeholders, and illustrative code or workflow examples. The skill contains no executable scripts and does not directly access commands, networks, files, or environment secrets. No prompt injection or malicious intent was found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"resources/implementation-playbook.md","line_end":254,"line_start":253},{"file":"resources/implementation-playbook.md","line_end":255,"line_start":254},{"file":"resources/implementation-playbook.md","line_end":256,"line_start":255},{"file":"resources/implementation-playbook.md","line_end":259,"line_start":256},{"file":"resources/implementation-playbook.md","line_end":356,"line_start":355},{"file":"resources/implementation-playbook.md","line_end":357,"line_start":356},{"file":"resources/implementation-playbook.md","line_end":363,"line_start":357},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":51,"line_start":51}]},{"factor":"network","evidence":[{"file":"resources/implementation-playbook.md","line_end":509,"line_start":509},{"file":"resources/implementation-playbook.md","line_end":503,"line_start":503},{"file":"resources/implementation-playbook.md","line_end":138,"line_start":138},{"file":"resources/implementation-playbook.md","line_end":469,"line_start":469},{"file":"resources/implementation-playbook.md","line_end":474,"line_start":474},{"file":"resources/implementation-playbook.md","line_end":500,"line_start":500},{"file":"resources/implementation-playbook.md","line_end":509,"line_start":509},{"file":"resources/implementation-playbook.md","line_end":520,"line_start":520}]},{"factor":"filesystem","evidence":[{"file":"resources/implementation-playbook.md","line_end":589,"line_start":589}]},{"factor":"env_access","evidence":[{"file":"resources/implementation-playbook.md","line_end":568,"line_start":568},{"file":"resources/implementation-playbook.md","line_end":319,"line_start":319},{"file":"resources/implementation-playbook.md","line_end":320,"line_start":320},{"file":"resources/implementation-playbook.md","line_end":321,"line_start":321},{"file":"resources/implementation-playbook.md","line_end":501,"line_start":501},{"file":"resources/implementation-playbook.md","line_end":511,"line_start":511},{"file":"resources/implementation-playbook.md","line_end":521,"line_start":521}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":698,"audit_model":"codex","audited_at":"2026-07-23T22:47:27.956+00:00","created_at":"2026-07-26T09:24:56.7041+00:00","static_findings":[{"id":"external_commands:resources/implementation-playbook.md:253:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"- `POST /users` - Create new user","category":"external_commands","line_end":254,"severity":"medium","line_start":253},{"id":"external_commands:resources/implementation-playbook.md:254:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"- `GET /users/{id}` - Get user details","category":"external_commands","line_end":255,"severity":"medium","line_start":254},{"id":"external_commands:resources/implementation-playbook.md:255:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"- `PUT /users/{id}` - Update user","category":"external_commands","line_end":256,"severity":"medium","line_start":255},{"id":"external_commands:resources/implementation-playbook.md:256:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"- `POST /auth/login` - User login","category":"external_commands","line_end":259,"severity":"medium","line_start":256},{"id":"external_commands:resources/implementation-playbook.md:355:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"2. Create a feature branch (`git checkout -b feature/amazing-feature`)","category":"external_commands","line_end":356,"severity":"medium","line_start":355},{"id":"external_commands:resources/implementation-playbook.md:356:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"3. Commit your changes (`git commit -m 'Add amazing feature'`)","category":"external_commands","line_end":357,"severity":"medium","line_start":356},{"id":"external_commands:resources/implementation-playbook.md:357:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"4. Push to the branch (`git push origin feature/amazing-feature`)","category":"external_commands","line_end":363,"severity":"medium","line_start":357},{"id":"network:resources/implementation-playbook.md:509:fetch-api-call","file":"resources/implementation-playbook.md","pattern":"Fetch API call","snippet":"const response = await fetch('https://api.example.com{endpoint['path']}', {{","category":"network","line_end":509,"severity":"low","line_start":509},{"id":"network:resources/implementation-playbook.md:503:python-http-libraries","file":"resources/implementation-playbook.md","pattern":"Python HTTP libraries","snippet":"response = requests.{endpoint['method'].lower()}(url, headers=headers)","category":"network","line_end":503,"severity":"low","line_start":503},{"id":"network:resources/implementation-playbook.md:138:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"- url: https://api.example.com/v1","category":"network","line_end":138,"severity":"low","line_start":138},{"id":"network:resources/implementation-playbook.md:469:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"<link rel=\"stylesheet\" href=\"https://cdn.jsdelivr.net/npm/swagger-ui-dist@latest/swagger-ui.css\">","category":"network","line_end":469,"severity":"low","line_start":469},{"id":"network:resources/implementation-playbook.md:474:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"<script src=\"https://cdn.jsdelivr.net/npm/swagger-ui-dist@latest/swagger-ui-bundle.js\"></script>","category":"network","line_end":474,"severity":"low","line_start":474},{"id":"network:resources/implementation-playbook.md:500:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"url = \"https://api.example.com{endpoint['path']}\"","category":"network","line_end":500,"severity":"low","line_start":500},{"id":"network:resources/implementation-playbook.md:509:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"const response = await fetch('https://api.example.com{endpoint['path']}', {{","category":"network","line_end":509,"severity":"low","line_start":509},{"id":"network:resources/implementation-playbook.md:520:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"curl -X {endpoint['method']} https://api.example.com{endpoint['path']} \\\\","category":"network","line_end":520,"severity":"low","line_start":520},{"id":"filesystem:resources/implementation-playbook.md:589:python-glob-pattern-matching","file":"resources/implementation-playbook.md","pattern":"Python glob/pattern matching","snippet":"for file_path in glob.glob(f\"{codebase_path}/**/*.py\", recursive=True):","category":"filesystem","line_end":589,"severity":"low","line_start":589},{"id":"env_access:resources/implementation-playbook.md:568:git-platform-tokens","file":"resources/implementation-playbook.md","pattern":"Git platform tokens","snippet":"github_token: ${{ secrets.GITHUB_TOKEN }}","category":"env_access","line_end":568,"severity":"high","line_start":568},{"id":"env_access:resources/implementation-playbook.md:319:database-connection-strings","file":"resources/implementation-playbook.md","pattern":"Database connection strings","snippet":"| DATABASE_URL | PostgreSQL connection string | - | Yes |","category":"env_access","line_end":319,"severity":"high","line_start":319},{"id":"env_access:resources/implementation-playbook.md:320:database-connection-strings","file":"resources/implementation-playbook.md","pattern":"Database connection strings","snippet":"| REDIS_URL | Redis connection string | - | Yes |","category":"env_access","line_end":320,"severity":"high","line_start":320},{"id":"env_access:resources/implementation-playbook.md:321:generic-api-secret-keys","file":"resources/implementation-playbook.md","pattern":"Generic API/secret keys","snippet":"| SECRET_KEY | Application secret key | - | Yes |","category":"env_access","line_end":321,"severity":"high","line_start":321},{"id":"env_access:resources/implementation-playbook.md:501:generic-api-secret-keys","file":"resources/implementation-playbook.md","pattern":"Generic API/secret keys","snippet":"headers = {{\"Authorization\": \"Bearer YOUR_API_KEY\"}}","category":"env_access","line_end":501,"severity":"high","line_start":501},{"id":"env_access:resources/implementation-playbook.md:511:generic-api-secret-keys","file":"resources/implementation-playbook.md","pattern":"Generic API/secret keys","snippet":"headers: {{'Authorization': 'Bearer YOUR_API_KEY'}}","category":"env_access","line_end":511,"severity":"high","line_start":511},{"id":"env_access:resources/implementation-playbook.md:521:generic-api-secret-keys","file":"resources/implementation-playbook.md","pattern":"Generic API/secret keys","snippet":"-H \"Authorization: Bearer YOUR_API_KEY\"","category":"env_access","line_end":521,"severity":"high","line_start":521},{"id":"blocker:resources/implementation-playbook.md:104:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"if any(base.id == 'BaseModel' for base in node.bases if hasattr(base, 'id')):","category":"blocker","line_end":104,"severity":"low","line_start":104},{"id":"blocker:resources/implementation-playbook.md:185:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"- id","category":"blocker","line_end":186,"severity":"low","line_start":185},{"id":"blocker:resources/implementation-playbook.md:190:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"format: uuid","category":"blocker","line_end":191,"severity":"low","line_start":190},{"id":"blocker:resources/implementation-playbook.md:204:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"```mermaid","category":"blocker","line_end":205,"severity":"low","line_start":204},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If detailed examples are required, open `resources/implementation-playbook.md`.","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `resources/implementation-playbook.md` for detailed examples and templates.","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"blocker:SKILL.md:41:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid exposing secrets, internal URLs, or sensitive data in docs.","category":"blocker","line_end":41,"severity":"low","line_start":41}],"finding_verdicts":[{"id":"external_commands:resources/implementation-playbook.md:253:ruby-shell-backtick-execution","reason":"The backticks format the API endpoint POST /users as inline Markdown. They do not invoke a shell or execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:254:ruby-shell-backtick-execution","reason":"The backticks format the API endpoint GET /users/{id} as inline Markdown. No shell execution syntax is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:255:ruby-shell-backtick-execution","reason":"The backticks format the API endpoint PUT /users/{id} as inline Markdown. This is documentation text, not executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:256:ruby-shell-backtick-execution","reason":"The backticks format the API endpoint POST /auth/login as inline Markdown. They do not perform command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:355:ruby-shell-backtick-execution","reason":"The git checkout command is a conventional contribution instruction displayed as inline Markdown. The skill does not execute it or insert untrusted arguments.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:resources/implementation-playbook.md:356:ruby-shell-backtick-execution","reason":"The git commit command is a static README example enclosed in Markdown backticks. It is not executed by the skill.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:resources/implementation-playbook.md:357:ruby-shell-backtick-execution","reason":"The git push command is a static contribution example with fixed arguments. No command execution or injection path exists in the skill.","verdict":"false_positive","confidence":0.98},{"id":"network:resources/implementation-playbook.md:509:fetch-api-call","reason":"The fetch call appears inside a code-example generator and uses the reserved example.com domain. The Markdown resource does not initiate a network request.","verdict":"false_positive","confidence":0.97},{"id":"network:resources/implementation-playbook.md:503:python-http-libraries","reason":"The requests call is generated documentation for an API usage example. It is presented inside a fenced code block and is not run by the skill.","verdict":"false_positive","confidence":0.97},{"id":"network:resources/implementation-playbook.md:138:hardcoded-url","reason":"The URL uses the reserved example.com domain in an OpenAPI template. It is illustrative documentation and does not contact a live service.","verdict":"false_positive","confidence":0.99},{"id":"network:resources/implementation-playbook.md:469:hardcoded-url","reason":"The jsDelivr stylesheet URL is part of an illustrative Swagger UI HTML template. The skill itself does not fetch or load the resource.","verdict":"false_positive","confidence":0.96},{"id":"network:resources/implementation-playbook.md:474:hardcoded-url","reason":"The jsDelivr script URL is shown in a fenced Swagger UI setup example. No network access occurs while the skill instructions are read.","verdict":"false_positive","confidence":0.96},{"id":"network:resources/implementation-playbook.md:500:hardcoded-url","reason":"The URL is a template string for generated Python API documentation and targets example.com. It is not an active endpoint or network action.","verdict":"false_positive","confidence":0.98},{"id":"network:resources/implementation-playbook.md:509:hardcoded-url","reason":"The URL is a placeholder inside a generated JavaScript API example and uses example.com. The skill does not send data to it.","verdict":"false_positive","confidence":0.98},{"id":"network:resources/implementation-playbook.md:520:hardcoded-url","reason":"The URL is part of a generated cURL example and uses the reserved example.com domain. It does not represent an executed request.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/implementation-playbook.md:589:python-glob-pattern-matching","reason":"The glob operation is an illustrative documentation-coverage implementation scoped to Python files under a supplied codebase path. The Markdown resource does not execute it.","verdict":"false_positive","confidence":0.95},{"id":"env_access:resources/implementation-playbook.md:568:git-platform-tokens","reason":"The expression references GitHub Actions built-in secret interpolation in an example deployment workflow. It contains no token value and the skill does not read the environment.","verdict":"false_positive","confidence":0.97},{"id":"env_access:resources/implementation-playbook.md:319:database-connection-strings","reason":"DATABASE_URL is only the name of a variable in a README configuration table. No connection string value is present or accessed.","verdict":"false_positive","confidence":0.99},{"id":"env_access:resources/implementation-playbook.md:320:database-connection-strings","reason":"REDIS_URL is only documented as a required configuration variable. The file neither supplies nor reads a Redis connection string.","verdict":"false_positive","confidence":0.99},{"id":"env_access:resources/implementation-playbook.md:321:generic-api-secret-keys","reason":"SECRET_KEY appears only as a variable name in a README template. There is no secret value or environment access.","verdict":"false_positive","confidence":0.99},{"id":"env_access:resources/implementation-playbook.md:501:generic-api-secret-keys","reason":"YOUR_API_KEY is an explicit placeholder in a generated Python API example. It is not a credential and is never read from the environment.","verdict":"false_positive","confidence":0.99},{"id":"env_access:resources/implementation-playbook.md:511:generic-api-secret-keys","reason":"YOUR_API_KEY is an explicit placeholder in a generated JavaScript example. The documentation contains no actual secret.","verdict":"false_positive","confidence":0.99},{"id":"env_access:resources/implementation-playbook.md:521:generic-api-secret-keys","reason":"YOUR_API_KEY is an explicit placeholder in a cURL documentation example. It does not expose or access a credential.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:104:system-reconnaissance","reason":"The id attribute belongs to a Python AST node while identifying Pydantic base classes. It is unrelated to host or system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:185:system-reconnaissance","reason":"The word id is an OpenAPI user-schema property. It does not inspect the operating system, host, or network.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:190:system-reconnaissance","reason":"The UUID format declaration describes an OpenAPI field. It performs no system discovery.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:204:system-reconnaissance","reason":"This line opens a Mermaid diagram code fence. It has no relationship to reconnaissance or system inspection.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The backticks format a local resource filename as inline Markdown. The instruction only tells the agent to read that file when detailed examples are needed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The backticks format the bundled playbook path in a resource list. They are not shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:41:system-reconnaissance","reason":"The line is a defensive instruction to avoid disclosing secrets, internal URLs, or sensitive data. It neither requests nor performs reconnaissance.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"e67bf58cbb99d400ca5ead22ae5e0aed53f38c8129f40fabd75c5172a5c40576","subject_tree_hash":"1f7ea19a2b674530ee8c2ffb42d15b656b6e9bd7848fb05a5a947989e2cd82cf","subject_plugin_path":"skills/sickn33/documentation-generation-doc-generate","audit_payload_hash":"4f41d7e16d0fe2a458f136b3407b93ec","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"e67bf58cbb99d400ca5ead22ae5e0aed53f38c8129f40fabd75c5172a5c40576","treeHash":"1f7ea19a2b674530ee8c2ffb42d15b656b6e9bd7848fb05a5a947989e2cd82cf","pluginPath":"skills/sickn33/documentation-generation-doc-generate","auditPayloadHash":"4f41d7e16d0fe2a458f136b3407b93ec"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-documentation-generation-doc-generate/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}