{"data":{"skill":{"slug":"sickn33-error-diagnostics-error-trace","name":"error-diagnostics-error-trace","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/error-diagnostics-error-trace","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"8b9e6554-cdd9-4b02-985d-bc17563332d8","skill_id":"975fb770-4ceb-4484-9432-0ff66fe5e611","version":5,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:21926d8600293dd7e649b1a106a81c9d542f609b077a2599f83586564874152f:0f55898048a2fe13faa2512d5a67b2f0538e51735ff8d415c03b6d93b19abd3a:736b696c6c732f7369636b6e33332f6572726f722d646961676e6f73746963732d6572726f722d7472616365:db1f2ad886df0f5e565911971c9b8301","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 13 static findings are false positives caused by documentation examples, JavaScript template literals, Markdown code spans, or benign observability integrations. No executable shell commands, environment-secret reads, reconnaissance behavior, unauthorized network activity, or prompt injection was found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"resources/implementation-playbook.md","line_end":425,"line_start":419},{"file":"resources/implementation-playbook.md","line_end":429,"line_start":425},{"file":"resources/implementation-playbook.md","line_end":541,"line_start":494},{"file":"resources/implementation-playbook.md","line_end":585,"line_start":541},{"file":"resources/implementation-playbook.md","line_end":1358,"line_start":1250},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":51,"line_start":51}]},{"factor":"network","evidence":[{"file":"resources/implementation-playbook.md","line_end":415,"line_start":415},{"file":"resources/implementation-playbook.md","line_end":1333,"line_start":1333}]},{"factor":"env_access","evidence":[{"file":"resources/implementation-playbook.md","line_end":238,"line_start":238},{"file":"resources/implementation-playbook.md","line_end":239,"line_start":239},{"file":"resources/implementation-playbook.md","line_end":374,"line_start":374}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":1429,"audit_model":"codex","audited_at":"2026-07-23T23:51:40.501+00:00","created_at":"2026-07-26T11:22:53.220741+00:00","static_findings":[{"id":"external_commands:resources/implementation-playbook.md:419:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"'Authorization': `Bearer ${this.config.apiKey}`","category":"external_commands","line_end":425,"severity":"medium","line_start":419},{"id":"external_commands:resources/implementation-playbook.md:425:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`Error tracking API returned ${response.status}`);","category":"external_commands","line_end":429,"severity":"medium","line_start":425},{"id":"external_commands:resources/implementation-playbook.md:494:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"index: `logs-${config.service}`,","category":"external_commands","line_end":541,"severity":"medium","line_start":494},{"id":"external_commands:resources/implementation-playbook.md:541:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"this.info(`Timer ${label}`, { duration, label });","category":"external_commands","line_end":585,"severity":"medium","line_start":541},{"id":"external_commands:resources/implementation-playbook.md:1250:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"value={`${(metrics.errorRate * 100).toFixed(2)}%`}","category":"external_commands","line_end":1358,"severity":"medium","line_start":1250},{"id":"network:resources/implementation-playbook.md:415:fetch-api-call","file":"resources/implementation-playbook.md","pattern":"Fetch API call","snippet":"const response = await fetch(this.config.endpoint, {","category":"network","line_end":415,"severity":"low","line_start":415},{"id":"network:resources/implementation-playbook.md:1333:server-sent-events","file":"resources/implementation-playbook.md","pattern":"Server-Sent Events","snippet":"const eventSource = new EventSource('/api/errors/stream');","category":"network","line_end":1333,"severity":"medium","line_start":1333},{"id":"env_access:resources/implementation-playbook.md:238:configuration-library","file":"resources/implementation-playbook.md","pattern":"Configuration library","snippet":"if (this.config.getUserContext) {","category":"env_access","line_end":238,"severity":"low","line_start":238},{"id":"env_access:resources/implementation-playbook.md:239:configuration-library","file":"resources/implementation-playbook.md","pattern":"Configuration library","snippet":"event.user = this.config.getUserContext();","category":"env_access","line_end":239,"severity":"low","line_start":239},{"id":"env_access:resources/implementation-playbook.md:374:generic-api-secret-keys","file":"resources/implementation-playbook.md","pattern":"Generic API/secret keys","snippet":"const sensitiveKeys = ['password', 'token', 'secret', 'api_key'];","category":"env_access","line_end":374,"severity":"high","line_start":374},{"id":"blocker:resources/implementation-playbook.md:537:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"startTimer(label: string): () => void {","category":"blocker","line_end":537,"severity":"low","line_start":537},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If detailed examples are required, open `resources/implementation-playbook.md`.","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `resources/implementation-playbook.md` for detailed patterns and examples.","category":"external_commands","line_end":51,"severity":"medium","line_start":51}],"finding_verdicts":[{"id":"external_commands:resources/implementation-playbook.md:419:ruby-shell-backtick-execution","reason":"The backticks form a JavaScript template literal for an Authorization header inside a documentation example. They do not invoke a shell or execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:425:ruby-shell-backtick-execution","reason":"The backticks construct a JavaScript error message containing an HTTP status. No shell or external process is involved.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:494:ruby-shell-backtick-execution","reason":"The backticks construct an Elasticsearch index name in TypeScript example code. This is string interpolation, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:541:ruby-shell-backtick-execution","reason":"The backticks format a timer log message in TypeScript. The example calls the local logger and does not launch an external process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:1250:ruby-shell-backtick-execution","reason":"The backticks format a percentage for a React dashboard property. This is presentation logic with no command execution.","verdict":"false_positive","confidence":0.99},{"id":"network:resources/implementation-playbook.md:415:fetch-api-call","reason":"The fetch appears in a labeled error-tracking integration example and sends sanitized events to the configured service endpoint. This matches the skill purpose and shows no unauthorized destination or exfiltration intent.","verdict":"false_positive","confidence":0.96},{"id":"network:resources/implementation-playbook.md:1333:server-sent-events","reason":"The EventSource connects to a relative application route for the documented live error dashboard. It does not contact an external host or transmit data.","verdict":"false_positive","confidence":0.98},{"id":"env_access:resources/implementation-playbook.md:238:configuration-library","reason":"This line checks whether an optional getUserContext callback exists. It does not read environment variables or credentials.","verdict":"false_positive","confidence":0.99},{"id":"env_access:resources/implementation-playbook.md:239:configuration-library","reason":"This line invokes the configured user-context callback for an error event. It contains no environment access or secret retrieval.","verdict":"false_positive","confidence":0.99},{"id":"env_access:resources/implementation-playbook.md:374:generic-api-secret-keys","reason":"The listed secret-related words are redaction keys used to remove sensitive fields before reporting. No secret value is accessed, embedded, or disclosed.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:537:system-reconnaissance","reason":"The startTimer method measures elapsed application time for performance logging. It performs no host discovery, system inspection, or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting around a relative resource filename. The instruction opens documentation and does not execute a shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting around the documented resource path. No command syntax or execution instruction is present.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"21926d8600293dd7e649b1a106a81c9d542f609b077a2599f83586564874152f","subject_tree_hash":"0f55898048a2fe13faa2512d5a67b2f0538e51735ff8d415c03b6d93b19abd3a","subject_plugin_path":"skills/sickn33/error-diagnostics-error-trace","audit_payload_hash":"db1f2ad886df0f5e565911971c9b8301","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"21926d8600293dd7e649b1a106a81c9d542f609b077a2599f83586564874152f","treeHash":"0f55898048a2fe13faa2512d5a67b2f0538e51735ff8d415c03b6d93b19abd3a","pluginPath":"skills/sickn33/error-diagnostics-error-trace","auditPayloadHash":"db1f2ad886df0f5e565911971c9b8301"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-error-diagnostics-error-trace/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}