{"data":{"skill":{"slug":"sickn33-helm-chart-scaffolding","name":"helm-chart-scaffolding","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/helm-chart-scaffolding","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"f5c01cee-7a47-4bc8-9970-c59512fd71c0","skill_id":"d9fd20fb-5e88-45f7-a176-8e26e1d03a18","version":5,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:dbd7904131eef531e690f95ddb13d8f625ee1fa7bb12b76d0221342e75439f31:1a8cf1c8f5d770305bb72e90cf29e83bb3e67716ca188b5baeb84f5f6a1c79e3:736b696c6c732f7369636b6e33332f68656c6d2d63686172742d73636166666f6c64696e67:23fc9f7b628f3ac3cc4a30d3c3449345","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The URL, shell, filesystem, reconnaissance, and environment-file detections are benign examples or validation operations with fixed commands and quoted paths. A weak default PostgreSQL password remains in the scaffolding template and implementation guidance.","remediation":[{"issue":"The PostgreSQL examples use the predictable password \"changeme\".","severity":"medium","suggestion":"Remove the default password and require an explicit secret reference or generated credential before PostgreSQL can be enabled."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"assets/Chart.yaml.template","line_end":12,"line_start":12},{"file":"assets/Chart.yaml.template","line_end":15,"line_start":15},{"file":"assets/Chart.yaml.template","line_end":20,"line_start":20},{"file":"assets/Chart.yaml.template","line_end":22,"line_start":22},{"file":"assets/Chart.yaml.template","line_end":29,"line_start":29},{"file":"assets/Chart.yaml.template","line_end":35,"line_start":35},{"file":"references/chart-structure.md","line_end":54,"line_start":54},{"file":"references/chart-structure.md","line_end":56,"line_start":56},{"file":"references/chart-structure.md","line_end":60,"line_start":60},{"file":"references/chart-structure.md","line_end":61,"line_start":61},{"file":"references/chart-structure.md","line_end":65,"line_start":65},{"file":"references/chart-structure.md","line_end":69,"line_start":69},{"file":"references/chart-structure.md","line_end":170,"line_start":170},{"file":"references/chart-structure.md","line_end":285,"line_start":285},{"file":"references/chart-structure.md","line_end":298,"line_start":298},{"file":"references/chart-structure.md","line_end":328,"line_start":328},{"file":"references/chart-structure.md","line_end":493,"line_start":493},{"file":"references/chart-structure.md","line_end":285,"line_start":285},{"file":"resources/implementation-playbook.md","line_end":82,"line_start":82},{"file":"resources/implementation-playbook.md","line_end":86,"line_start":86},{"file":"resources/implementation-playbook.md","line_end":89,"line_start":89},{"file":"resources/implementation-playbook.md","line_end":92,"line_start":92},{"file":"resources/implementation-playbook.md","line_end":98,"line_start":98},{"file":"resources/implementation-playbook.md","line_end":102,"line_start":102},{"file":"resources/implementation-playbook.md","line_end":269,"line_start":269},{"file":"resources/implementation-playbook.md","line_end":353,"line_start":353}]},{"factor":"external_commands","evidence":[{"file":"references/chart-structure.md","line_end":283,"line_start":283},{"file":"resources/implementation-playbook.md","line_end":316,"line_start":316},{"file":"scripts/validate-chart.sh","line_end":72,"line_start":72},{"file":"scripts/validate-chart.sh","line_end":73,"line_start":73},{"file":"scripts/validate-chart.sh","line_end":74,"line_start":74},{"file":"scripts/validate-chart.sh","line_end":118,"line_start":118},{"file":"scripts/validate-chart.sh","line_end":1,"line_start":1},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":37,"line_start":37}]},{"factor":"filesystem","evidence":[{"file":"scripts/validate-chart.sh","line_end":31,"line_start":31},{"file":"scripts/validate-chart.sh","line_end":97,"line_start":97},{"file":"scripts/validate-chart.sh","line_end":108,"line_start":108},{"file":"scripts/validate-chart.sh","line_end":196,"line_start":196},{"file":"scripts/validate-chart.sh","line_end":216,"line_start":216},{"file":"scripts/validate-chart.sh","line_end":217,"line_start":217}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Predictable Default Database Password","locations":[{"file":"assets/values.yaml.template","line_end":156,"line_start":156},{"file":"resources/implementation-playbook.md","line_end":287,"line_start":287}],"confidence":0.99,"description":"The chart template and implementation example set the PostgreSQL password to \"changeme\", which can remain active when users enable the dependency.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"Both files explicitly assign the predictable value \"changeme\" to the PostgreSQL password field."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":6,"total_lines":1562,"audit_model":"codex","audited_at":"2026-07-23T23:13:17.854+00:00","created_at":"2026-07-26T14:22:31.209146+00:00","static_findings":[{"id":"network:assets/Chart.yaml.template:12:hardcoded-url","file":"assets/Chart.yaml.template","pattern":"Hardcoded URL","snippet":"home: https://github.com/<org>/<repo>","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"network:assets/Chart.yaml.template:15:hardcoded-url","file":"assets/Chart.yaml.template","pattern":"Hardcoded URL","snippet":"- https://github.com/<org>/<repo>","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:assets/Chart.yaml.template:20:hardcoded-url","file":"assets/Chart.yaml.template","pattern":"Hardcoded URL","snippet":"url: https://github.com/<username>","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"network:assets/Chart.yaml.template:22:hardcoded-url","file":"assets/Chart.yaml.template","pattern":"Hardcoded URL","snippet":"icon: https://example.com/icon.png","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:assets/Chart.yaml.template:29:hardcoded-url","file":"assets/Chart.yaml.template","pattern":"Hardcoded URL","snippet":"repository: \"https://charts.bitnami.com/bitnami\"","category":"network","line_end":29,"severity":"low","line_start":29},{"id":"network:assets/Chart.yaml.template:35:hardcoded-url","file":"assets/Chart.yaml.template","pattern":"Hardcoded URL","snippet":"repository: \"https://charts.bitnami.com/bitnami\"","category":"network","line_end":35,"severity":"low","line_start":35},{"id":"blocker:assets/values.yaml.template:123:system-reconnaissance","file":"assets/values.yaml.template","pattern":"System reconnaissance","snippet":"topologyKey: kubernetes.io/hostname","category":"blocker","line_end":123,"severity":"low","line_start":123},{"id":"blocker:assets/values.yaml.template:182:network-reconnaissance","file":"assets/values.yaml.template","pattern":"Network reconnaissance","snippet":"- Ingress","category":"blocker","line_end":183,"severity":"low","line_start":182},{"id":"external_commands:references/chart-structure.md:283:shell-command-substitution","file":"references/chart-structure.md","pattern":"Shell command substitution","snippet":"export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l \"app.kubernetes.io/name={","category":"external_commands","line_end":283,"severity":"medium","line_start":283},{"id":"network:references/chart-structure.md:54:hardcoded-url","file":"references/chart-structure.md","pattern":"Hardcoded URL","snippet":"home: https://example.com         # Project home page","category":"network","line_end":54,"severity":"low","line_start":54},{"id":"network:references/chart-structure.md:56:hardcoded-url","file":"references/chart-structure.md","pattern":"Hardcoded URL","snippet":"- https://github.com/example/my-app","category":"network","line_end":56,"severity":"low","line_start":56},{"id":"network:references/chart-structure.md:60:hardcoded-url","file":"references/chart-structure.md","pattern":"Hardcoded URL","snippet":"url: https://github.com/johndoe","category":"network","line_end":60,"severity":"low","line_start":60},{"id":"network:references/chart-structure.md:61:hardcoded-url","file":"references/chart-structure.md","pattern":"Hardcoded URL","snippet":"icon: https://example.com/icon.png  # Chart icon URL","category":"network","line_end":61,"severity":"low","line_start":61},{"id":"network:references/chart-structure.md:65:hardcoded-url","file":"references/chart-structure.md","pattern":"Hardcoded URL","snippet":"example.com/release-notes: https://example.com/releases/v1.2.3","category":"network","line_end":65,"severity":"low","line_start":65},{"id":"network:references/chart-structure.md:69:hardcoded-url","file":"references/chart-structure.md","pattern":"Hardcoded URL","snippet":"repository: \"https://charts.bitnami.com/bitnami\"","category":"network","line_end":69,"severity":"low","line_start":69},{"id":"network:references/chart-structure.md:170:hardcoded-url","file":"references/chart-structure.md","pattern":"Hardcoded URL","snippet":"\"$schema\": \"https://json-schema.org/draft-07/schema#\",","category":"network","line_end":170,"severity":"low","line_start":170},{"id":"network:references/chart-structure.md:285:hardcoded-url","file":"references/chart-structure.md","pattern":"Hardcoded URL","snippet":"echo \"Visit http://127.0.0.1:8080\"","category":"network","line_end":285,"severity":"low","line_start":285},{"id":"network:references/chart-structure.md:298:hardcoded-url","file":"references/chart-structure.md","pattern":"Hardcoded URL","snippet":"repository: \"https://charts.bitnami.com/bitnami\"","category":"network","line_end":298,"severity":"low","line_start":298},{"id":"network:references/chart-structure.md:328:hardcoded-url","file":"references/chart-structure.md","pattern":"Hardcoded URL","snippet":"repository: https://charts.bitnami.com/bitnami","category":"network","line_end":328,"severity":"low","line_start":328},{"id":"network:references/chart-structure.md:493:hardcoded-url","file":"references/chart-structure.md","pattern":"Hardcoded URL","snippet":"helm repo index . --url https://charts.example.com","category":"network","line_end":493,"severity":"low","line_start":493},{"id":"network:references/chart-structure.md:285:hardcoded-ip-address","file":"references/chart-structure.md","pattern":"Hardcoded IP address","snippet":"echo \"Visit http://127.0.0.1:8080\"","category":"network","line_end":285,"severity":"medium","line_start":285},{"id":"sensitive:references/chart-structure.md:305:sqlite-database-file","file":"references/chart-structure.md","pattern":"SQLite database file","snippet":"alias: db                      # Reference as .Values.db","category":"sensitive","line_end":305,"severity":"medium","line_start":305},{"id":"external_commands:resources/implementation-playbook.md:316:unix-shell-invocation","file":"resources/implementation-playbook.md","pattern":"Unix shell invocation","snippet":"#!/bin/bash","category":"external_commands","line_end":316,"severity":"medium","line_start":316},{"id":"network:resources/implementation-playbook.md:82:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"url: https://github.com/example/my-app","category":"network","line_end":82,"severity":"low","line_start":82},{"id":"network:resources/implementation-playbook.md:86:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"- https://github.com/example/my-app","category":"network","line_end":86,"severity":"low","line_start":86},{"id":"network:resources/implementation-playbook.md:89:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"home: https://example.com","category":"network","line_end":89,"severity":"low","line_start":89},{"id":"network:resources/implementation-playbook.md:92:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"icon: https://example.com/icon.png","category":"network","line_end":92,"severity":"low","line_start":92},{"id":"network:resources/implementation-playbook.md:98:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"repository: \"https://charts.bitnami.com/bitnami\"","category":"network","line_end":98,"severity":"low","line_start":98},{"id":"network:resources/implementation-playbook.md:102:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"repository: \"https://charts.bitnami.com/bitnami\"","category":"network","line_end":102,"severity":"low","line_start":102},{"id":"network:resources/implementation-playbook.md:269:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"repository: \"https://charts.bitnami.com/bitnami\"","category":"network","line_end":269,"severity":"low","line_start":269},{"id":"network:resources/implementation-playbook.md:353:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"helm repo add my-repo https://charts.example.com","category":"network","line_end":353,"severity":"low","line_start":353},{"id":"sensitive:resources/implementation-playbook.md:211:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"{{- toYaml .Values.env | nindent 12 }}","category":"sensitive","line_end":211,"severity":"high","line_start":211},{"id":"sensitive:resources/implementation-playbook.md:475:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"{{- range .Values.env }}","category":"sensitive","line_end":475,"severity":"high","line_start":475},{"id":"external_commands:scripts/validate-chart.sh:72:shell-command-substitution","file":"scripts/validate-chart.sh","pattern":"Shell command substitution","snippet":"CHART_NAME=$(grep \"^name:\" \"$CHART_DIR/Chart.yaml\" | awk '{print $2}')","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:scripts/validate-chart.sh:73:shell-command-substitution","file":"scripts/validate-chart.sh","pattern":"Shell command substitution","snippet":"CHART_VERSION=$(grep \"^version:\" \"$CHART_DIR/Chart.yaml\" | awk '{print $2}')","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:scripts/validate-chart.sh:74:shell-command-substitution","file":"scripts/validate-chart.sh","pattern":"Shell command substitution","snippet":"APP_VERSION=$(grep \"^appVersion:\" \"$CHART_DIR/Chart.yaml\" | awk '{print $2}' | tr -d '\"')","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:scripts/validate-chart.sh:118:shell-command-substitution","file":"scripts/validate-chart.sh","pattern":"Shell command substitution","snippet":"MANIFESTS=$(helm template \"$RELEASE_NAME\" \"$CHART_DIR\")","category":"external_commands","line_end":118,"severity":"medium","line_start":118},{"id":"external_commands:scripts/validate-chart.sh:1:unix-shell-invocation","file":"scripts/validate-chart.sh","pattern":"Unix shell invocation","snippet":"#!/bin/bash","category":"external_commands","line_end":1,"severity":"medium","line_start":1},{"id":"filesystem:scripts/validate-chart.sh:31:standard-device-file-access","file":"scripts/validate-chart.sh","pattern":"Standard device file access","snippet":"if ! command -v helm &> /dev/null; then","category":"filesystem","line_end":31,"severity":"low","line_start":31},{"id":"filesystem:scripts/validate-chart.sh:97:standard-device-file-access","file":"scripts/validate-chart.sh","pattern":"Standard device file access","snippet":"if helm template \"$RELEASE_NAME\" \"$CHART_DIR\" > /dev/null 2>&1; then","category":"filesystem","line_end":97,"severity":"low","line_start":97},{"id":"filesystem:scripts/validate-chart.sh:108:standard-device-file-access","file":"scripts/validate-chart.sh","pattern":"Standard device file access","snippet":"if helm install \"$RELEASE_NAME\" \"$CHART_DIR\" --dry-run --debug > /dev/null 2>&1; then","category":"filesystem","line_end":108,"severity":"low","line_start":108},{"id":"filesystem:scripts/validate-chart.sh:196:standard-device-file-access","file":"scripts/validate-chart.sh","pattern":"Standard device file access","snippet":"if helm dependency list \"$CHART_DIR\" > /dev/null 2>&1; then","category":"filesystem","line_end":196,"severity":"low","line_start":196},{"id":"filesystem:scripts/validate-chart.sh:216:standard-device-file-access","file":"scripts/validate-chart.sh","pattern":"Standard device file access","snippet":"if command -v jq &> /dev/null; then","category":"filesystem","line_end":216,"severity":"low","line_start":216},{"id":"filesystem:scripts/validate-chart.sh:217:standard-device-file-access","file":"scripts/validate-chart.sh","pattern":"Standard device file access","snippet":"if jq empty \"$CHART_DIR/values.schema.json\" 2>/dev/null; then","category":"filesystem","line_end":217,"severity":"low","line_start":217},{"id":"blocker:scripts/validate-chart.sh:218:system-reconnaissance","file":"scripts/validate-chart.sh","pattern":"System reconnaissance","snippet":"success \"values.schema.json is valid JSON\"","category":"blocker","line_end":218,"severity":"low","line_start":218},{"id":"blocker:scripts/validate-chart.sh:220:system-reconnaissance","file":"scripts/validate-chart.sh","pattern":"System reconnaissance","snippet":"error \"values.schema.json contains invalid JSON\"","category":"blocker","line_end":220,"severity":"low","line_start":220},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If detailed examples are required, open `resources/implementation-playbook.md`.","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `resources/implementation-playbook.md` for detailed patterns and examples.","category":"external_commands","line_end":37,"severity":"medium","line_start":37}],"finding_verdicts":[{"id":"network:assets/Chart.yaml.template:12:hardcoded-url","reason":"This is a placeholder project homepage in chart metadata and does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/Chart.yaml.template:15:hardcoded-url","reason":"This placeholder identifies a source repository in chart metadata and does not perform network access.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/Chart.yaml.template:20:hardcoded-url","reason":"The URL is a maintainer metadata placeholder, not an executed request or hidden destination.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/Chart.yaml.template:22:hardcoded-url","reason":"The example icon URL is declarative chart metadata and uses the reserved example.com domain.","verdict":"false_positive","confidence":0.99},{"id":"network:assets/Chart.yaml.template:29:hardcoded-url","reason":"This is an explicit dependency repository for the named PostgreSQL chart, which is expected Helm metadata.","verdict":"false_positive","confidence":0.98},{"id":"network:assets/Chart.yaml.template:35:hardcoded-url","reason":"This is an explicit dependency repository for the named Redis chart, which is expected Helm metadata.","verdict":"false_positive","confidence":0.98},{"id":"blocker:assets/values.yaml.template:123:system-reconnaissance","reason":"The value is a standard Kubernetes topology label used for pod anti-affinity, not a host reconnaissance command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:assets/values.yaml.template:182:network-reconnaissance","reason":"Ingress is a declarative Kubernetes NetworkPolicy type and does not scan or enumerate networks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/chart-structure.md:283:shell-command-substitution","reason":"The documentation captures a pod name from a fixed kubectl query; it does not interpolate untrusted shell input.","verdict":"false_positive","confidence":0.96},{"id":"network:references/chart-structure.md:54:hardcoded-url","reason":"The reserved example.com URL demonstrates a Chart.yaml homepage field and is not fetched.","verdict":"false_positive","confidence":0.99},{"id":"network:references/chart-structure.md:56:hardcoded-url","reason":"This illustrative source URL is chart metadata and does not trigger a request.","verdict":"false_positive","confidence":0.99},{"id":"network:references/chart-structure.md:60:hardcoded-url","reason":"This illustrative maintainer URL is chart metadata and does not trigger a request.","verdict":"false_positive","confidence":0.99},{"id":"network:references/chart-structure.md:61:hardcoded-url","reason":"The reserved example.com URL documents the optional chart icon field without performing network access.","verdict":"false_positive","confidence":0.99},{"id":"network:references/chart-structure.md:65:hardcoded-url","reason":"This reserved example.com URL illustrates a metadata annotation and is not contacted.","verdict":"false_positive","confidence":0.99},{"id":"network:references/chart-structure.md:69:hardcoded-url","reason":"The URL explicitly identifies the repository for an example PostgreSQL dependency.","verdict":"false_positive","confidence":0.98},{"id":"network:references/chart-structure.md:170:hardcoded-url","reason":"The URL is a JSON Schema identifier inside an example and is not a network operation.","verdict":"false_positive","confidence":0.99},{"id":"network:references/chart-structure.md:285:hardcoded-url","reason":"The command prints a loopback address for local port forwarding and makes no outbound request.","verdict":"false_positive","confidence":0.99},{"id":"network:references/chart-structure.md:298:hardcoded-url","reason":"The URL explicitly identifies the repository for an example PostgreSQL dependency.","verdict":"false_positive","confidence":0.98},{"id":"network:references/chart-structure.md:328:hardcoded-url","reason":"The URL appears in generated Chart.lock documentation and identifies the declared dependency source.","verdict":"false_positive","confidence":0.98},{"id":"network:references/chart-structure.md:493:hardcoded-url","reason":"The reserved example.com URL is an explicit placeholder argument in repository-index documentation.","verdict":"false_positive","confidence":0.99},{"id":"network:references/chart-structure.md:285:hardcoded-ip-address","reason":"127.0.0.1 is the local loopback address used for a documented port-forward, not a remote endpoint.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/chart-structure.md:305:sqlite-database-file","reason":"The token db is a Helm dependency alias and does not reference a SQLite file.","verdict":"false_positive","confidence":1},{"id":"external_commands:resources/implementation-playbook.md:316:unix-shell-invocation","reason":"The shebang begins a transparent validation-script example and is not itself an unsafe invocation.","verdict":"false_positive","confidence":0.99},{"id":"network:resources/implementation-playbook.md:82:hardcoded-url","reason":"This illustrative maintainer URL is declarative Chart.yaml metadata.","verdict":"false_positive","confidence":0.99},{"id":"network:resources/implementation-playbook.md:86:hardcoded-url","reason":"This illustrative source URL is declarative Chart.yaml metadata.","verdict":"false_positive","confidence":0.99},{"id":"network:resources/implementation-playbook.md:89:hardcoded-url","reason":"The reserved example.com URL demonstrates the chart homepage field without initiating access.","verdict":"false_positive","confidence":0.99},{"id":"network:resources/implementation-playbook.md:92:hardcoded-url","reason":"The reserved example.com URL demonstrates the chart icon field without initiating access.","verdict":"false_positive","confidence":0.99},{"id":"network:resources/implementation-playbook.md:98:hardcoded-url","reason":"The URL is the explicit repository for an example PostgreSQL dependency.","verdict":"false_positive","confidence":0.98},{"id":"network:resources/implementation-playbook.md:102:hardcoded-url","reason":"The URL is the explicit repository for an example Redis dependency.","verdict":"false_positive","confidence":0.98},{"id":"network:resources/implementation-playbook.md:269:hardcoded-url","reason":"The URL is expected Helm metadata for the documented PostgreSQL dependency.","verdict":"false_positive","confidence":0.98},{"id":"network:resources/implementation-playbook.md:353:hardcoded-url","reason":"The command uses a reserved example.com placeholder while explaining explicit repository configuration.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:211:environment-file-access","reason":"This Helm expression renders the chart's env values into a container specification and does not read an environment file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:475:environment-file-access","reason":"This Helm loop iterates over declared chart values and does not access host environment files.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/validate-chart.sh:72:shell-command-substitution","reason":"The script extracts a field from a quoted local Chart.yaml path using fixed grep and awk expressions.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/validate-chart.sh:73:shell-command-substitution","reason":"The script extracts a field from a quoted local Chart.yaml path using fixed grep and awk expressions.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/validate-chart.sh:74:shell-command-substitution","reason":"The script extracts a field from a quoted local Chart.yaml path using fixed grep, awk, and tr expressions.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/validate-chart.sh:118:shell-command-substitution","reason":"The script captures Helm-rendered manifests using fixed arguments and a quoted chart directory.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/validate-chart.sh:1:unix-shell-invocation","reason":"The Bash shebang only selects the interpreter for an openly provided chart-validation script.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/validate-chart.sh:31:standard-device-file-access","reason":"Redirecting command lookup output to /dev/null is standard error suppression and does not expose device data.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/validate-chart.sh:97:standard-device-file-access","reason":"The script discards Helm validation output through /dev/null and does not read device data.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/validate-chart.sh:108:standard-device-file-access","reason":"The script discards dry-run output through /dev/null and does not read device data.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/validate-chart.sh:196:standard-device-file-access","reason":"The script discards dependency-list output through /dev/null and does not read device data.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/validate-chart.sh:216:standard-device-file-access","reason":"Redirecting jq command lookup output to /dev/null is standard error suppression.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/validate-chart.sh:217:standard-device-file-access","reason":"The script redirects jq errors to /dev/null while validating a quoted local schema file.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/validate-chart.sh:218:system-reconnaissance","reason":"This line only prints that values.schema.json passed JSON validation.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/validate-chart.sh:220:system-reconnaissance","reason":"This line only prints that values.schema.json failed JSON validation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Backticks format a relative documentation path in Markdown and do not execute it.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"Backticks format a relative documentation path in Markdown and do not execute it.","verdict":"false_positive","confidence":1}],"semantic_findings":[{"title":"Predictable Default Database Password","severity":"medium","locations":[{"file":"assets/values.yaml.template","line_end":156,"line_start":156},{"file":"resources/implementation-playbook.md","line_end":287,"line_start":287}],"confidence":0.99,"description":"The chart template and implementation example set the PostgreSQL password to \"changeme\", which can remain active when users enable the dependency.","confidence_reasoning":"Both files explicitly assign the predictable value \"changeme\" to the PostgreSQL password field."}],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"dbd7904131eef531e690f95ddb13d8f625ee1fa7bb12b76d0221342e75439f31","subject_tree_hash":"1a8cf1c8f5d770305bb72e90cf29e83bb3e67716ca188b5baeb84f5f6a1c79e3","subject_plugin_path":"skills/sickn33/helm-chart-scaffolding","audit_payload_hash":"23fc9f7b628f3ac3cc4a30d3c3449345","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"dbd7904131eef531e690f95ddb13d8f625ee1fa7bb12b76d0221342e75439f31","treeHash":"1a8cf1c8f5d770305bb72e90cf29e83bb3e67716ca188b5baeb84f5f6a1c79e3","pluginPath":"skills/sickn33/helm-chart-scaffolding","auditPayloadHash":"23fc9f7b628f3ac3cc4a30d3c3449345"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-helm-chart-scaffolding/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}