{"data":{"skill":{"slug":"sickn33-memory-safety-patterns","name":"memory-safety-patterns","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/memory-safety-patterns","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"e5d861a7-2333-45f6-8448-d6f24e477442","skill_id":"3856f8fb-62a7-4043-9158-96655d1958f9","version":5,"content_hash":"v3:81e05e636292629114b76cbb3922fbe57672fc02:d266d1b743fa5aafeb26c84787d2029dbe668d359361c41c0d8ac831a17a5832:69584b5aa65d8d9a52f4d6e1dca1105118c8975164451c28528c6312991a5c6e:736b696c6c732f7369636b6e33332f6d656d6f72792d7361666574792d7061747465726e73:df7702ce6c2b1de0f26e8f5a13c308c5","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 26 static findings are false positives caused by documentation examples and scanner keyword collisions. The skill contains no executable scripts, prompt injection, external process execution, reconnaissance, or malicious intent.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"resources/implementation-playbook.md","line_end":298,"line_start":298},{"file":"resources/implementation-playbook.md","line_end":523,"line_start":523},{"file":"resources/implementation-playbook.md","line_end":543,"line_start":543},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":36,"line_start":36}]},{"factor":"filesystem","evidence":[{"file":"resources/implementation-playbook.md","line_end":367,"line_start":367}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":646,"audit_model":"codex","audited_at":"2026-08-04T13:47:43.199+00:00","created_at":"2026-08-05T01:13:36.844147+00:00","static_findings":[{"id":"external_commands:resources/implementation-playbook.md:298:process-spawn","file":"resources/implementation-playbook.md","pattern":"Process spawn","snippet":"thread::spawn(move || {","category":"external_commands","line_end":298,"severity":"high","line_start":298},{"id":"external_commands:resources/implementation-playbook.md:523:process-spawn","file":"resources/implementation-playbook.md","pattern":"Process spawn","snippet":"thread::spawn(move || {","category":"external_commands","line_end":523,"severity":"high","line_start":523},{"id":"external_commands:resources/implementation-playbook.md:543:process-spawn","file":"resources/implementation-playbook.md","pattern":"Process spawn","snippet":"thread::spawn(move || {","category":"external_commands","line_end":543,"severity":"high","line_start":543},{"id":"filesystem:resources/implementation-playbook.md:367:python-file-write-append","file":"resources/implementation-playbook.md","pattern":"Python file write/append","snippet":"ctx->log = fopen(\"log.txt\", \"w\");","category":"filesystem","line_end":367,"severity":"medium","line_start":367},{"id":"blocker:resources/implementation-playbook.md:72:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void write(const std::string& data) {","category":"blocker","line_end":72,"severity":"low","line_start":72},{"id":"blocker:resources/implementation-playbook.md:83:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void update(const std::string& key, const std::string& value) {","category":"blocker","line_end":83,"severity":"low","line_start":83},{"id":"blocker:resources/implementation-playbook.md:112:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void commit() { committed_ = true; }","category":"blocker","line_end":112,"severity":"low","line_start":112},{"id":"blocker:resources/implementation-playbook.md:131:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void start() { /* ... */ }","category":"blocker","line_end":131,"severity":"low","line_start":131},{"id":"blocker:resources/implementation-playbook.md:138:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void start() {","category":"blocker","line_end":138,"severity":"low","line_start":138},{"id":"blocker:resources/implementation-playbook.md:161:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void sharedPtrExample() {","category":"blocker","line_end":161,"severity":"low","line_start":161},{"id":"blocker:resources/implementation-playbook.md:170:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"// parent is valid shared_ptr","category":"blocker","line_end":170,"severity":"low","line_start":170},{"id":"blocker:resources/implementation-playbook.md:177:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"static void close(int* fd) {","category":"blocker","line_end":177,"severity":"low","line_start":177},{"id":"blocker:resources/implementation-playbook.md:194:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void bestPractices() {","category":"blocker","line_end":194,"severity":"low","line_start":194},{"id":"blocker:resources/implementation-playbook.md:212:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"let s2 = s1; // s1 is MOVED, no longer valid","category":"blocker","line_end":214,"severity":"low","line_start":212},{"id":"blocker:resources/implementation-playbook.md:347:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void context_destroy(Context* ctx);","category":"blocker","line_end":347,"severity":"low","line_start":347},{"id":"blocker:resources/implementation-playbook.md:377:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void context_destroy(Context* ctx) {","category":"blocker","line_end":377,"severity":"low","line_start":377},{"id":"blocker:resources/implementation-playbook.md:388:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void auto_free_func(void** ptr) {","category":"blocker","line_end":388,"severity":"low","line_start":388},{"id":"blocker:resources/implementation-playbook.md:392:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void auto_free_example(void) {","category":"blocker","line_end":392,"severity":"low","line_start":392},{"id":"blocker:resources/implementation-playbook.md:406:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void safe_array_access() {","category":"blocker","line_end":406,"severity":"low","line_start":406},{"id":"blocker:resources/implementation-playbook.md:428:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void fixed_array() {","category":"blocker","line_end":428,"severity":"low","line_start":428},{"id":"blocker:resources/implementation-playbook.md:474:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void increment() {","category":"blocker","line_end":474,"severity":"low","line_start":474},{"id":"blocker:resources/implementation-playbook.md:489:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"void write(const std::string& key, int value) {","category":"blocker","line_end":489,"severity":"low","line_start":489},{"id":"blocker:resources/implementation-playbook.md:571:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"- **Use smart pointers** - Avoid raw pointers in C++","category":"blocker","line_end":571,"severity":"low","line_start":571},{"id":"blocker:resources/implementation-playbook.md:587:network-reconnaissance","file":"resources/implementation-playbook.md","pattern":"Network reconnaissance","snippet":"clang++ -fsanitize=address -g source.cpp","category":"blocker","line_end":587,"severity":"low","line_start":587},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If detailed examples are required, open `resources/implementation-playbook.md`.","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `resources/implementation-playbook.md` for detailed patterns and examples.","category":"external_commands","line_end":36,"severity":"medium","line_start":36}],"finding_verdicts":[{"id":"external_commands:resources/implementation-playbook.md:298:process-spawn","reason":"This is Rust thread::spawn inside a fenced concurrency example, not an operating-system process launch. It executes no external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:523:process-spawn","reason":"This fenced Rust example creates a local thread to update an atomic counter. It does not spawn an external process or handle command input.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:resources/implementation-playbook.md:543:process-spawn","reason":"This fenced Rust example creates a local thread to demonstrate mutex synchronization. No shell or external command is invoked.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:367:python-file-write-append","reason":"The line is C code in a fenced resource-lifecycle example, not Python or active skill code. It opens a fixed log.txt path to demonstrate cleanup.","verdict":"false_positive","confidence":0.98},{"id":"blocker:resources/implementation-playbook.md:72:system-reconnaissance","reason":"The line declares a C++ method that writes supplied data to an already-owned file stream. It performs no system discovery.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:83:system-reconnaissance","reason":"The line declares a C++ database example method that updates an in-memory map under a lock. It performs no reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:112:system-reconnaissance","reason":"The commit method only sets a transaction example boolean. It neither inspects the host system nor executes a command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:131:system-reconnaissance","reason":"This is an empty illustrative C++ Engine method. There is no system access or reconnaissance behavior.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:138:system-reconnaissance","reason":"The method delegates to an owned Engine object to illustrate unique_ptr usage. It does not gather host information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:161:system-reconnaissance","reason":"This function demonstrates shared_ptr and weak_ptr ownership in fenced C++ documentation. It contains no reconnaissance operation.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:170:system-reconnaissance","reason":"The matched text is a comment explaining that a locked weak_ptr is valid. It is unrelated to system reconnaissance.","verdict":"false_positive","confidence":1},{"id":"blocker:resources/implementation-playbook.md:177:system-reconnaissance","reason":"This is a custom C++ socket descriptor deleter used to explain resource cleanup. It closes an existing descriptor and performs no discovery.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:194:system-reconnaissance","reason":"The function contains smart-pointer construction examples. It does not inspect the environment, network, or system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:212:system-reconnaissance","reason":"The lines demonstrate Rust move semantics and include a compile-time ownership comment. They contain no reconnaissance logic.","verdict":"false_positive","confidence":1},{"id":"blocker:resources/implementation-playbook.md:347:system-reconnaissance","reason":"This is a C function declaration for releasing an opaque context. It is a cleanup API, not reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:377:system-reconnaissance","reason":"The function frees memory and closes a file held by an example context. It does not collect host or user information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:388:system-reconnaissance","reason":"This C cleanup callback frees its supplied pointer. The behavior is local resource management with no discovery activity.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:392:system-reconnaissance","reason":"This fenced C function demonstrates automatic memory cleanup for a local allocation. It performs no reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:406:system-reconnaissance","reason":"The function demonstrates bounds-checked C++ container access. It does not query any system state.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:428:system-reconnaissance","reason":"The function demonstrates fixed-size std::array usage. It contains no system or network inspection.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:474:system-reconnaissance","reason":"The C++ method increments a local atomic counter. It has no reconnaissance capability.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:489:system-reconnaissance","reason":"The method writes a value to an in-memory map under a mutex. It does not inspect external system state.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:571:system-reconnaissance","reason":"This is a prose recommendation to use smart pointers in C++. It has no executable or reconnaissance behavior.","verdict":"false_positive","confidence":1},{"id":"blocker:resources/implementation-playbook.md:587:network-reconnaissance","reason":"This local compiler command enables AddressSanitizer for source.cpp. It performs no network request, scan, or discovery.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting around a relative documentation path. No Ruby or shell execution syntax is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The backticks format a resource filename in Markdown. The line does not execute the path or invoke a shell.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"81e05e636292629114b76cbb3922fbe57672fc02","subject_content_hash":"d266d1b743fa5aafeb26c84787d2029dbe668d359361c41c0d8ac831a17a5832","subject_tree_hash":"69584b5aa65d8d9a52f4d6e1dca1105118c8975164451c28528c6312991a5c6e","subject_plugin_path":"skills/sickn33/memory-safety-patterns","audit_payload_hash":"df7702ce6c2b1de0f26e8f5a13c308c5","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"81e05e636292629114b76cbb3922fbe57672fc02","contentHash":"d266d1b743fa5aafeb26c84787d2029dbe668d359361c41c0d8ac831a17a5832","treeHash":"69584b5aa65d8d9a52f4d6e1dca1105118c8975164451c28528c6312991a5c6e","pluginPath":"skills/sickn33/memory-safety-patterns","auditPayloadHash":"df7702ce6c2b1de0f26e8f5a13c308c5"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-memory-safety-patterns/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}