{"data":{"skill":{"slug":"sickn33-monorepo-management","name":"monorepo-management","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/monorepo-management","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"6d918963-8948-4be8-8b12-820d49f09b5d","skill_id":"f6e2db4a-faab-40b9-96f4-ac326e780f31","version":5,"content_hash":"v3:81e05e636292629114b76cbb3922fbe57672fc02:86c1778873b97e9689369752c60861ffba0ec29cd3504773f96ddddc5fabb692:8a6471a63ee509067f7bf64e0a1582142879ce193a9c3cb3d940cf37ec8c12bd:736b696c6c732f7369636b6e33332f6d6f6e6f7265706f2d6d616e6167656d656e74:c2aa92463f949e68244bdf10c3bf276a","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 13 static findings are false positives caused by Markdown formatting, template literals, standard configuration paths, or documented CI secret references. The reviewed files provide instructional content and contain no prompt injection, credential disclosure, exfiltration intent, or executable payload.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"resources/implementation-playbook.md","line_end":418,"line_start":400},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":38,"line_start":38}]},{"factor":"network","evidence":[{"file":"resources/implementation-playbook.md","line_end":76,"line_start":76}]},{"factor":"filesystem","evidence":[{"file":"resources/implementation-playbook.md","line_end":187,"line_start":187},{"file":"resources/implementation-playbook.md","line_end":77,"line_start":77},{"file":"resources/implementation-playbook.md","line_end":187,"line_start":187},{"file":"resources/implementation-playbook.md","line_end":264,"line_start":264},{"file":"resources/implementation-playbook.md","line_end":374,"line_start":374}]},{"factor":"env_access","evidence":[{"file":"resources/implementation-playbook.md","line_end":610,"line_start":610}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":666,"audit_model":"codex","audited_at":"2026-08-04T14:57:34.878+00:00","created_at":"2026-08-05T01:16:52.863395+00:00","static_findings":[{"id":"external_commands:resources/implementation-playbook.md:400:ruby-shell-backtick-execution","file":"resources/implementation-playbook.md","pattern":"Ruby/shell backtick execution","snippet":"className={`btn btn-${variant}`}","category":"external_commands","line_end":418,"severity":"medium","line_start":400},{"id":"network:resources/implementation-playbook.md:76:hardcoded-url","file":"resources/implementation-playbook.md","pattern":"Hardcoded URL","snippet":"\"$schema\": \"https://turbo.build/schema.json\",","category":"network","line_end":76,"severity":"low","line_start":76},{"id":"filesystem:resources/implementation-playbook.md:187:hidden-file-in-home-directory","file":"resources/implementation-playbook.md","pattern":"Hidden file in home directory","snippet":"store-dir=~/.pnpm-store","category":"filesystem","line_end":187,"severity":"high","line_start":187},{"id":"filesystem:resources/implementation-playbook.md:77:hidden-file-access","file":"resources/implementation-playbook.md","pattern":"Hidden file access","snippet":"\"globalDependencies\": [\"**/.env.*local\"],","category":"filesystem","line_end":77,"severity":"medium","line_start":77},{"id":"filesystem:resources/implementation-playbook.md:187:hidden-file-access","file":"resources/implementation-playbook.md","pattern":"Hidden file access","snippet":"store-dir=~/.pnpm-store","category":"filesystem","line_end":187,"severity":"medium","line_start":187},{"id":"filesystem:resources/implementation-playbook.md:264:hidden-file-access","file":"resources/implementation-playbook.md","pattern":"Hidden file access","snippet":"\"inputs\": [\"default\", \"{workspaceRoot}/.eslintrc.json\"],","category":"filesystem","line_end":264,"severity":"medium","line_start":264},{"id":"filesystem:resources/implementation-playbook.md:374:hidden-file-access","file":"resources/implementation-playbook.md","pattern":"Hidden file access","snippet":"// apps/web/.eslintrc.js","category":"filesystem","line_end":374,"severity":"medium","line_start":374},{"id":"env_access:resources/implementation-playbook.md:610:git-platform-tokens","file":"resources/implementation-playbook.md","pattern":"Git platform tokens","snippet":"GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}","category":"env_access","line_end":610,"severity":"high","line_start":610},{"id":"sensitive:resources/implementation-playbook.md:77:environment-file-access","file":"resources/implementation-playbook.md","pattern":"Environment file access","snippet":"\"globalDependencies\": [\"**/.env.*local\"],","category":"sensitive","line_end":77,"severity":"high","line_start":77},{"id":"sensitive:resources/implementation-playbook.md:178:npm-config-file-may-contain-tokens","file":"resources/implementation-playbook.md","pattern":"NPM config file (may contain tokens)","snippet":"// .npmrc","category":"sensitive","line_end":178,"severity":"high","line_start":178},{"id":"blocker:resources/implementation-playbook.md:570:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"3. **Dependency Graph**: Keep it acyclic, avoid circular dependencies","category":"blocker","line_end":570,"severity":"low","line_start":570},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If detailed examples are required, open `resources/implementation-playbook.md`.","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `resources/implementation-playbook.md` for detailed patterns and examples.","category":"external_commands","line_end":38,"severity":"medium","line_start":38}],"finding_verdicts":[{"id":"external_commands:resources/implementation-playbook.md:400:ruby-shell-backtick-execution","reason":"The snippet is a TypeScript JSX template literal that constructs a CSS class name. It does not invoke Ruby, a shell, or an external command.","verdict":"false_positive","confidence":0.99},{"id":"network:resources/implementation-playbook.md:76:hardcoded-url","reason":"The URL identifies the official Turborepo JSON schema in a configuration example. No network request or data transmission is implemented.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:187:hidden-file-in-home-directory","reason":"This line configures pnpm's conventional package store location in an example .npmrc file. It does not read, modify, or conceal sensitive user files.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/implementation-playbook.md:77:hidden-file-access","reason":"The glob declares local environment files as Turborepo cache dependencies. It does not access their contents or expose their values.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/implementation-playbook.md:187:hidden-file-access","reason":"The hidden path is a documented pnpm cache directory setting. The skill does not execute any operation against that path.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:resources/implementation-playbook.md:264:hidden-file-access","reason":"The line names a repository ESLint configuration file as an Nx cache input. This is ordinary project configuration, not sensitive filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:resources/implementation-playbook.md:374:hidden-file-access","reason":"The detected path appears only in a comment labeling an ESLint configuration example. No file operation occurs.","verdict":"false_positive","confidence":0.99},{"id":"env_access:resources/implementation-playbook.md:610:git-platform-tokens","reason":"The release workflow references GitHub's secret interpolation syntax without revealing or transmitting the token. This is a standard CI credential injection pattern.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:resources/implementation-playbook.md:77:environment-file-access","reason":"The environment-file glob is a cache invalidation dependency in a Turborepo example. No instruction reads, prints, commits, or transfers environment-file contents.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:resources/implementation-playbook.md:178:npm-config-file-may-contain-tokens","reason":"The line is only a comment naming an example .npmrc file. The shown configuration contains package-management settings and no credentials.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:570:system-reconnaissance","reason":"The line advises users to keep a software dependency graph acyclic. It does not gather host, network, process, or account information.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"Backticks format a relative documentation path in Markdown. The instruction asks the agent to read that resource and contains no shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Backticks format the implementation playbook path in a Markdown resource list. They are not Ruby or shell execution syntax in this context.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"81e05e636292629114b76cbb3922fbe57672fc02","subject_content_hash":"86c1778873b97e9689369752c60861ffba0ec29cd3504773f96ddddc5fabb692","subject_tree_hash":"8a6471a63ee509067f7bf64e0a1582142879ce193a9c3cb3d940cf37ec8c12bd","subject_plugin_path":"skills/sickn33/monorepo-management","audit_payload_hash":"c2aa92463f949e68244bdf10c3bf276a","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"81e05e636292629114b76cbb3922fbe57672fc02","contentHash":"86c1778873b97e9689369752c60861ffba0ec29cd3504773f96ddddc5fabb692","treeHash":"8a6471a63ee509067f7bf64e0a1582142879ce193a9c3cb3d940cf37ec8c12bd","pluginPath":"skills/sickn33/monorepo-management","auditPayloadHash":"c2aa92463f949e68244bdf10c3bf276a"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-monorepo-management/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}