{"data":{"skill":{"slug":"sickn33-on-call-handoff-patterns","name":"on-call-handoff-patterns","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/on-call-handoff-patterns","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"0aae4034-a22c-40be-b705-9fa7b594cd18","skill_id":"7d2ef1dd-483e-4ab6-94ce-3374c60c1732","version":5,"content_hash":"v3:81e05e636292629114b76cbb3922fbe57672fc02:68ef45b9aabae1c22e9b871b39292f9d53acf8fbd1cac1bf473deb0221810d10:1669d47beb3c939e5ae41f021a36ff8d6868fcf63c79f6387c29561c7f800caf:736b696c6c732f7369636b6e33332f6f6e2d63616c6c2d68616e646f66662d7061747465726e73:ef87e087ef30411fa543adef781e495d","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 37 static alerts are false positives caused by Markdown formatting, example links, or ordinary prose. A separate semantic review found one destructive Redis command presented without sufficient execution safeguards.","remediation":[{"issue":"The quick reference includes redis-cli FLUSHDB, which deletes every key in the selected Redis database.","severity":"medium","suggestion":"Replace it with a non-destructive diagnostic procedure, or require explicit authorization, target verification, backup confirmation, and a service-specific runbook."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":59,"line_start":48},{"file":"SKILL.md","line_end":65,"line_start":59},{"file":"SKILL.md","line_end":161,"line_start":65},{"file":"SKILL.md","line_end":191,"line_start":161},{"file":"SKILL.md","line_end":203,"line_start":191},{"file":"SKILL.md","line_end":230,"line_start":203},{"file":"SKILL.md","line_end":234,"line_start":230},{"file":"SKILL.md","line_end":256,"line_start":234},{"file":"SKILL.md","line_end":260,"line_start":256},{"file":"SKILL.md","line_end":311,"line_start":260},{"file":"SKILL.md","line_end":317,"line_start":311},{"file":"SKILL.md","line_end":339,"line_start":317},{"file":"SKILL.md","line_end":345,"line_start":339},{"file":"SKILL.md","line_end":372,"line_start":345},{"file":"SKILL.md","line_end":376,"line_start":372},{"file":"SKILL.md","line_end":395,"line_start":376},{"file":"SKILL.md","line_end":399,"line_start":395},{"file":"SKILL.md","line_end":408,"line_start":399},{"file":"SKILL.md","line_end":414,"line_start":408},{"file":"SKILL.md","line_end":434,"line_start":414}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":118,"line_start":118},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":129,"line_start":129},{"file":"SKILL.md","line_end":206,"line_start":206},{"file":"SKILL.md","line_end":207,"line_start":207},{"file":"SKILL.md","line_end":208,"line_start":208},{"file":"SKILL.md","line_end":209,"line_start":209},{"file":"SKILL.md","line_end":301,"line_start":301},{"file":"SKILL.md","line_end":302,"line_start":302},{"file":"SKILL.md","line_end":454,"line_start":454},{"file":"SKILL.md","line_end":455,"line_start":455},{"file":"SKILL.md","line_end":456,"line_start":456}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Destructive Redis Command Lacks Safeguards","locations":[{"file":"SKILL.md","line_end":202,"line_start":201}],"confidence":0.98,"description":"The quick reference presents redis-cli FLUSHDB as an emergency cache-clear command. It deletes the selected Redis database without target, backup, or authorization checks.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"FLUSHDB has documented destructive semantics, and the surrounding guidance provides only an emergency-only label rather than execution safeguards."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":462,"audit_model":"codex","audited_at":"2026-08-04T16:46:28.11+00:00","created_at":"2026-08-05T01:54:08.374824+00:00","static_findings":[{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If detailed examples are required, open `resources/implementation-playbook.md`.","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":59,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":65,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":161,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Issue**: `test_payment_flow` fails intermittently in CI","category":"external_commands","line_end":191,"severity":"medium","line_start":161},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":203,"severity":"medium","line_start":191},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":230,"severity":"medium","line_start":203},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":234,"severity":"medium","line_start":230},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":256,"severity":"medium","line_start":234},{"id":"external_commands:SKILL.md:256:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":260,"severity":"medium","line_start":256},{"id":"external_commands:SKILL.md:260:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":311,"severity":"medium","line_start":260},{"id":"external_commands:SKILL.md:311:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":317,"severity":"medium","line_start":311},{"id":"external_commands:SKILL.md:317:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":339,"severity":"medium","line_start":317},{"id":"external_commands:SKILL.md:339:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":345,"severity":"medium","line_start":339},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":372,"severity":"medium","line_start":345},{"id":"external_commands:SKILL.md:372:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":376,"severity":"medium","line_start":372},{"id":"external_commands:SKILL.md:376:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":395,"severity":"medium","line_start":376},{"id":"external_commands:SKILL.md:395:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":399,"severity":"medium","line_start":395},{"id":"external_commands:SKILL.md:399:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":408,"severity":"medium","line_start":399},{"id":"external_commands:SKILL.md:408:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":414,"severity":"medium","line_start":408},{"id":"external_commands:SKILL.md:414:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":434,"severity":"medium","line_start":414},{"id":"network:SKILL.md:98:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Dashboard: [API Latency](https://grafana/d/api-latency)","category":"network","line_end":98,"severity":"low","line_start":98},{"id":"network:SKILL.md:118:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Dashboard: [Auth Service Memory](https://grafana/d/auth-memory)","category":"network","line_end":118,"severity":"low","line_start":118},{"id":"network:SKILL.md:119:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Analysis doc: [Memory Investigation](https://docs/eng-1235)","category":"network","line_end":119,"severity":"low","line_start":119},{"id":"network:SKILL.md:129:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Postmortem**: [POSTMORTEM-89](https://docs/postmortem-89)","category":"network","line_end":129,"severity":"low","line_start":129},{"id":"network:SKILL.md:206:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Runbooks](https://wiki/runbooks)","category":"network","line_end":206,"severity":"low","line_start":206},{"id":"network:SKILL.md:207:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Service Catalog](https://wiki/services)","category":"network","line_end":207,"severity":"low","line_start":207},{"id":"network:SKILL.md:208:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Incident Slack](https://slack.com/incidents)","category":"network","line_end":208,"severity":"low","line_start":208},{"id":"network:SKILL.md:209:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [PagerDuty](https://pagerduty.com/schedules)","category":"network","line_end":209,"severity":"low","line_start":209},{"id":"network:SKILL.md:301:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Dashboard: [Payment Service](https://grafana/d/payments)","category":"network","line_end":301,"severity":"low","line_start":301},{"id":"network:SKILL.md:302:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Runbook: [Payment Degradation](https://wiki/runbooks/payments)","category":"network","line_end":302,"severity":"low","line_start":302},{"id":"network:SKILL.md:454:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Google SRE - Being On-Call](https://sre.google/sre-book/being-on-call/)","category":"network","line_end":454,"severity":"low","line_start":454},{"id":"network:SKILL.md:455:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [PagerDuty On-Call Guide](https://www.pagerduty.com/resources/learn/on-call-management/)","category":"network","line_end":455,"severity":"low","line_start":455},{"id":"network:SKILL.md:456:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Increment On-Call Issue](https://increment.com/on-call/)","category":"network","line_end":456,"severity":"low","line_start":456},{"id":"blocker:SKILL.md:295:at-command-scheduling","file":"SKILL.md","pattern":"at command scheduling","snippet":"- Status page: Updated at 08:45","category":"blocker","line_end":295,"severity":"medium","line_start":295},{"id":"blocker:SKILL.md:351:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- [ ] Database read access","category":"blocker","line_end":352,"severity":"low","line_start":351},{"id":"blocker:SKILL.md:387:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- [ ] Document investigation progress","category":"blocker","line_end":388,"severity":"low","line_start":387}],"finding_verdicts":[{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"Line 23 uses Markdown inline backticks around a relative documentation path. It does not contain Ruby syntax or execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"Lines 48-59 are a fenced text diagram describing handoff timing. The backticks are Markdown delimiters, not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The detected token closes a Markdown diagram and opens the templates section. No command or interpreter invocation is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"Line 65 begins a Markdown example for an on-call handoff document. The fenced content is documentation, not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","reason":"The backticks format the test name test_payment_flow inside a handoff example. They do not execute the named test.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","reason":"Line 191 opens a fenced Bash quick-reference example. The Markdown file itself has no mechanism that automatically executes its contents.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","reason":"Line 203 only closes the fenced Bash example. The delimiter is not a Ruby backtick operator or shell invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:230:ruby-shell-backtick-execution","reason":"Line 230 closes the handoff-document Markdown example. It contains no executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:234:ruby-shell-backtick-execution","reason":"Line 234 opens a Markdown quick-handoff template. Its backticks delimit example text and cannot execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:256:ruby-shell-backtick-execution","reason":"Line 256 closes the quick-handoff Markdown template. The token is formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:260:ruby-shell-backtick-execution","reason":"Line 260 opens a Markdown incident-handoff template containing status and coordination guidance. It is not executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:311:ruby-shell-backtick-execution","reason":"Line 311 closes the incident-handoff template. No shell or Ruby execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:317:ruby-shell-backtick-execution","reason":"Line 317 opens a Markdown meeting-agenda example. The fenced prose has no executable behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:339:ruby-shell-backtick-execution","reason":"Line 339 closes the meeting-agenda example. The static pattern misclassifies a Markdown fence.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","reason":"Line 345 opens a Markdown pre-shift checklist. It documents access checks but executes nothing.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:372:ruby-shell-backtick-execution","reason":"Line 372 closes the pre-shift checklist. It is a Markdown delimiter without command semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:376:ruby-shell-backtick-execution","reason":"Line 376 opens a Markdown daily-routine checklist. The block contains operational reminders, not executable commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:395:ruby-shell-backtick-execution","reason":"Line 395 closes the daily-routine checklist. The backticks are formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:399:ruby-shell-backtick-execution","reason":"Line 399 opens a Markdown post-shift checklist. No interpreter or shell execution is requested by the fence.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:408:ruby-shell-backtick-execution","reason":"Line 408 closes the post-shift checklist. It is not an executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:414:ruby-shell-backtick-execution","reason":"Line 414 opens a Markdown escalation-guidance block. The fenced content is procedural prose and does not execute commands.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:98:hardcoded-url","reason":"The URL is a placeholder dashboard link inside an example handoff. The skill does not fetch it or transmit data.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:118:hardcoded-url","reason":"The URL is an illustrative Grafana dashboard reference. No network request is implemented.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:119:hardcoded-url","reason":"The URL is a placeholder analysis-document link within sample content. It is not used for network access.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:129:hardcoded-url","reason":"The postmortem URL is an illustrative internal link in a template. The skill neither follows it nor sends information to it.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:206:hardcoded-url","reason":"This is a placeholder runbook hyperlink listed as a handoff resource. It does not trigger a request.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:207:hardcoded-url","reason":"This is a placeholder service-catalog hyperlink for users to replace. No network operation is defined.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:208:hardcoded-url","reason":"The Slack URL is a documentation link in an example resource list. There is no automated request or data transfer.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:209:hardcoded-url","reason":"The PagerDuty URL is an example schedule link. The Markdown content does not access the service.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:301:hardcoded-url","reason":"The URL is a sample payment-service dashboard reference in an incident-handoff template. It is not fetched.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:302:hardcoded-url","reason":"The URL is a placeholder payment runbook link. No code follows the link or transmits data.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:454:hardcoded-url","reason":"This is a public Google SRE reference link in the resources section. It is not an automated network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:455:hardcoded-url","reason":"This is a public PagerDuty educational reference. The skill only presents the hyperlink.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:456:hardcoded-url","reason":"This is a public educational resource link. There is no automatic access or exfiltration behavior.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:295:at-command-scheduling","reason":"The phrase Updated at 08:45 reports a status-page timestamp. It does not invoke the at scheduling utility.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:351:network-reconnaissance","reason":"Database read access is one item in a pre-shift access checklist. It does not scan or enumerate a network.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:387:network-reconnaissance","reason":"Document investigation progress is an incident-recordkeeping instruction. It has no network reconnaissance behavior.","verdict":"false_positive","confidence":1}],"semantic_findings":[{"title":"Destructive Redis Command Lacks Safeguards","severity":"medium","locations":[{"file":"SKILL.md","line_end":202,"line_start":201}],"confidence":0.98,"description":"The quick reference presents redis-cli FLUSHDB as an emergency cache-clear command. It deletes the selected Redis database without target, backup, or authorization checks.","confidence_reasoning":"FLUSHDB has documented destructive semantics, and the surrounding guidance provides only an emergency-only label rather than execution safeguards."}],"subject_marketplace_commit_sha":"81e05e636292629114b76cbb3922fbe57672fc02","subject_content_hash":"68ef45b9aabae1c22e9b871b39292f9d53acf8fbd1cac1bf473deb0221810d10","subject_tree_hash":"1669d47beb3c939e5ae41f021a36ff8d6868fcf63c79f6387c29561c7f800caf","subject_plugin_path":"skills/sickn33/on-call-handoff-patterns","audit_payload_hash":"ef87e087ef30411fa543adef781e495d","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"81e05e636292629114b76cbb3922fbe57672fc02","contentHash":"68ef45b9aabae1c22e9b871b39292f9d53acf8fbd1cac1bf473deb0221810d10","treeHash":"1669d47beb3c939e5ae41f021a36ff8d6868fcf63c79f6387c29561c7f800caf","pluginPath":"skills/sickn33/on-call-handoff-patterns","auditPayloadHash":"ef87e087ef30411fa543adef781e495d"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-on-call-handoff-patterns/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}