{"data":{"skill":{"slug":"supercent-io-environment-setup","name":"environment-setup","icon":"📦","repo":"https://github.com/supercent-io/skills-template/tree/main/.agent-skills/environment-setup/","status":"approved","author":"supercent-io","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"0592e53d-d8dd-4148-985d-960cec7259c8","skill_id":"5257a8f1-77c9-4a35-9dd4-0f5aa0307ad0","version":1,"content_hash":"06b51094582b5b5411c0ff33a64e92cf","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"This skill is a documentation/education resource that provides templates and best practices for environment configuration. Static analysis flagged many patterns (credential examples, dotenv usage, environment variable access) but these are all placeholder examples in documentation, not actual executable code. The skill declares Read Write Edit Bash permissions, which is appropriate for configuration management. No malicious intent detected - all flagged patterns are legitimate documentation content. Users should be aware this skill can modify configuration files.","remediation":[],"risk_factor_evidence":[{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":56,"line_start":55},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":127,"line_start":127},{"file":"SKILL.md","line_end":173,"line_start":173}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":67,"line_start":25}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Educational Documentation Contains Credential Patterns","locations":[{"file":"SKILL.md","line_end":56,"line_start":32}],"description":"SKILL.md contains example .env templates with placeholder credentials (DATABASE_URL, AWS keys, SMTP passwords). These are documentation examples showing users how to structure their own configuration, not actual secrets. The skill does not exfiltrate or misuse these values."},{"title":"Broad Tool Permissions Declared","locations":[{"file":"SKILL.md","line_end":4,"line_start":4}],"description":"The skill declares allowed-tools: Read Write Edit Bash, providing broad file system and command execution capabilities. This is necessary for configuration management but means the skill could modify any file if given malicious instructions."}],"low_findings":[{"title":"Environment Variable Access in Documentation","locations":[{"file":"SKILL.md","line_end":189,"line_start":169}],"description":"Code examples show process.env usage patterns. These are educational examples teaching users how to access environment variables in TypeScript applications, not actual runtime environment access by the skill."},{"title":"Hardcoded URLs in Documentation Examples","locations":[{"file":"SKILL.md","line_end":61,"line_start":29}],"description":"Documentation contains example URLs (localhost:3000, sentry.io, myapp.com). These are placeholder examples showing URL formats, not actual network endpoints."}],"dangerous_patterns":[{"title":"Heuristic: Documentation Pattern Confusion","locations":[{"file":"SKILL.md","line_end":361,"line_start":1}],"description":"Static analysis flagged this as a dangerous combination (code execution + network + credential access). Upon review, these patterns appear in example code blocks within markdown documentation, not actual executable code. The skill is teaching configuration management patterns, not performing these operations."}],"files_scanned":2,"total_lines":378,"audit_model":"claude","audited_at":"2026-03-19T08:22:15.72+00:00","created_at":"2026-03-19T09:01:20.190316+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}