{"data":{"skill":{"slug":"supercent-io-npm-git-install","name":"npm-git-install","icon":"📦","repo":"https://github.com/supercent-io/skills-template/tree/main/.agent-skills/npm-git-install/","status":"approved","author":"supercent-io","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"75fb6c92-47d7-4300-adcc-4aed5974a6e8","skill_id":"faea5af4-412c-4e8d-aec1-682dfea17960","version":1,"content_hash":"f30a663c875df78b96f58c00b0f5aadf","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"This skill is documentation-only (markdown guide). Static analyzer flagged 119 patterns in code examples, but all are FALSE POSITIVES. The skill teaches legitimate npm/git workflows. Minor risk: documents sudo usage and credential handling patterns, but explicitly recommends secure practices (env vars over hardcoded tokens, SSH over passwords).","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":30,"line_start":28},{"file":"SKILL.md","line_end":196,"line_start":196}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":36,"line_start":36}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":91,"line_start":84},{"file":"SKILL.md","line_end":160,"line_start":160}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":178,"line_start":177}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Documentation References sudo Commands","locations":[{"file":"SKILL.md","line_end":196,"line_start":196}],"confidence":0.75,"description":"The skill documents sudo usage for fixing npm permissions (line 196). While this is legitimate system administration, users could misuse sudo. The skill does recommend safer alternatives (~/.npm-global).","confidence_reasoning":"sudo commands present in documentation examples, but skill explicitly recommends non-sudo alternatives as preferred approach"}],"low_findings":[{"title":"Documents Credential Handling Patterns","locations":[{"file":"SKILL.md","line_end":186,"line_start":174}],"confidence":0.65,"description":"The skill documents GitHub token usage and SSH key setup. While it recommends secure practices (env vars, SSH), providing these patterns could be misused if users don't follow the security guidance.","confidence_reasoning":"Credential patterns documented but skill explicitly recommends secure handling via environment variables and SSH keys"},{"title":"Static Analyzer False Positives - Command Patterns in Documentation","locations":[{"file":"SKILL.md","line_end":377,"line_start":28}],"confidence":0.95,"description":"61 'external_commands' detections are markdown code examples, not executable skill code. Pattern matches like $(whoami) and backticks are bash examples in documentation context.","confidence_reasoning":"All detected patterns are in markdown code blocks - this is documentation teaching users commands, not a skill that executes code"},{"title":"Static Analyzer False Positives - URL Patterns","locations":[{"file":"SKILL.md","line_end":361,"line_start":29}],"confidence":0.95,"description":"23 'network' detections are documentation URLs (github.com, npm docs, stackoverflow) and git URL examples. These are reference links, not network calls made by the skill.","confidence_reasoning":"URLs are documentation references and git URL syntax examples, not actual network requests"},{"title":"Static Analyzer False Positives - Filesystem Paths","locations":[{"file":"SKILL.md","line_end":202,"line_start":84}],"confidence":0.95,"description":"24 'filesystem' detections include /tmp paths, ~/.ssh, ~/.npmrc references. These are documentation examples showing where npm/git store files, not actual file operations by the skill.","confidence_reasoning":"File paths appear in documentation examples explaining npm/git behavior, not skill file operations"}],"dangerous_patterns":[],"files_scanned":2,"total_lines":388,"audit_model":"claude","audited_at":"2026-03-20T08:20:10.963+00:00","created_at":"2026-03-20T12:51:21.10784+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}