{"data":{"skill":{"slug":"supercent-io-task-estimation","name":"task-estimation","icon":"📦","repo":"https://github.com/supercent-io/skills-template/tree/main/.agent-skills/task-estimation/","status":"approved","author":"supercent-io","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"a826d970-1e59-410a-b6de-af3b79ed90d7","skill_id":"a4abb707-ade2-4e8e-a471-4fc20df994ca","version":2,"content_hash":"d3225f5ac67e0943ea62293d82c03b2e","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis flagged markdown fences, inline backticks, external reference links, and weak-crypto patterns. Manual review found no executable commands, no cryptographic code, no automatic network access, and no prompt injection attempt. The skill is documentation-only agile estimation guidance and is safe to publish.","remediation":[],"risk_factor_evidence":[],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"False Positive: Markdown Blocks Misidentified as Shell Execution","locations":[{"file":"SKILL.md","line_end":67,"line_start":25},{"file":"SKILL.md","line_end":94,"line_start":81},{"file":"SKILL.md","line_end":111,"line_start":98},{"file":"SKILL.md","line_end":145,"line_start":116},{"file":"SKILL.md","line_end":181,"line_start":151},{"file":"SKILL.md","line_end":217,"line_start":217}],"confidence":0.95,"description":"The static analyzer flagged Ruby or shell backtick execution across markdown examples. The locations are fenced markdown, plain example text, and inline tag formatting, not executable skill code. Verdict: FALSE_POSITIVE.","confidence_reasoning":"The flagged locations are documentation fences or inline markdown syntax. No executable script file, shell invocation, or user-controlled command path is present."},{"title":"False Positive: Weak Cryptography Pattern Not Present","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":155,"line_start":154},{"file":"SKILL.md","line_end":180,"line_start":180},{"file":"SKILL.md","line_end":205,"line_start":205}],"confidence":0.94,"description":"The static analyzer flagged weak cryptographic algorithm patterns at descriptive text and template lines. Manual review found estimation content only, with no MD5, SHA-1, encryption, hashing, or credential handling code. Verdict: FALSE_POSITIVE.","confidence_reasoning":"The cited lines contain plain task-estimation prose or references. There is no cryptographic operation or security-sensitive data flow to evaluate."},{"title":"False Positive: Reference Links Are Not Network Behavior","locations":[{"file":"SKILL.md","line_end":207,"line_start":205}],"confidence":0.9,"description":"The static analyzer flagged hardcoded URLs in the references section. These are educational links to Scrum Guide, Planning Poker, and Atlassian pages; the skill does not instruct an agent to fetch them or send data to them. Verdict: FALSE_POSITIVE.","confidence_reasoning":"The URLs appear only as markdown reference links. No automated request, webhook, credential transfer, or exfiltration behavior is present."}],"dangerous_patterns":[],"files_scanned":2,"total_lines":236,"audit_model":"codex","audited_at":"2026-06-30T23:38:58.274+00:00","created_at":"2026-06-30T23:49:01.611296+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}