{"data":{"skill":{"slug":"threadpage-connect","name":"connect","icon":"📦","repo":"https://github.com/threadpage/threadpage-companion/tree/6b26845a15b36d7631787e45d6467df2f4c5fa0a/plugins/threadpage/skills/connect","status":"approved","author":"threadpage","authorVersion":null,"skillstoreRevision":1,"license":null},"licenseCorrection":null,"audit":{"id":"a4de0fb5-4270-4438-827e-d421c511a664","skill_id":"fe726be4-f5d2-4a7c-8e85-53af6f25118b","version":1,"content_hash":"v3:c993c6abcbffafea2683d7748b53b3dfaf438415:17d2b7625fcd467fd52dc7f7f4b5d1b4aa1cbaa586c6d6fd0d9d0bf0603d59a6:dffd7d8d708dff7b25f00825ffe245c3828c954ff8371e108f07a8adc9ee408b:736b696c6c732f746872656164706167652f636f6e6e656374:0cd01968dac3211b9b017c0b63626892","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Both static findings are false positives: Markdown backticks identify a slash command and tool arguments, not executable shell expressions. The instructions require explicit invocation, describe user approval, and request one ThreadPage connection call. No evidence found of prompt injection, credential theft, or unauthorized data transfer in the reviewed file.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":10,"line_start":10}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":13,"audit_model":"codex","audited_at":"2026-11-06T20:39:27.712+00:00","created_at":"2026-11-09T15:36:03.409102+00:00","static_findings":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The person typed `/threadpage:connect $ARGUMENTS`: connect this session to ThreadPage.","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Call the ThreadPage tool `threadpage_connect` once. If the arguments are `as <name>`, pass that n","category":"external_commands","line_end":10,"severity":"medium","line_start":10}],"finding_verdicts":[{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","reason":"SKILL.md:8 uses Markdown backticks to show the user-invoked slash command with its argument placeholder. No Ruby code or shell execution appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"SKILL.md:10 uses Markdown backticks for the ThreadPage tool name and optional naming arguments, not shell expressions. The next instruction describes user approval before execution.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"c993c6abcbffafea2683d7748b53b3dfaf438415","subject_content_hash":"17d2b7625fcd467fd52dc7f7f4b5d1b4aa1cbaa586c6d6fd0d9d0bf0603d59a6","subject_tree_hash":"dffd7d8d708dff7b25f00825ffe245c3828c954ff8371e108f07a8adc9ee408b","subject_plugin_path":"skills/threadpage/connect","audit_payload_hash":"0cd01968dac3211b9b017c0b63626892","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"c993c6abcbffafea2683d7748b53b3dfaf438415","contentHash":"17d2b7625fcd467fd52dc7f7f4b5d1b4aa1cbaa586c6d6fd0d9d0bf0603d59a6","treeHash":"dffd7d8d708dff7b25f00825ffe245c3828c954ff8371e108f07a8adc9ee408b","pluginPath":"skills/threadpage/connect","auditPayloadHash":"0cd01968dac3211b9b017c0b63626892"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/threadpage-connect/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}