{"data":{"skill":{"slug":"wshobson-architecture-patterns","name":"architecture-patterns","icon":"📦","repo":"https://github.com/wshobson/agents/tree/main/plugins/backend-development/skills/architecture-patterns","status":"approved","author":"wshobson","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"110909bb-4ea1-4a95-92df-c743e2a7e44c","skill_id":"d6c9f49d-6828-4164-adbf-eec98a6ebe9f","version":7,"content_hash":"7605bb761ca5ed5be7a52e9cc97fbc89","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Static analysis reported 29 potential issues in SKILL.md, including external command, environment access, weak cryptography, and reconnaissance patterns. Review found these are false positives from Markdown code fences, architecture vocabulary, parameterized SQL examples, and illustrative API-key dependency injection. No prompt injection, data exfiltration, executable installer, network beacon, or malicious intent was found.","remediation":[],"risk_factor_evidence":[],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"False Positive: Markdown Code Fence Backticks","locations":[{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":276,"line_start":276},{"file":"SKILL.md","line_end":280,"line_start":280},{"file":"SKILL.md","line_end":360,"line_start":360},{"file":"SKILL.md","line_end":364,"line_start":364}],"confidence":0.98,"description":"Static external command detections map to Markdown code fences and sample code block boundaries, not Ruby or shell execution. The file is documentation and does not define executable skill commands.","confidence_reasoning":"The flagged lines are literal Markdown triple-backtick delimiters. No shell command, command substitution, or runtime execution path is present."},{"title":"False Positive: Illustrative API Key Parameter","locations":[{"file":"SKILL.md","line_end":342,"line_start":340}],"confidence":0.96,"description":"The environment-access alerts refer to an example Stripe adapter constructor and assignment. The example receives api_key as a parameter and does not read process environment variables or secrets from the host.","confidence_reasoning":"The code sample shows api_key as a function argument. There is no process.env, os.environ, filesystem secret read, or outbound exfiltration logic."},{"title":"False Positive: Architecture Terms And Identifiers","locations":[{"file":"SKILL.md","line_end":16,"line_start":3},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":150,"line_start":150},{"file":"SKILL.md","line_end":211,"line_start":211},{"file":"SKILL.md","line_end":238,"line_start":238},{"file":"SKILL.md","line_end":303,"line_start":298},{"file":"SKILL.md","line_end":376,"line_start":362},{"file":"SKILL.md","line_end":394,"line_start":394},{"file":"SKILL.md","line_end":425,"line_start":425}],"confidence":0.94,"description":"Weak-cryptography and reconnaissance alerts match words such as Clean Architecture, Domain-Driven Design, id fields, customer identifiers, and SQL examples. These are explanatory architecture examples, not cryptographic or host reconnaissance behavior.","confidence_reasoning":"The flagged text is ordinary architecture guidance and sample domain model code. No weak algorithm call, host inspection command, or system inventory collection appears."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":488,"audit_model":"codex","audited_at":"2026-06-30T21:50:24.604+00:00","created_at":"2026-07-07T02:38:17.687786+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}