{"data":{"skill":{"slug":"wshobson-javascript-testing-patterns","name":"javascript-testing-patterns","icon":"📦","repo":"https://github.com/wshobson/agents/tree/main/plugins/javascript-typescript/skills/javascript-testing-patterns","status":"approved","author":"wshobson","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"c931e8a2-17cf-4414-9ed0-4d154babd522","skill_id":"438c7494-3cf6-4de2-bce1-dbf2f1209d96","version":5,"content_hash":"b26cf71a1bdfc8c4d2da3afb9f43bc15","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported many critical and high indicators, but review found a single Markdown guide with TypeScript documentation examples, not an executable skill payload. Network, email, environment variable, and database cleanup examples are legitimate testing topics, but they create medium risk if copied into a real project without test isolation and secret hygiene.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":52,"line_start":26},{"file":"SKILL.md","line_end":73,"line_start":57},{"file":"SKILL.md","line_end":126,"line_start":79},{"file":"SKILL.md","line_end":945,"line_start":936}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":223,"line_start":215},{"file":"SKILL.md","line_end":316,"line_start":302},{"file":"SKILL.md","line_end":493,"line_start":491},{"file":"SKILL.md","line_end":624,"line_start":603},{"file":"SKILL.md","line_end":1025,"line_start":1022}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":460,"line_start":447},{"file":"SKILL.md","line_end":493,"line_start":492},{"file":"SKILL.md","line_end":639,"line_start":637},{"file":"SKILL.md","line_end":890,"line_start":890}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":310,"line_start":306},{"file":"SKILL.md","line_end":316,"line_start":315}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Network and Email Examples Require Isolation","verdict":"TRUE_POSITIVE","locations":[{"file":"SKILL.md","line_end":223,"line_start":215},{"file":"SKILL.md","line_end":316,"line_start":302}],"confidence":0.78,"description":"The guide includes sample fetch calls to an external API and a nodemailer transport that reads SMTP values from environment variables. This is appropriate test documentation, but copied examples could contact external services or expose email credentials if used outside mocked test environments.","confidence_reasoning":"The network and environment access patterns are directly present in documentation examples. Confidence is below very high because the file is Markdown guidance and does not execute these calls itself."},{"title":"Database Cleanup Examples Can Be Destructive","verdict":"TRUE_POSITIVE","locations":[{"file":"SKILL.md","line_end":657,"line_start":645},{"file":"SKILL.md","line_end":673,"line_start":666}],"confidence":0.74,"description":"The integration test section shows test database setup and cleanup, including dropping and truncating a users table. The intent is legitimate, but these statements are dangerous if pointed at a shared or production database.","confidence_reasoning":"The SQL cleanup operations are visible and potentially destructive in a copied test setup. The surrounding context names a test database, so the risk depends on user configuration."}],"low_findings":[{"title":"Static Command Execution Hits Are Markdown Code Fence False Positives","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":52,"line_start":26},{"file":"SKILL.md","line_end":73,"line_start":57},{"file":"SKILL.md","line_end":945,"line_start":936}],"confidence":0.91,"description":"The repeated Ruby or shell backtick detections correspond to Markdown fenced TypeScript examples and package script snippets. No evidence found that the skill itself runs shell commands or evaluates user-controlled commands.","confidence_reasoning":"The cited lines are code fences and configuration examples in a Markdown guide. There is no executable wrapper, script file, or command invocation path in the scanned file."},{"title":"Path Traversal Detections Are Relative Import Examples","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":460,"line_start":447},{"file":"SKILL.md","line_end":493,"line_start":492},{"file":"SKILL.md","line_end":890,"line_start":890}],"confidence":0.88,"description":"The path traversal alerts are relative imports used in sample tests, such as importing app, database, logger, or fixtures from neighboring source directories. No evidence found of arbitrary file reads or writes.","confidence_reasoning":"The flagged sequences appear inside normal TypeScript import paths. They do not take user input or access filesystem APIs."},{"title":"Weak Cryptography Alerts Are Keyword False Positives","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":624,"line_start":603},{"file":"SKILL.md","line_end":693,"line_start":681},{"file":"SKILL.md","line_end":974,"line_start":970}],"confidence":0.86,"description":"The scanner flagged words such as hash password, hashed_password, token, and password fields in testing examples. No evidence found of MD5, SHA1, insecure random generation, or cryptographic implementation.","confidence_reasoning":"Targeted review found password and token terminology in sample assertions, not weak cryptographic APIs. The finding is likely generated by broad keyword matching."}],"dangerous_patterns":[{"title":"External HTTP Calls in Sample Service","verdict":"NEEDS_REVIEW","locations":[{"file":"SKILL.md","line_end":223,"line_start":215}],"confidence":0.7,"description":"The async service example calls a hardcoded API URL with fetch. Users should mock this pattern in tests and avoid sending real user data to example endpoints.","confidence_reasoning":"The hardcoded fetch calls are clear, but they are part of a documentation example rather than active skill code."},{"title":"SMTP Credentials Read From Environment Variables","verdict":"NEEDS_REVIEW","locations":[{"file":"SKILL.md","line_end":316,"line_start":302}],"confidence":0.72,"description":"The email service example reads SMTP host, user, password, and from address from environment variables. This is common practice, but tests should mock email delivery and protect secrets.","confidence_reasoning":"The environment variable access is explicit and tied to email sending. The surrounding mocking section reduces malicious-intent confidence."},{"title":"Destructive SQL Cleanup in Integration Test Example","verdict":"NEEDS_REVIEW","locations":[{"file":"SKILL.md","line_end":673,"line_start":666}],"confidence":0.76,"description":"The repository test example includes table drop and truncate cleanup. These commands should only run against isolated test databases.","confidence_reasoning":"The SQL statements are visible and destructive, but the sample connection is named test_db and appears intended for testing isolation."}],"files_scanned":1,"total_lines":1026,"audit_model":"codex","audited_at":"2026-07-01T01:22:31.335+00:00","created_at":"2026-07-01T02:22:05.92216+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}