{"data":{"skill":{"slug":"wshobson-on-call-handoff-patterns","name":"on-call-handoff-patterns","icon":"📦","repo":"https://github.com/wshobson/agents/tree/main/plugins/incident-response/skills/on-call-handoff-patterns","status":"approved","author":"wshobson","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"efd50d11-1c87-435b-ad31-a8db47d3a4d9","skill_id":"bcb4aad5-2f8b-4be4-b9c3-f7493eb5ab28","version":5,"content_hash":"c1de72014bb3c53f8793b83f14fbd2f1","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported command execution, network, weak cryptography, scheduling, and reconnaissance patterns in SKILL.md. AI review found these are documentation examples, Markdown fences, timestamps, operational checklist text, and reference links, with no executable code, prompt injection, data exfiltration, or malicious intent.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":44,"line_start":33},{"file":"SKILL.md","line_end":50,"line_start":44},{"file":"SKILL.md","line_end":146,"line_start":50},{"file":"SKILL.md","line_end":176,"line_start":146},{"file":"SKILL.md","line_end":188,"line_start":176},{"file":"SKILL.md","line_end":215,"line_start":188},{"file":"SKILL.md","line_end":219,"line_start":215},{"file":"SKILL.md","line_end":241,"line_start":219},{"file":"SKILL.md","line_end":245,"line_start":241},{"file":"SKILL.md","line_end":296,"line_start":245},{"file":"SKILL.md","line_end":302,"line_start":296},{"file":"SKILL.md","line_end":324,"line_start":302},{"file":"SKILL.md","line_end":330,"line_start":324},{"file":"SKILL.md","line_end":357,"line_start":330},{"file":"SKILL.md","line_end":361,"line_start":357},{"file":"SKILL.md","line_end":380,"line_start":361},{"file":"SKILL.md","line_end":384,"line_start":380},{"file":"SKILL.md","line_end":393,"line_start":384},{"file":"SKILL.md","line_end":399,"line_start":393},{"file":"SKILL.md","line_end":419,"line_start":399}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":103,"line_start":103},{"file":"SKILL.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":114,"line_start":114},{"file":"SKILL.md","line_end":191,"line_start":191},{"file":"SKILL.md","line_end":192,"line_start":192},{"file":"SKILL.md","line_end":193,"line_start":193},{"file":"SKILL.md","line_end":194,"line_start":194},{"file":"SKILL.md","line_end":286,"line_start":286},{"file":"SKILL.md","line_end":287,"line_start":287},{"file":"SKILL.md","line_end":439,"line_start":439},{"file":"SKILL.md","line_end":440,"line_start":440},{"file":"SKILL.md","line_end":441,"line_start":441}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"False Positive: Markdown Fence Markers Flagged as Command Execution","locations":[{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":146,"line_start":146},{"file":"SKILL.md","line_end":176,"line_start":176},{"file":"SKILL.md","line_end":188,"line_start":188},{"file":"SKILL.md","line_end":215,"line_start":215},{"file":"SKILL.md","line_end":219,"line_start":219},{"file":"SKILL.md","line_end":241,"line_start":241},{"file":"SKILL.md","line_end":245,"line_start":245},{"file":"SKILL.md","line_end":296,"line_start":296},{"file":"SKILL.md","line_end":302,"line_start":302},{"file":"SKILL.md","line_end":324,"line_start":324},{"file":"SKILL.md","line_end":330,"line_start":330},{"file":"SKILL.md","line_end":357,"line_start":357},{"file":"SKILL.md","line_end":361,"line_start":361},{"file":"SKILL.md","line_end":380,"line_start":380},{"file":"SKILL.md","line_end":384,"line_start":384},{"file":"SKILL.md","line_end":393,"line_start":393},{"file":"SKILL.md","line_end":399,"line_start":399}],"confidence":0.98,"description":"The external command findings point to Markdown code fence boundaries and documentation examples. They do not invoke Ruby backticks or execute shell commands from the skill.","confidence_reasoning":"The locations are Markdown fences or inline example text in a documentation skill. No executable Ruby or shell wrapper is present in SKILL.md."},{"title":"False Positive: Reference Links Flagged as Network Activity","locations":[{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":103,"line_start":103},{"file":"SKILL.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":114,"line_start":114},{"file":"SKILL.md","line_end":191,"line_start":191},{"file":"SKILL.md","line_end":192,"line_start":192},{"file":"SKILL.md","line_end":193,"line_start":193},{"file":"SKILL.md","line_end":194,"line_start":194},{"file":"SKILL.md","line_end":286,"line_start":286},{"file":"SKILL.md","line_end":287,"line_start":287},{"file":"SKILL.md","line_end":439,"line_start":439},{"file":"SKILL.md","line_end":440,"line_start":440},{"file":"SKILL.md","line_end":441,"line_start":441}],"confidence":0.97,"description":"The network findings are static links to dashboards, internal documents, Slack, PagerDuty, and public learning resources. The skill contains no fetch, curl, webhook, or automatic network request logic.","confidence_reasoning":"Every network location is a Markdown link in template or resources sections. I found no code path that transmits data."},{"title":"False Positive: Weak Cryptography Pattern Found in Non-Cryptographic Text","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":133,"line_start":133}],"confidence":0.96,"description":"The weak cryptography findings occur in the skill description and ordinary infrastructure prose. These lines do not define or call cryptographic algorithms.","confidence_reasoning":"The reviewed lines contain descriptive operational text, not hash functions or encryption APIs. No weak cryptographic behavior is present."},{"title":"False Positive: Scheduling Command Pattern Matched Timestamp Text","locations":[{"file":"SKILL.md","line_end":280,"line_start":280}],"confidence":0.99,"description":"The at command scheduling finding points to a status update time inside an incident handoff template. It does not schedule a command or instruct automation to run later.","confidence_reasoning":"The line is an incident communication timestamp in Markdown. There is no command syntax or shell execution context."},{"title":"False Positive: Reconnaissance Pattern Matched Checklist Language","locations":[{"file":"SKILL.md","line_end":336,"line_start":336},{"file":"SKILL.md","line_end":372,"line_start":372}],"confidence":0.95,"description":"The network reconnaissance findings point to access verification and documentation checklist wording. The skill does not run discovery commands or scan networks.","confidence_reasoning":"The locations are prose in checklist sections. No reconnaissance tool, network scan command, or target enumeration logic is present."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":442,"audit_model":"codex","audited_at":"2026-07-01T01:10:42.999+00:00","created_at":"2026-07-01T02:22:08.663052+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":5,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}