{"data":{"skill":{"slug":"wshobson-postmortem-writing","name":"postmortem-writing","icon":"📦","repo":"https://github.com/wshobson/agents/tree/main/plugins/incident-response/skills/postmortem-writing","status":"approved","author":"wshobson","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"9bd0899d-5061-4dad-80ea-4876b25fd6ae","skill_id":"f5c948e5-8ca1-448b-b223-0709de35f3ca","version":5,"content_hash":"56165e1b7a57623e9d76c794430b1330","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported many high-risk patterns, but review found they occur inside Markdown examples, prose, and incident templates rather than executable code. The only confirmed risk factor is low-risk network exposure from three external reference links; no prompt injection, malicious intent, credential access, or runnable command execution was found.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"SKILL.md","line_end":372,"line_start":372},{"file":"SKILL.md","line_end":373,"line_start":373},{"file":"SKILL.md","line_end":374,"line_start":374}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"External Documentation Links","locations":[{"file":"SKILL.md","line_end":372,"line_start":372},{"file":"SKILL.md","line_end":373,"line_start":373},{"file":"SKILL.md","line_end":374,"line_start":374}],"confidence":0.86,"description":"The skill links to Google SRE, Etsy, and PagerDuty postmortem resources. These are user-visible references, not hidden network requests or data exfiltration paths.","confidence_reasoning":"The URLs are explicit Markdown resource links at the end of the guide. There is no code that fetches them or sends user data to them."},{"title":"Static Command-Execution Findings Are Markdown False Positives","locations":[{"file":"SKILL.md","line_end":50,"line_start":43},{"file":"SKILL.md","line_end":56,"line_start":50},{"file":"SKILL.md","line_end":80,"line_start":56},{"file":"SKILL.md","line_end":98,"line_start":80},{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":115,"line_start":98},{"file":"SKILL.md","line_end":121,"line_start":115},{"file":"SKILL.md","line_end":214,"line_start":121},{"file":"SKILL.md","line_end":218,"line_start":214},{"file":"SKILL.md","line_end":236,"line_start":218},{"file":"SKILL.md","line_end":236,"line_start":236},{"file":"SKILL.md","line_end":273,"line_start":236},{"file":"SKILL.md","line_end":277,"line_start":273},{"file":"SKILL.md","line_end":301,"line_start":277},{"file":"SKILL.md","line_end":307,"line_start":301},{"file":"SKILL.md","line_end":342,"line_start":307}],"confidence":0.93,"description":"The reported Ruby and shell backtick locations are fenced Markdown examples, inline code formatting, diagrams, and templates. SKILL.md contains guidance text only and no executable script blocks that run commands.","confidence_reasoning":"The reviewed locations are prose or Markdown template content. The file contains no Ruby, shell, JavaScript, or Python execution logic around these lines."},{"title":"Static Blocker Findings Are Prose False Positives","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":110,"line_start":101},{"file":"SKILL.md","line_end":136,"line_start":136},{"file":"SKILL.md","line_end":240,"line_start":226},{"file":"SKILL.md","line_end":322,"line_start":322},{"file":"SKILL.md","line_end":344,"line_start":344},{"file":"SKILL.md","line_end":357,"line_start":357}],"confidence":0.9,"description":"The weak cryptography, at scheduling, and system reconnaissance findings are triggered by ordinary incident-response wording and template content. No cryptographic operation, task scheduling command, or host reconnaissance command is present.","confidence_reasoning":"The cited lines are YAML metadata, postmortem analysis prompts, or best-practice prose. I found no executable commands or security-sensitive implementation in those contexts."},{"title":"Network Library Finding Is Textual False Positive","locations":[{"file":"SKILL.md","line_end":229,"line_start":229}],"confidence":0.94,"description":"The Python HTTP library finding at line 229 is caused by the word requests in an incident evidence sentence. It does not import a library or perform any HTTP operation.","confidence_reasoning":"Line 229 is inside a 5 Whys postmortem example and describes pending requests as operational evidence. There is no Python code or network call at this location."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":375,"audit_model":"codex","audited_at":"2026-07-01T00:10:00.363+00:00","created_at":"2026-07-01T02:22:09.696395+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}