{"data":{"skill":{"slug":"wshobson-shellcheck-configuration","name":"shellcheck-configuration","icon":"📦","repo":"https://github.com/wshobson/agents/tree/main/plugins/shell-scripting/skills/shellcheck-configuration","status":"approved","author":"wshobson","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"8bfdc6af-686e-4bf7-99fa-f2050e0dddd5","skill_id":"c6591312-2cfb-4ea5-811b-4786e45f0ed1","version":6,"content_hash":"f5135b0a821eaf95dc18773b85a4d65d","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Static analysis reported many command, filesystem, network, and blocker patterns, but review shows they are documentation examples for ShellCheck usage. No prompt injection, credential access, data exfiltration, persistence, or malicious execution intent was found in SKILL.md.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":48,"line_start":33},{"file":"SKILL.md","line_end":54,"line_start":48},{"file":"SKILL.md","line_end":56,"line_start":54},{"file":"SKILL.md","line_end":67,"line_start":56},{"file":"SKILL.md","line_end":71,"line_start":67},{"file":"SKILL.md","line_end":80,"line_start":71},{"file":"SKILL.md","line_end":85,"line_start":80},{"file":"SKILL.md","line_end":90,"line_start":85},{"file":"SKILL.md","line_end":98,"line_start":94},{"file":"SKILL.md","line_end":102,"line_start":98},{"file":"SKILL.md","line_end":102,"line_start":102},{"file":"SKILL.md","line_end":113,"line_start":102},{"file":"SKILL.md","line_end":117,"line_start":113},{"file":"SKILL.md","line_end":126,"line_start":117},{"file":"SKILL.md","line_end":132,"line_start":126},{"file":"SKILL.md","line_end":136,"line_start":132},{"file":"SKILL.md","line_end":144,"line_start":136},{"file":"SKILL.md","line_end":150,"line_start":144},{"file":"SKILL.md","line_end":159,"line_start":150},{"file":"SKILL.md","line_end":163,"line_start":159},{"file":"SKILL.md","line_end":172,"line_start":163},{"file":"SKILL.md","line_end":176,"line_start":172},{"file":"SKILL.md","line_end":189,"line_start":176},{"file":"SKILL.md","line_end":193,"line_start":189},{"file":"SKILL.md","line_end":209,"line_start":193},{"file":"SKILL.md","line_end":215,"line_start":209},{"file":"SKILL.md","line_end":231,"line_start":215},{"file":"SKILL.md","line_end":235,"line_start":231},{"file":"SKILL.md","line_end":251,"line_start":235},{"file":"SKILL.md","line_end":255,"line_start":251},{"file":"SKILL.md","line_end":262,"line_start":255},{"file":"SKILL.md","line_end":268,"line_start":262},{"file":"SKILL.md","line_end":289,"line_start":268},{"file":"SKILL.md","line_end":295,"line_start":289},{"file":"SKILL.md","line_end":302,"line_start":295},{"file":"SKILL.md","line_end":306,"line_start":302},{"file":"SKILL.md","line_end":317,"line_start":306},{"file":"SKILL.md","line_end":321,"line_start":317},{"file":"SKILL.md","line_end":331,"line_start":321},{"file":"SKILL.md","line_end":335,"line_start":331},{"file":"SKILL.md","line_end":341,"line_start":335},{"file":"SKILL.md","line_end":345,"line_start":341},{"file":"SKILL.md","line_end":351,"line_start":345},{"file":"SKILL.md","line_end":357,"line_start":351},{"file":"SKILL.md","line_end":368,"line_start":357},{"file":"SKILL.md","line_end":372,"line_start":368},{"file":"SKILL.md","line_end":400,"line_start":372},{"file":"SKILL.md","line_end":406,"line_start":400},{"file":"SKILL.md","line_end":411,"line_start":406},{"file":"SKILL.md","line_end":415,"line_start":411},{"file":"SKILL.md","line_end":420,"line_start":415},{"file":"SKILL.md","line_end":424,"line_start":420},{"file":"SKILL.md","line_end":429,"line_start":424},{"file":"SKILL.md","line_end":433,"line_start":429},{"file":"SKILL.md","line_end":437,"line_start":433},{"file":"SKILL.md","line_end":445,"line_start":437},{"file":"SKILL.md","line_end":103,"line_start":103},{"file":"SKILL.md","line_end":273,"line_start":273},{"file":"SKILL.md","line_end":383,"line_start":383},{"file":"SKILL.md","line_end":113,"line_start":102},{"file":"SKILL.md","line_end":289,"line_start":268},{"file":"SKILL.md","line_end":400,"line_start":372},{"file":"SKILL.md","line_end":151,"line_start":151},{"file":"SKILL.md","line_end":164,"line_start":164},{"file":"SKILL.md","line_end":177,"line_start":177},{"file":"SKILL.md","line_end":216,"line_start":216},{"file":"SKILL.md","line_end":219,"line_start":219},{"file":"SKILL.md","line_end":269,"line_start":269},{"file":"SKILL.md","line_end":358,"line_start":358},{"file":"SKILL.md","line_end":373,"line_start":373},{"file":"SKILL.md","line_end":367,"line_start":367},{"file":"SKILL.md","line_end":249,"line_start":249}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":452,"line_start":452},{"file":"SKILL.md","line_end":453,"line_start":453},{"file":"SKILL.md","line_end":454,"line_start":454}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":124,"line_start":124},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":124,"line_start":124},{"file":"SKILL.md","line_end":124,"line_start":124}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Shell Command Examples Are Documentation","locations":[{"file":"SKILL.md","line_end":48,"line_start":33},{"file":"SKILL.md","line_end":188,"line_start":150},{"file":"SKILL.md","line_end":250,"line_start":215},{"file":"SKILL.md","line_end":399,"line_start":357}],"confidence":0.94,"description":"The external command detections occur in fenced examples showing how to install ShellCheck, run it locally, add CI checks, and parallelize linting. These commands are relevant to the skill purpose and do not show hidden execution, user-input command injection, or unauthorized behavior.","confidence_reasoning":"The matched lines are visibly fenced examples and workflow snippets for ShellCheck. The semantic context supports legitimate documentation rather than executable malware."},{"title":"Configuration File References Are Expected","locations":[{"file":"SKILL.md","line_end":79,"line_start":52},{"file":"SKILL.md","line_end":124,"line_start":123}],"confidence":0.95,"description":"The hidden file matches reference .shellcheckrc and shell profile paths as configuration examples. They do not instruct the model to read secrets, modify unrelated user files, or persist unauthorized changes.","confidence_reasoning":"The file paths are standard examples for ShellCheck and shell configuration guidance. No sensitive file harvesting or broad filesystem traversal was found."},{"title":"Network URLs Point To Public ShellCheck Resources","locations":[{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":454,"line_start":452}],"confidence":0.94,"description":"The hardcoded URLs identify the official ShellCheck repository, wiki, and reference site. They are informational links and do not transmit local data or credentials.","confidence_reasoning":"The URLs are public ShellCheck resources used for installation and documentation. No outbound request code or exfiltration target appears in the file."},{"title":"Blocker Keywords Are ShellCheck Terminology","locations":[{"file":"SKILL.md","line_end":66,"line_start":65},{"file":"SKILL.md","line_end":208,"line_start":201},{"file":"SKILL.md","line_end":288,"line_start":271},{"file":"SKILL.md","line_end":350,"line_start":343}],"confidence":0.91,"description":"The blocker keyword matches come from ShellCheck rule names, disable directives, source annotations, process examples, and command comments. They are not command-and-control instructions or prompt-injection attempts.","confidence_reasoning":"The suspicious terms are embedded in normal ShellCheck examples and rule explanations. I found no text instructing the evaluator or assistant to override security rules."}],"dangerous_patterns":[{"title":"Privilege Escalation Command In CI Example","locations":[{"file":"SKILL.md","line_end":250,"line_start":247}],"confidence":0.72,"description":"A GitHub Actions example uses sudo apt-get install shellcheck. This is a common package installation pattern, but users should review privileged commands before copying workflow examples.","confidence_reasoning":"The sudo command is explicit and privileged, but it installs a known linting tool in a CI example. This is a cautionary pattern, not confirmed malicious behavior."},{"title":"External Source Checkout Example","locations":[{"file":"SKILL.md","line_end":44,"line_start":40}],"confidence":0.68,"description":"The installation section shows cloning the ShellCheck source repository before building it. This is expected setup guidance, but users should verify source repositories before building software.","confidence_reasoning":"The command downloads code from the public ShellCheck repository. It is legitimate in context, with ordinary supply-chain caution still applicable."},{"title":"Parallel Command Execution Example","locations":[{"file":"SKILL.md","line_end":367,"line_start":365}],"confidence":0.7,"description":"The performance section uses xargs to run ShellCheck over files in parallel. The command target is fixed to shellcheck, so arbitrary command execution is not indicated.","confidence_reasoning":"xargs can execute commands, but this example uses it for a specific linting command. The context does not show attacker-controlled command construction."}],"files_scanned":1,"total_lines":455,"audit_model":"codex","audited_at":"2026-07-01T01:10:03.526+00:00","created_at":"2026-07-07T02:32:55.225004+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":4,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}