{"data":{"skill":{"slug":"zhanlincui-deploying-to-production","name":"deploying-to-production","icon":"📦","repo":"https://github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/deploying-to-production","status":"approved","author":"ZhanlinCui","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"a114406a-61c6-4832-8d36-0d221cd600df","skill_id":"e9506227-b331-41f1-88c0-135c61f707c2","version":2,"content_hash":"c5eb577c1ad3fed71a938c6a32571f62","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis flagged one external command and one weak cryptography pattern. The cryptography finding is a false positive because SKILL.md line 3 is frontmatter description text, while the build command on line 22 is expected deployment behavior with ordinary script execution risk.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":22,"line_start":22}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"External Build Command Requires Project Trust","verdict":"TRUE_POSITIVE","locations":[{"file":"SKILL.md","line_end":22,"line_start":22}],"confidence":0.82,"description":"SKILL.md line 22 instructs the agent to run npm run build. This is standard for deployment workflows, but it can execute scripts from the target project, so users should review project dependencies and scripts before running it.","confidence_reasoning":"The command is explicitly present and can run project-defined build scripts. The surrounding deployment workflow gives it legitimate intent, so the risk is low rather than suspicious."},{"title":"False Positive Weak Cryptography Pattern","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":3,"line_start":3}],"confidence":0.97,"description":"The static finding points to SKILL.md line 3, which is a natural language description in frontmatter. No cryptographic algorithm, hash function, encryption code, or credential handling appears at that location.","confidence_reasoning":"Line 3 contains only descriptive text about GitHub and Vercel deployment. There is no evidence of weak cryptography or security-sensitive code in the reviewed file."}],"dangerous_patterns":[{"title":"Project Script Execution","locations":[{"file":"SKILL.md","line_end":22,"line_start":22}],"confidence":0.82,"description":"The workflow includes npm run build, which may execute package scripts from the project being deployed. This is expected for web deployment but should be run only in trusted project contexts.","confidence_reasoning":"The command is present and semantically relevant to deployment. No malicious command chaining, obfuscation, or exfiltration behavior was found."}],"files_scanned":1,"total_lines":41,"audit_model":"codex","audited_at":"2026-07-01T03:23:40.114+00:00","created_at":"2026-07-01T04:01:02.783501+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"low","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}