{"data":{"skill":{"slug":"zhanlincui-internationalizing-websites","name":"internationalizing-websites","icon":"📦","repo":"https://github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/internationalizing-websites","status":"approved","author":"ZhanlinCui","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"27fcad91-d7ff-4da7-acef-ab1c6e15cbd1","skill_id":"f16fd4ee-bb0a-4e24-b45f-20bb473600cf","version":1,"content_hash":"947fe77c64810cb1a6c2136d66fc6844","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static scanner produced many false positives due to markdown documentation being misinterpreted. The skill contains legitimate i18n automation scripts that modify translation files and configuration - this is expected behavior for an internationalization tool. All detected patterns in markdown files are documentation content (code blocks, links, technical terms), not executable code. The JavaScript scripts perform standard file operations for adding language support.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"reference/hreflang-guide.md","line_end":17,"line_start":15},{"file":"reference/locale-codes.md","line_end":15,"line_start":13},{"file":"reference/seo-checklist.md","line_end":12,"line_start":10},{"file":"SKILL.md","line_end":41,"line_start":33},{"file":"WORKFLOW.md","line_end":11,"line_start":8}]},{"factor":"network","evidence":[{"file":"reference/hreflang-guide.md","line_end":36,"line_start":26},{"file":"reference/locale-codes.md","line_end":152,"line_start":148},{"file":"SKILL.md","line_end":149,"line_start":147},{"file":"WORKFLOW.md","line_end":241,"line_start":236}]},{"factor":"filesystem","evidence":[{"file":"scripts/i18n-add-languages.mjs","line_end":60,"line_start":60},{"file":"scripts/i18n-add-languages.mjs","line_end":108,"line_start":108},{"file":"scripts/i18n-add-schema.js","line_end":571,"line_start":571}]},{"factor":"scripts","evidence":[{"file":"scripts/i18n-add-languages.mjs","line_end":134,"line_start":134}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Script File Operations","locations":[{"file":"scripts/i18n-add-languages.mjs","line_end":403,"line_start":1},{"file":"scripts/i18n-add-schema.js","line_end":607,"line_start":1}],"confidence":0.9,"description":"The skill includes JavaScript scripts that perform file system operations (copy translation files, update configuration). This is expected behavior for an i18n automation skill - the scripts copy en.json templates to create new language files and update locale configurations.","confidence_reasoning":"File operations are clearly part of the intended i18n automation workflow - copying translation files and updating configuration. No malicious intent detected."}],"low_findings":[{"title":"Markdown Code Blocks Flagged","locations":[{"file":"SKILL.md","line_end":260,"line_start":33},{"file":"WORKFLOW.md","line_end":633,"line_start":1}],"confidence":0.95,"description":"Static scanner incorrectly flagged markdown code block syntax (backticks) as shell command execution. The backticks are used for markdown code formatting in documentation files.","confidence_reasoning":"These are clearly markdown documentation files with code blocks using backtick syntax - standard markdown formatting, not actual shell commands."},{"title":"Documentation URLs Flagged","locations":[{"file":"reference/hreflang-guide.md","line_end":436,"line_start":26}],"confidence":0.95,"description":"Static scanner flagged markdown hyperlinks as 'hardcoded URLs'. These are documentation links, not actual network requests made by any code.","confidence_reasoning":"The URLs are markdown hyperlinks in documentation, such as [Google hreflang guidelines](https://developers.google.com/search/docs/advanced/crawling/localized-versions). No actual network calls are made by skill code."}],"dangerous_patterns":[],"files_scanned":7,"total_lines":3244,"audit_model":"claude","audited_at":"2026-02-24T09:55:06.824+00:00","created_at":"2026-02-24T15:49:00.866464+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}