{"data":{"skill":{"slug":"zhanlincui-obsidian-markdown","name":"obsidian-markdown","icon":"📦","repo":"https://github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/obsidian-markdown","status":"approved","author":"ZhanlinCui","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"24b7593c-e7fa-4745-98f9-02d36364e378","skill_id":"b25e77cf-c997-4533-8ca7-a25c7d8d140c","version":3,"content_hash":"52388100ebe804337453120a8ab5bf0e","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Static analysis reported many command execution, weak crypto, reconnaissance, and URL patterns. Review found the command, crypto, and reconnaissance alerts are Markdown documentation false positives. The remaining URLs are examples or documentation references, with no automated network access or exfiltration intent.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"SKILL.md","line_end":15,"line_start":13},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":143,"line_start":142},{"file":"SKILL.md","line_end":603,"line_start":603},{"file":"SKILL.md","line_end":620,"line_start":614}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Markdown Backticks Misclassified as Shell Execution","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":62,"line_start":22},{"file":"SKILL.md","line_end":333,"line_start":296},{"file":"SKILL.md","line_end":591,"line_start":545}],"confidence":0.98,"description":"Static command alerts are Markdown fences and inline code examples. They are documentation syntax, not Ruby or shell execution.","confidence_reasoning":"The flagged text is inside Markdown code fences or inline examples. No executable script, interpreter call, or command invocation is present."},{"title":"Reference URLs Are Documentation Links","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":15,"line_start":13},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":143,"line_start":142},{"file":"SKILL.md","line_end":603,"line_start":603},{"file":"SKILL.md","line_end":620,"line_start":614}],"confidence":0.93,"description":"Hardcoded URLs point to public Markdown, Obsidian, LaTeX, or example documentation. The skill does not fetch or transmit data.","confidence_reasoning":"The URLs are rendered as links or examples. I found no code that opens network connections or sends user content externally."},{"title":"Weak Crypto Alerts Are Word Matches","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":218,"line_start":218},{"file":"SKILL.md","line_end":324,"line_start":324},{"file":"SKILL.md","line_end":571,"line_start":571}],"confidence":0.97,"description":"The high blocker alerts match ordinary Markdown text such as description, type labels, nesting guidance, and frontend design wording.","confidence_reasoning":"The flagged lines do not contain cryptographic functions or algorithms. They are prose, table headers, or note content examples."},{"title":"Reconnaissance Alerts Are Markdown Content","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":100,"line_start":92},{"file":"SKILL.md","line_end":418,"line_start":395},{"file":"SKILL.md","line_end":586,"line_start":586}],"confidence":0.96,"description":"System reconnaissance alerts match normal documentation examples, block IDs, Mermaid graph syntax, and note text. No host inspection is requested.","confidence_reasoning":"The lines are example note syntax and diagram syntax. I found no commands for host, network, user, or environment enumeration."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":621,"audit_model":"codex","audited_at":"2026-07-01T03:00:38.789+00:00","created_at":"2026-07-07T02:34:26.863501+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":4,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}