{"data":{"skill":{"slug":"zhanlincui-web-artifacts-builder","name":"web-artifacts-builder","icon":"📦","repo":"https://github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/web-artifacts-builder","status":"approved","author":"ZhanlinCui","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"50ef63e7-9c25-4a74-b18c-4baf42b1fcd2","skill_id":"ebc88744-b8ff-4f2e-ba56-233e6373d162","version":1,"content_hash":"0b6b6ebba7fc4a8c3e04abb81b22cadb","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis flagged 39 patterns across 3 files (451 lines). All findings evaluated as false positives: shell commands are legitimate build tooling with hardcoded arguments, filesystem operations modify only project-local configuration files, network references are documentation URLs only, and weak crypto detections are false matches on CSS color values. The skill is a frontend scaffolding tool with no malicious patterns detected.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"scripts/bundle-artifact.sh","line_end":54,"line_start":1},{"file":"scripts/init-artifact.sh","line_end":323,"line_start":1}]},{"factor":"scripts","evidence":[{"file":"scripts/init-artifact.sh","line_end":93,"line_start":93}]},{"factor":"filesystem","evidence":[{"file":"scripts/init-artifact.sh","line_end":250,"line_start":230}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Shell Script Execution","locations":[{"file":"scripts/bundle-artifact.sh","line_end":54,"line_start":1},{"file":"scripts/init-artifact.sh","line_end":323,"line_start":1}],"description":"Build scripts execute shell commands for project scaffolding. All commands use hardcoded arguments with no user input injection vectors. Standard pattern for development tooling."},{"title":"Filesystem Modification","locations":[{"file":"scripts/init-artifact.sh","line_end":251,"line_start":228}],"description":"Scripts modify project configuration files (tsconfig.json, tailwind.config.js) using Node.js fs module. Operations are scoped to the created project directory only."}],"dangerous_patterns":[],"files_scanned":3,"total_lines":451,"audit_model":"claude","audited_at":"2026-02-24T09:24:35.256+00:00","created_at":"2026-02-24T15:49:03.917643+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}