{"data":{"skill":{"slug":"zhuyansen-backlink-guard","name":"backlink-guard","icon":"📦","repo":"https://github.com/zhuyansen/backlink-guard/tree/588ff58d3cfd5c59590ff11e7ce967427d069afa/skills/backlink-guard","status":"approved","author":"zhuyansen","authorVersion":null,"skillstoreRevision":3},"audit":{"id":"e5731aea-8de7-43fc-a4bf-a16c4db6fff2","skill_id":"4acb8709-55ec-4282-be6d-162ad684dd43","version":3,"content_hash":"v3:0b4c943e6552f80b68898606ff940013b53776a9:91b79ef58814113881e393e86a0370149844cea86eb99934a83d1c5cfd6f638c:d5adc3e735bc61e4e78ec867e1e36cc2cbe82cf08cf7ced79f659f701fa11b1d:736b696c6c732f7a687579616e73656e2f6261636b6c696e6b2d6775617264:bb2479489bccd6b9b7217b970487d1fc","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 113 static findings are false positives involving Markdown, documented configuration, example URLs, or legitimate backlink workflows. No evidence found of prompt injection, credential exfiltration, destructive actions, or unauthorized submissions in SKILL.md. The externally installed PyPI implementation was not provided, so its runtime security was not verified.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":25,"line_start":23},{"file":"SKILL.md","line_end":27,"line_start":25},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":30,"line_start":29},{"file":"SKILL.md","line_end":31,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":33,"line_start":32},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":41,"line_start":39},{"file":"SKILL.md","line_end":43,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":51,"line_start":49},{"file":"SKILL.md","line_end":53,"line_start":51},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":61,"line_start":59},{"file":"SKILL.md","line_end":63,"line_start":61},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":70,"line_start":67},{"file":"SKILL.md","line_end":72,"line_start":70},{"file":"SKILL.md","line_end":72,"line_start":72},{"file":"SKILL.md","line_end":74,"line_start":74},{"file":"SKILL.md","line_end":80,"line_start":76},{"file":"SKILL.md","line_end":82,"line_start":80},{"file":"SKILL.md","line_end":84,"line_start":82},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":91,"line_start":90},{"file":"SKILL.md","line_end":92,"line_start":91},{"file":"SKILL.md","line_end":93,"line_start":92},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":95,"line_start":95},{"file":"SKILL.md","line_end":97,"line_start":96},{"file":"SKILL.md","line_end":97,"line_start":97},{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":100,"line_start":99},{"file":"SKILL.md","line_end":101,"line_start":100},{"file":"SKILL.md","line_end":102,"line_start":101},{"file":"SKILL.md","line_end":103,"line_start":102},{"file":"SKILL.md","line_end":104,"line_start":103},{"file":"SKILL.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":105,"line_start":105}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":126,"line_start":126},{"file":"SKILL.md","line_end":136,"line_start":136},{"file":"SKILL.md","line_end":137,"line_start":137}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":12,"line_start":12}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":16,"line_start":16}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":190,"audit_model":"codex","audited_at":"2026-10-28T11:28:51.352+00:00","created_at":"2026-10-28T12:09:22.340892+00:00","static_findings":[{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Run the pinned release from PyPI: `uvx backlink-guard==0.11.1 <command>` when `uv` is there, else","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `GLASSER_API_KEY` (https://link.glasser.ai/JasonZhu), the first choice: spam scores, Google search","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `AISA_API_KEY` (https://go.aisa.one/yansen-zhu), the second: the same when there is no Glasser key","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `GOANYAPI_API_KEY` (https://goanyapi.com/r/ga-95708898fb): a site's rating, a year of monthly visi","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Say the cost in USD and wait for the user's yes before any paid run. `find`: about 0.005 USD a ke","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":25,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":27,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Start here when the user asks where to get links or listings. It reads Google's top 30 for each keyw","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `list`: ask to be added (a pull request to a GitHub list, a short note to an article's author), on","category":"external_commands","line_end":30,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `directory`: a place to submit to, after vet and the user's yes (section 3). A GitHub topic page m","category":"external_commands","line_end":31,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `article`, `video`: an author or creator who covered the topic. Offer what the page lacks; a paid ","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `community`: answer where it genuinely helps. Never drop links in bulk.","category":"external_commands","line_end":33,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `docs`, `site`: official pages and products; not sources.","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`--vet` vets the directories and the article sites found (not platforms like GitHub, Medium or YouTu","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":41,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":43,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"For each competitor, `new` holds its referring domains first seen in the last `--days` days (7), str","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":51,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":53,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use it when the user's site is new, or asks how competitors got started: the strong sites linking to","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Lead with the same-age table: a new site compares itself with what its competitors had at the same a","category":"external_commands","line_end":55,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":61,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":63,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"For each keyword (Google US, English): `overview` (whether there is an AI Overview), `cited` (the pa","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":70,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":72,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`questions` has ChatGPT, Claude and Gemini write the questions they expect; show them to the user an","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"With `--rank`, `ranks` looks each search up on Google and Bing (top 20): `by_engine` says how many s","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Answers vary from one ask to the next: report counts with their denominators and call a change of on","category":"external_commands","line_end":80,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":82,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":84,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"One call for all the sites the user is considering. Add `--topic \"their keyword\"` to see where each ","category":"external_commands","line_end":84,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Lead with `action`, and say `action_reason` in a sentence. `skip`: do not submit. `look first`: a ","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `networks` in the result: one operator's sites that the shared spam-link list lacks, most of them ","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- A `listed` finding: the site is on the shared list of spam-link sources (github.com/zhuyansen/back","category":"external_commands","line_end":91,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `avoid` (dead, parked, not listed by Google, a URL shortener, a link network's template page, a li","category":"external_commands","line_end":92,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `caution`: read the evidence aloud to the user and let them decide.","category":"external_commands","line_end":93,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Each row also has `policy` (`avoid`, `caution`, `clean`: what a link there would mean under Google","category":"external_commands","line_end":93,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ok` with one finding under Why: one caution alone is not a verdict. Name it in a sentence; for `p","category":"external_commands","line_end":94,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Sells followed links** (`paid_follow`): the free listing may still be fine. Never pay for a foll","category":"external_commands","line_end":95,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Asks for a link or badge back** (`link_exchange`): one is a choice; a habit of it is a link exch","category":"external_commands","line_end":97,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Visits fell sharply in a month** (`traffic_cliff`): the evidence names the Google updates that r","category":"external_commands","line_end":97,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Lost its Google search traffic** (`search_fall`, the last 12 months; `old_search_fall` is the sa","category":"external_commands","line_end":98,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Thousands of pages, almost none ranking** (`scaled_pages`): the site's own sitemaps list 1,000 o","category":"external_commands","line_end":100,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **High rating, almost no visitors** (`hollow_rating`): the rating was built with links. A listing ","category":"external_commands","line_end":101,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **High spam score** (`spam_score`): the site's own backlinks look manufactured.","category":"external_commands","line_end":102,"severity":"medium","line_start":101},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **One template across several sites** (`same_template`): one operator's network, found in this che","category":"external_commands","line_end":103,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **One analytics or ads account across several sites** (`same_owner`): the same AdSense, Analytics,","category":"external_commands","line_end":104,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Badge network** (`badge_network`, with `--deep`): its rating comes from the badges every listed ","category":"external_commands","line_end":104,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Unproven** (`unproven`, with `--deep`): new, almost nobody links to it, almost nobody visits. Ah","category":"external_commands","line_end":105,"severity":"medium","line_start":105},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Not indexing** (`not_indexing`, with `--recent`): it keeps adding pages and Google shows none fr","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ok` with `reach: low`: harmless and useless. Skip it unless it costs nothing.","category":"external_commands","line_end":107,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- A `blocked` note means the site refused the check: the page signals are missing, not clean.","category":"external_commands","line_end":109,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `incomplete`: it looked ok, but a check that could have found something failed (`missing` says whi","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- A row with `skipped`: its own pages already put it at avoid, so no paid check was bought for it.","category":"external_commands","line_end":111,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `newcomers` (with `--newcomers`): whether it still takes new sites, read off its newest sitemap pa","category":"external_commands","line_end":111,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Nothing goes out without the user's yes. Before each submission, pull request, issue, form or emai","category":"external_commands","line_end":119,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Read the list's contribution rules first. Where they ask for a human (some lists forbid agents and","category":"external_commands","line_end":125,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":128,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":135,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":138,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":140,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Verdicts: `followed link` (passes ranking credit), `qualified link` (nofollow, sponsored or ugc: vis","category":"external_commands","line_end":140,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":146,"severity":"medium","line_start":144},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":150,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `velocity_spike`: a week far above the usual. Ask what was done that week.","category":"external_commands","line_end":151,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `anchor_repeat`: one keyword anchor on a large share of links.","category":"external_commands","line_end":152,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `spam_anchor`: anchors that sell links or name gambling and similar trades. Someone else's network","category":"external_commands","line_end":153,"severity":"medium","line_start":152},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `spammy_referrers`: several of the top linking sites score high for spam. If the user paid any of ","category":"external_commands","line_end":154,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `owner_network`: three or more sites linking to the user report to one analytics or ads account (A","category":"external_commands","line_end":154,"severity":"medium","line_start":154},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `sitewide` (a note): one site links to one page of the user's from many of its pages (20 or more b","category":"external_commands","line_end":155,"severity":"medium","line_start":155},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":161,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":163,"severity":"medium","line_start":161},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"From the same backlinks, it asks each page of the user's that gets links whether it is still there (","category":"external_commands","line_end":163,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`redirected` holds the pages of the user's that redirect, followed hop by hop, each with a `verdict`","category":"external_commands","line_end":165,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":173,"severity":"medium","line_start":171},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":175,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"It checks the sites in the log (submitted or live) again and compares them with the last look: a low","category":"external_commands","line_end":175,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If the user has analytics, ask for the referral export (GA4: Reports, Acquisition, Traffic acquisiti","category":"external_commands","line_end":177,"severity":"medium","line_start":177},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For `find`: the keywords with their searches, then the pages worth being on, busiest first (page, ","category":"external_commands","line_end":182,"severity":"medium","line_start":181},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For `vet`: a table (site, action, verdict, reach, rating, visits a month, spam score, fit when `--","category":"external_commands","line_end":182,"severity":"medium","line_start":182},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For `audit`: the numbers, the findings with evidence, and at most three things to do.","category":"external_commands","line_end":184,"severity":"medium","line_start":183},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For `lost`: the dead pages with their referring domains and the suggested 301 targets, the ones wi","category":"external_commands","line_end":185,"severity":"medium","line_start":184},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For `competitors`: per competitor the new sites worth a look, then the sites linking to several co","category":"external_commands","line_end":186,"severity":"medium","line_start":185},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For `competitors --early`: the same-age table with each launch day and where it came from, the bur","category":"external_commands","line_end":186,"severity":"medium","line_start":186},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For `cited`: per keyword whether there is an AI Overview and whether it cites the user, then the s","category":"external_commands","line_end":188,"severity":"medium","line_start":187},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For `asked`: a table per assistant (answers, domain written, name only, cited, same-name site), th","category":"external_commands","line_end":188,"severity":"medium","line_start":188},{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- `GLASSER_API_KEY` (https://link.glasser.ai/JasonZhu), the first choice: spam scores, Google search","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- `AISA_API_KEY` (https://go.aisa.one/yansen-zhu), the second: the same when there is no Glasser key","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:SKILL.md:16:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- `GOANYAPI_API_KEY` (https://goanyapi.com/r/ga-95708898fb): a site's rating, a year of monthly visi","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:SKILL.md:126:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"backlink-guard log add mcpservers.org --kind directory --anchor \"Agent Skills Hub\" --url https://mcp","category":"network","line_end":126,"severity":"low","line_start":126},{"id":"network:SKILL.md:136:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"backlink-guard verify https://mcpservers.org/servers/you/your-tool --to yoursite.com","category":"network","line_end":136,"severity":"low","line_start":136},{"id":"network:SKILL.md:137:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"backlink-guard log set mcpservers.org --status live --url https://mcpservers.org/servers/you/your-to","category":"network","line_end":137,"severity":"low","line_start":137},{"id":"filesystem:SKILL.md:12:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"1. Run the pinned release from PyPI: `uvx backlink-guard==0.11.1 <command>` when `uv` is there, else","category":"filesystem","line_end":12,"severity":"high","line_start":12},{"id":"filesystem:SKILL.md:12:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"1. Run the pinned release from PyPI: `uvx backlink-guard==0.11.1 <command>` when `uv` is there, else","category":"filesystem","line_end":12,"severity":"medium","line_start":12},{"id":"env_access:SKILL.md:3:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"description: Check a link source before submitting a site to it, verify a listing after it goes live","category":"env_access","line_end":3,"severity":"high","line_start":3},{"id":"env_access:SKILL.md:14:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- `GLASSER_API_KEY` (https://link.glasser.ai/JasonZhu), the first choice: spam scores, Google search","category":"env_access","line_end":14,"severity":"high","line_start":14},{"id":"env_access:SKILL.md:15:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- `AISA_API_KEY` (https://go.aisa.one/yansen-zhu), the second: the same when there is no Glasser key","category":"env_access","line_end":15,"severity":"high","line_start":15},{"id":"env_access:SKILL.md:16:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- `GOANYAPI_API_KEY` (https://goanyapi.com/r/ga-95708898fb): a site's rating, a year of monthly visi","category":"env_access","line_end":16,"severity":"high","line_start":16},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: Check a link source before submitting a site to it, verify a listing after it goes live","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:SKILL.md:12:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"1. Run the pinned release from PyPI: `uvx backlink-guard==0.11.1 <command>` when `uv` is there, else","category":"blocker","line_end":12,"severity":"low","line_start":12},{"id":"blocker:SKILL.md:17:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"When the user has neither and wants the paid signals, suggest Glasser first, then AIsa. Without a ke","category":"blocker","line_end":17,"severity":"low","line_start":17},{"id":"blocker:SKILL.md:18:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"3. Say the cost in USD and wait for the user's yes before any paid run. `find`: about 0.005 USD a ke","category":"blocker","line_end":18,"severity":"low","line_start":18},{"id":"blocker:SKILL.md:29:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- `list`: ask to be added (a pull request to a GitHub list, a short note to an article's author), on","category":"blocker","line_end":29,"severity":"low","line_start":29},{"id":"blocker:SKILL.md:31:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- `article`, `video`: an author or creator who covered the topic. Offer what the page lacks; a paid ","category":"blocker","line_end":31,"severity":"low","line_start":31},{"id":"blocker:SKILL.md:43:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"For each competitor, `new` holds its referring domains first seen in the last `--days` days (7), str","category":"blocker","line_end":43,"severity":"low","line_start":43},{"id":"blocker:SKILL.md:84:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"One call for all the sites the user is considering. Add `--topic \"their keyword\"` to see where each ","category":"blocker","line_end":84,"severity":"low","line_start":84},{"id":"blocker:SKILL.md:95:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Sells followed links** (`paid_follow`): the free listing may still be fine. Never pay for a foll","category":"blocker","line_end":95,"severity":"low","line_start":95},{"id":"blocker:SKILL.md:110:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- A row with `skipped`: its own pages already put it at avoid, so no paid check was bought for it.","category":"blocker","line_end":110,"severity":"low","line_start":110},{"id":"blocker:SKILL.md:121:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Read the list's contribution rules first. Where they ask for a human (some lists forbid agents and","category":"blocker","line_end":121,"severity":"low","line_start":121},{"id":"blocker:SKILL.md:140:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Verdicts: `followed link` (passes ranking credit), `qualified link` (nofollow, sponsored or ugc: vis","category":"blocker","line_end":140,"severity":"low","line_start":140},{"id":"blocker:SKILL.md:153:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- `spammy_referrers`: several of the top linking sites score high for spam. If the user paid any of ","category":"blocker","line_end":153,"severity":"low","line_start":153},{"id":"blocker:SKILL.md:175:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"It checks the sites in the log (submitted or live) again and compares them with the last look: a low","category":"blocker","line_end":175,"severity":"low","line_start":175}],"finding_verdicts":[{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"Backticks delimit Markdown examples for the pinned backlink-guard CLI, not shell substitution. Installing the intended tool is documented; its external implementation remains unreviewed.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"GLASSER_API_KEY is a configuration name formatted as inline Markdown. This line contains no executable shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"AISA_API_KEY and command options are inline Markdown identifiers. The line describes optional provider features rather than executing commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"GOANYAPI_API_KEY is a documented configuration name enclosed in Markdown backticks. No shell substitution or executable expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"Backticks format command names and options in a pricing explanation. The text explicitly requires cost disclosure and user approval before paid runs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"This is a Markdown fence around a backlink-guard find example. Its quoted keywords and example domain do not contain shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The matched characters close a Markdown code block. The following prose explains discovery output rather than executing a shell expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Backticks identify result fields such as kind, ranks, visitors, and action. They are documentation labels, not executable expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"The list label is inline Markdown, and the text requires approval before outreach. Neither this line nor the adjacent directory label performs shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Directory, article, and video are documented page classifications. The prose requires vetting and user approval, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Article and video are inline Markdown labels describing relevant outreach. No executable backtick expression is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"Community and adjacent page labels are Markdown identifiers. The instruction prohibits bulk link posting rather than executing external commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Docs and site are inline labels for official pages and products. The line contains no shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks format the documented --vet and --skip options. Describing these options is not shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"A Markdown fence encloses the intended competitor comparison command with example domains. It contains no dynamic shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The matched fence closes the competitor example. The following output-field descriptions are prose, not executable shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"Backticks identify competitor report fields and budget options. This explains public backlink analysis, not shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"This Markdown fence encloses a documented competitors --early example. The command uses example domains without shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The matched characters close a Markdown example. Adjacent prose describes launch-channel research rather than executing a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"Inline backticks mark launch dates, counts, and checklist fields. These are documented output identifiers with no shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"Young.recent, skip, and avoid are report labels formatted as Markdown. The text explains ranking a checklist, not executing shell expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"A Markdown code fence wraps the cited command with quoted example keywords. No shell substitution appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"This is the closing fence for an AI Overview lookup example. The nearby text defines citation fields, not executable expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"Overview, cited, you, rank, and sites are Markdown-formatted result fields. The line only describes interpreting search results.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The Markdown block demonstrates writing generated questions to questions.txt and reading that file for an authorized lookup. It contains no backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The matched fence ends the questions workflow example. Following Markdown identifiers describe assistant response counts, not shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"Questions, asked, and response fields are inline Markdown. The workflow requires user review of questions before paying for answers.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"Backticks mark ranking options and output fields for Google and Bing lookups. No executable shell substitution is shown.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The span contains cache guidance, an inline --rank option, and a Markdown fence. None is a Ruby or shell execution expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"This Markdown fence encloses a vet command for three public example sites. It is the advertised source-checking workflow, without shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The match starts at the vet example's closing Markdown fence. Following option and result descriptions are documentation, not executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"Backticks identify CLI options, user-provided file examples, and result fields. No shell interpolation or unrelated command is specified.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"Action values are Markdown-formatted labels used to explain recommendations. The text limits paid placements and asks users to decide uncertain cases.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"Networks and report are output-field names in Markdown. The text explicitly leaves report submission to the user.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"Listed and avoid are labels describing spam-source evidence. The shared-list reference and reporting suggestion contain no shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"Avoid and caution are Markdown report labels. The prose discourages submitting to suspicious sites rather than executing commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The span explains caution, policy, and value fields. Inline formatting is not shell execution, and the user retains the decision.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"Policy and value classifications are Markdown labels. The instructions distinguish SEO policy concerns from audience value without executing code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"Ok and paid_follow are documented verdict identifiers. The line explains a caution finding and prohibits paying for followed links.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"Backticks format paid_follow and HTML link attributes. These are SEO examples, not shell expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"Link_exchange and traffic_cliff are documented finding names. Their Markdown formatting does not execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"Traffic_cliff and traffic_drop identify report flags. The prose cautions against unsupported penalty claims and contains no shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"Search_fall and old_search_fall are inline result labels. The line discusses geographic and evidentiary limitations, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"Scaled_pages and the adjacent hollow_rating identifier are Markdown field labels. This describes ranking signals rather than executable shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"Hollow_rating and spam_score are report identifiers. Backticks provide inline formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"Spam_score and same_template name backlink analysis findings. No command or executable substitution appears in this span.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"Same_template and same_owner label website network signals. They describe public site comparisons, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"Same_owner, badge_network, and --deep are Markdown identifiers. The text discusses website ownership signals without executable shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"Badge_network and --deep are documented finding and option names. The instruction discourages paid link exchanges rather than running commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"Unproven and --deep are Markdown labels for a low-evidence website signal. No shell substitution appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"Backticks mark indexing flags and a search operator. This explains incomplete search evidence, not executable shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"Ok and reach: low are result values in Markdown. The line contains only a recommendation about free listings.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"Blocked and incomplete are documented status labels. The text warns that failed checks do not establish safety.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"Incomplete and missing are inline report fields. Requesting a repeat check is normal workflow guidance, not backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"Skipped and the adjacent newcomers fields describe results and cost avoidance. Markdown labels do not execute shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"Newcomers, its option, and sampling fields are inline Markdown. The passage describes public sitemap sampling and its limitations.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"Submit and ok are quoted result values, not shell expressions. The instruction explicitly requires separate user approval for every external submission.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The span includes an inline gh reference and a Markdown fence for logging examples. It requires respecting human-only contribution rules, not bypassing them.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"A Markdown fence encloses local submission-log examples. The commands record an example URL rather than submit content or execute backtick expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"The match spans closing and opening Markdown fences with intervening prose. That prose prohibits bulk link creation and contains no shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"A fenced example verifies a public listing and updates its local log status. No executable backtick substitution or unauthorized submission is shown.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"The closing code fence is followed by Markdown-formatted link verdicts and attributes. These characters do not represent shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"Backticks mark link verdicts, rel attributes, and placement labels. The passage documents verification output and browser-check limitations, not executable expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","reason":"A Markdown fence wraps an audit command for an example domain. This is the advertised backlink-profile analysis, without shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The matched fence closes the audit example, followed by descriptive report prose. No executable backtick expression is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"Velocity_spike and anchor_repeat are Markdown-formatted finding names. The text asks for campaign context rather than executing code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"Anchor_repeat and spam_anchor label backlink patterns. Their inline Markdown formatting has no execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","reason":"Spam_anchor and spammy_referrers are report labels. The prose describes unwanted backlinks and cautions against alarming the user.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"Spammy_referrers and owner_network are Markdown identifiers for backlink findings. No executable shell expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","reason":"Owner_network, owners, and --homes are documented report fields and options. Comparing public website account identifiers is not shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","reason":"Sitewide and --sitewide are inline identifiers explaining link aggregation. The line contains no command execution syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"A Markdown code fence encloses the intended lost-page lookup command. It uses an example domain without shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","reason":"The matched fence closes the lost example. Subsequent status labels and redirect suggestions are documentation, not executable shell expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"Suggest, score, blocked, and unreachable are result labels in Markdown. The text explicitly says the tool changes no redirects.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"Backticks mark redirect classifications and report fields. The passage asks for review before changes and contains no shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","reason":"A Markdown fence encloses the documented recheck command for an example site. No dynamic shell expression is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"The matched characters close the recheck example. Following inline options describe checking logged sites, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"The --to and log add references are Markdown-formatted CLI guidance. The text describes reporting deterioration, not injecting checkout links or executing substitutions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","reason":"The --referrals and sent_you identifiers describe importing a user-supplied analytics export. No shell substitution or instruction to transmit that export appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","reason":"Find, vet, and related options are Markdown command labels in reporting instructions. The passage specifies presentation, not executable shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","reason":"Vet, --topic, and networks identify report sections and options. The instruction requires evidence and missing-signal disclosure rather than executing code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"Audit and lost are Markdown labels for report formats. The passage requests concise evidence-based recommendations, not command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","reason":"Lost and competitors are inline report headings. The text describes suggested redirects and competitor summaries, with no executable backtick expressions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","reason":"Competitors and competitors --early label report variants. The passage requests evidence, omitted-data disclosure, and costs rather than executing commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","reason":"Competitors --early and before_index are Markdown identifiers. They define a comparison report and index limitation, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","reason":"Cited and asked are inline command labels for report presentation. The span contains no shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","reason":"Asked and --rank are Markdown identifiers in assistant-citation reporting guidance. The instruction describes tables and costs, not executable expressions.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:14:hardcoded-url","reason":"The Glasser URL is a provider referral link beside an optional API key name. No credential-bearing request or automatic data transmission is specified.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:15:hardcoded-url","reason":"The AIsa URL is a provider referral link for documented optional features. It is not an exfiltration request or an instruction to send secrets.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:16:hardcoded-url","reason":"The GoAnyAPI URL is a referral link for an optional metrics provider. The line specifies no secret transmission or unrelated network action.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:126:hardcoded-url","reason":"The public submission URL is recorded by a local log add example. The surrounding rules require explicit user approval before any actual submission.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:136:hardcoded-url","reason":"The URL is a placeholder public listing checked for a backlink to the user's site. This is the advertised verification task, not exfiltration.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:137:hardcoded-url","reason":"The example records a public listing URL and live status in the local log. No remote submission or credential-bearing request is specified.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:12:hidden-file-in-home-directory","reason":"The documented ~/.backlink-guard directory stores application logs, cached paid answers, and known networks. No unrelated hidden-file access or covert persistence is instructed.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:12:hidden-file-access","reason":"This is disclosed application-state storage with a BACKLINK_GUARD_STATE relocation option. The text does not instruct access to SSH keys or other unrelated secrets.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:3:generic-api-secret-keys","reason":"The description names optional provider key variables but includes no secret values. No environment enumeration or credential exfiltration is instructed.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:14:generic-api-secret-keys","reason":"GLASSER_API_KEY is the documented optional credential name for requested SEO signals. No actual key value or instruction to disclose it appears.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:15:generic-api-secret-keys","reason":"AISA_API_KEY names an optional provider credential for documented features. The text contains no secret value or unrelated credential collection.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:16:generic-api-secret-keys","reason":"GOANYAPI_API_KEY names an optional metrics-provider credential. The line neither embeds a secret nor instructs credential disclosure.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"The frontmatter describes backlink research and optional provider keys. It does not request local host, account, or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:12:system-reconnaissance","reason":"The line specifies a Python requirement, a pinned CLI release, and application-state storage. Checking tool availability is setup guidance, not system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:17:system-reconnaissance","reason":"The text explains optional provider selection and missing paid signals. It requests no system inventory or secret discovery.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:18:system-reconnaissance","reason":"This line lists prices, spending caps, and approval requirements. It contains no host inspection or reconnaissance instructions.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:29:system-reconnaissance","reason":"The line describes user-approved outreach to relevant public lists. It does not enumerate local users, services, or system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:31:system-reconnaissance","reason":"The prose describes relevant author outreach and marking paid mentions. No system reconnaissance activity is requested.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:43:system-reconnaissance","reason":"The line describes competitor referring domains and public linking pages. This is scoped backlink research, not reconnaissance of the local system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:84:system-reconnaissance","reason":"The workflow vets user-selected sites and accepts user-specified lists. It does not request broad filesystem discovery or host enumeration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:95:system-reconnaissance","reason":"The line explains paid-link policy and HTML rel attributes. It contains no local system inspection.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:110:system-reconnaissance","reason":"Skipped means a paid site check was avoided after negative page findings. The text describes cost control, not reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:121:system-reconnaissance","reason":"The instruction requires reading contribution rules and respecting human-only workflows. Mentioning gh does not enumerate systems or bypass access restrictions.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:140:system-reconnaissance","reason":"The line explains public backlink attributes, placement, and browser verification. It requests no host information or internal network discovery.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:153:system-reconnaissance","reason":"The line discusses spam scores of public referring sites. No local system, process, or account enumeration is present.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:175:system-reconnaissance","reason":"Recheck revisits previously logged public sites and reports deterioration. An injected checkout link is a warning example, not an instruction or reconnaissance action.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"0b4c943e6552f80b68898606ff940013b53776a9","subject_content_hash":"91b79ef58814113881e393e86a0370149844cea86eb99934a83d1c5cfd6f638c","subject_tree_hash":"d5adc3e735bc61e4e78ec867e1e36cc2cbe82cf08cf7ced79f659f701fa11b1d","subject_plugin_path":"skills/zhuyansen/backlink-guard","audit_payload_hash":"bb2479489bccd6b9b7217b970487d1fc","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"0b4c943e6552f80b68898606ff940013b53776a9","contentHash":"91b79ef58814113881e393e86a0370149844cea86eb99934a83d1c5cfd6f638c","treeHash":"d5adc3e735bc61e4e78ec867e1e36cc2cbe82cf08cf7ced79f659f701fa11b1d","pluginPath":"skills/zhuyansen/backlink-guard","auditPayloadHash":"bb2479489bccd6b9b7217b970487d1fc"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/zhuyansen-backlink-guard/audits/3/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}