{"data":{"skill":{"slug":"zl2023github-frontend-developer","name":"frontend-developer","icon":"📦","repo":"https://github.com/zl2023github/software-engineer-skills/tree/main/software-engineering/frontend-developer","status":"approved","author":"zl2023github","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"c258c9ba-9d15-4f32-9a10-c207ff3cff21","skill_id":"8c6e7ab7-d9ec-4191-b67b-12e1b98b83be","version":4,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:7a7cb8f24b8ffab8cc2f62e24f1208e9596515d920cb4705599ae0be99b5a071:a65d2b2d918b932171e9432599144b5ab1eea951d750e0acbeb3543fc286051d:736b696c6c732f7a6c323032336769746875622f66726f6e74656e642d646576656c6f706572:1055ae4289b75616ed8b90e7ce102f2f","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most static alerts mistake Markdown fences, inline identifiers, and TypeScript template literals for shell execution. The network, path, and environment examples are normal frontend patterns. One semantic issue remains: the authentication examples persist bearer tokens in browser storage, where injected scripts could read them.","remediation":[{"issue":"The authentication templates read and persist bearer tokens in browser storage.","severity":"medium","suggestion":"Prefer Secure, HttpOnly, SameSite cookies or short-lived in-memory tokens, and document the required CSRF and XSS protections."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":142,"line_start":98},{"file":"SKILL.md","line_end":189,"line_start":142},{"file":"SKILL.md","line_end":224,"line_start":189},{"file":"SKILL.md","line_end":257,"line_start":224},{"file":"SKILL.md","line_end":285,"line_start":257},{"file":"SKILL.md","line_end":315,"line_start":285},{"file":"SKILL.md","line_end":340,"line_start":315},{"file":"SKILL.md","line_end":344,"line_start":340},{"file":"SKILL.md","line_end":358,"line_start":344},{"file":"SKILL.md","line_end":375,"line_start":358},{"file":"SKILL.md","line_end":379,"line_start":375},{"file":"SKILL.md","line_end":411,"line_start":379},{"file":"SKILL.md","line_end":415,"line_start":411},{"file":"SKILL.md","line_end":431,"line_start":415},{"file":"SKILL.md","line_end":445,"line_start":431},{"file":"SKILL.md","line_end":449,"line_start":445},{"file":"SKILL.md","line_end":480,"line_start":449},{"file":"SKILL.md","line_end":485,"line_start":480},{"file":"SKILL.md","line_end":497,"line_start":485},{"file":"SKILL.md","line_end":500,"line_start":497},{"file":"SKILL.md","line_end":525,"line_start":500},{"file":"SKILL.md","line_end":551,"line_start":525},{"file":"SKILL.md","line_end":552,"line_start":551},{"file":"SKILL.md","line_end":553,"line_start":552},{"file":"SKILL.md","line_end":554,"line_start":553},{"file":"SKILL.md","line_end":555,"line_start":554},{"file":"SKILL.md","line_end":556,"line_start":555},{"file":"SKILL.md","line_end":557,"line_start":556},{"file":"SKILL.md","line_end":557,"line_start":557}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":176,"line_start":176},{"file":"SKILL.md","line_end":236,"line_start":236},{"file":"SKILL.md","line_end":346,"line_start":346},{"file":"SKILL.md","line_end":348,"line_start":348},{"file":"SKILL.md","line_end":510,"line_start":510}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":453,"line_start":453},{"file":"SKILL.md","line_end":557,"line_start":557},{"file":"SKILL.md","line_end":557,"line_start":557}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Insecure Browser Token Persistence","locations":[{"file":"SKILL.md","line_end":359,"line_start":354},{"file":"SKILL.md","line_end":408,"line_start":392}],"confidence":0.96,"description":"The examples read a bearer token from localStorage and persist the authentication token through Zustand. A successful XSS attack could extract the token.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The code directly reads localStorage for an Authorization header and configures Zustand persistence for the token. Browser scripts can access this storage."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":558,"audit_model":"codex","audited_at":"2026-07-23T23:37:27.608+00:00","created_at":"2026-07-26T17:16:42.034588+00:00","static_findings":[{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":142,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":189,"severity":"medium","line_start":142},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":224,"severity":"medium","line_start":189},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":257,"severity":"medium","line_start":224},{"id":"external_commands:SKILL.md:257:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":285,"severity":"medium","line_start":257},{"id":"external_commands:SKILL.md:285:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":315,"severity":"medium","line_start":285},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":340,"severity":"medium","line_start":315},{"id":"external_commands:SKILL.md:340:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":344,"severity":"medium","line_start":340},{"id":"external_commands:SKILL.md:344:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":358,"severity":"medium","line_start":344},{"id":"external_commands:SKILL.md:358:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"config.headers.Authorization = `Bearer ${token}`;","category":"external_commands","line_end":375,"severity":"medium","line_start":358},{"id":"external_commands:SKILL.md:375:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":379,"severity":"medium","line_start":375},{"id":"external_commands:SKILL.md:379:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":411,"severity":"medium","line_start":379},{"id":"external_commands:SKILL.md:411:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":415,"severity":"medium","line_start":411},{"id":"external_commands:SKILL.md:415:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":431,"severity":"medium","line_start":415},{"id":"external_commands:SKILL.md:431:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"queryFn: () => apiClient.get(`/users/${id}`),","category":"external_commands","line_end":445,"severity":"medium","line_start":431},{"id":"external_commands:SKILL.md:445:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":449,"severity":"medium","line_start":445},{"id":"external_commands:SKILL.md:449:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":480,"severity":"medium","line_start":449},{"id":"external_commands:SKILL.md:480:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":485,"severity":"medium","line_start":480},{"id":"external_commands:SKILL.md:485:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":497,"severity":"medium","line_start":485},{"id":"external_commands:SKILL.md:497:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":500,"severity":"medium","line_start":497},{"id":"external_commands:SKILL.md:500:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":525,"severity":"medium","line_start":500},{"id":"external_commands:SKILL.md:525:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":551,"severity":"medium","line_start":525},{"id":"external_commands:SKILL.md:551:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `software-architect` — 软件架构师Agent(出方案、画架构图、写ADR、技术选型)","category":"external_commands","line_end":552,"severity":"medium","line_start":551},{"id":"external_commands:SKILL.md:552:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `backend-developer` — 后端开发工程师Agent(API开发、数据库、部署运维)","category":"external_commands","line_end":553,"severity":"medium","line_start":552},{"id":"external_commands:SKILL.md:553:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `arch-c4-diagram` — C4架构图生成","category":"external_commands","line_end":554,"severity":"medium","line_start":553},{"id":"external_commands:SKILL.md:554:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `arch-adr` — 架构决策记录","category":"external_commands","line_end":555,"severity":"medium","line_start":554},{"id":"external_commands:SKILL.md:555:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `arch-tech-evaluation` — 技术选型评估","category":"external_commands","line_end":556,"severity":"medium","line_start":555},{"id":"external_commands:SKILL.md:556:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `mobile-engineer` — 移动端工程师Agent(iOS/Android/Flutter/React Native开发)","category":"external_commands","line_end":557,"severity":"medium","line_start":556},{"id":"external_commands:SKILL.md:557:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `chinese-pdf-generation` — 将技能内容/报告输出为PDF文档(参考本文档:`~/.hermes/skills/software-engineering/frontend-","category":"external_commands","line_end":557,"severity":"medium","line_start":557},{"id":"network:SKILL.md:176:http-client-library","file":"SKILL.md","pattern":"HTTP client library","snippet":"│    - HTTP客户端(axios/fetch)       │","category":"network","line_end":176,"severity":"low","line_start":176},{"id":"network:SKILL.md:236:http-client-library","file":"SKILL.md","pattern":"HTTP client library","snippet":"│    - 创建axios/fetch实例             │","category":"network","line_end":236,"severity":"low","line_start":236},{"id":"network:SKILL.md:346:http-client-library","file":"SKILL.md","pattern":"HTTP client library","snippet":"import axios from 'axios';","category":"network","line_end":346,"severity":"low","line_start":346},{"id":"network:SKILL.md:348:http-client-library","file":"SKILL.md","pattern":"HTTP client library","snippet":"const apiClient = axios.create({","category":"network","line_end":348,"severity":"low","line_start":348},{"id":"network:SKILL.md:510:http-client-library","file":"SKILL.md","pattern":"HTTP client library","snippet":"npm install axios","category":"network","line_end":510,"severity":"low","line_start":510},{"id":"filesystem:SKILL.md:453:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"import { Button } from '../index';","category":"filesystem","line_end":453,"severity":"high","line_start":453},{"id":"filesystem:SKILL.md:557:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"- `chinese-pdf-generation` — 将技能内容/报告输出为PDF文档(参考本文档:`~/.hermes/skills/software-engineering/frontend-","category":"filesystem","line_end":557,"severity":"high","line_start":557},{"id":"filesystem:SKILL.md:557:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"- `chinese-pdf-generation` — 将技能内容/报告输出为PDF文档(参考本文档:`~/.hermes/skills/software-engineering/frontend-","category":"filesystem","line_end":557,"severity":"medium","line_start":557},{"id":"sensitive:SKILL.md:349:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"baseURL: import.meta.env.VITE_API_BASE_URL,","category":"sensitive","line_end":349,"severity":"high","line_start":349}],"finding_verdicts":[{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"Line 98 starts a Markdown workflow diagram. The backticks delimit documentation and do not execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","reason":"Line 142 is a Markdown fence before a project setup diagram. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","reason":"Line 189 opens a documentation block containing a UI component workflow. No command substitution or executable code is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","reason":"Line 224 opens a Markdown diagram for API integration steps. The fence has no shell execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:257:ruby-shell-backtick-execution","reason":"Line 257 starts a Markdown debugging workflow diagram. It does not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:285:ruby-shell-backtick-execution","reason":"Line 285 starts a Markdown performance workflow diagram. The backticks are formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","reason":"The detected text is a fenced TSX example. Markdown code fencing cannot execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:340:ruby-shell-backtick-execution","reason":"Line 340 closes the preceding TSX code block. It is documentation syntax, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:344:ruby-shell-backtick-execution","reason":"Line 344 opens a fenced TypeScript API client example. The Markdown delimiter does not execute code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:358:ruby-shell-backtick-execution","reason":"The backticks form a TypeScript template literal for a Bearer authorization header. They are not shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:375:ruby-shell-backtick-execution","reason":"Line 375 closes the TypeScript API client example. It has no runtime effect.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:379:ruby-shell-backtick-execution","reason":"Line 379 opens a fenced TypeScript state management example. It is Markdown formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:411:ruby-shell-backtick-execution","reason":"Line 411 closes a TypeScript example and does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:415:ruby-shell-backtick-execution","reason":"Line 415 opens a fenced TypeScript React Query example. The delimiter is non-executable documentation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:431:ruby-shell-backtick-execution","reason":"The backticks create a TypeScript URL template literal for a user endpoint. They do not run an external command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:445:ruby-shell-backtick-execution","reason":"Line 445 closes the React Query example. It is a Markdown fence with no execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:449:ruby-shell-backtick-execution","reason":"Line 449 opens a fenced component test example. Markdown formatting does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:480:ruby-shell-backtick-execution","reason":"Line 480 closes the component test example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:485:ruby-shell-backtick-execution","reason":"The match is the Markdown fence labeling a Bash quick-reference block. The listed scaffold commands are explicit developer commands without interpolated user input.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:497:ruby-shell-backtick-execution","reason":"Line 497 closes the Bash quick-reference block. The fence itself cannot execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:500:ruby-shell-backtick-execution","reason":"The match is a Markdown Bash fence before standard dependency installation examples. No command substitution or untrusted argument interpolation is shown.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:525:ruby-shell-backtick-execution","reason":"Line 525 closes the dependency command example. It is a non-executable Markdown delimiter.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:551:ruby-shell-backtick-execution","reason":"The backticks format the related skill name software-architect as inline code. They do not represent command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:552:ruby-shell-backtick-execution","reason":"The backticks format the related skill name backend-developer. This is an inline documentation label.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:553:ruby-shell-backtick-execution","reason":"The backticks format the related skill name arch-c4-diagram. No shell syntax is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:554:ruby-shell-backtick-execution","reason":"The backticks format the related skill name arch-adr as inline code. They are not executable.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:555:ruby-shell-backtick-execution","reason":"The backticks format the related skill name arch-tech-evaluation. This is documentation only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:556:ruby-shell-backtick-execution","reason":"The backticks format the related skill name mobile-engineer. No command is constructed or invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:557:ruby-shell-backtick-execution","reason":"The backticks format a related skill name and documentation path. Inline Markdown has no shell execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:176:http-client-library","reason":"Line 176 lists Axios and Fetch as optional HTTP clients during project setup. It defines no request, destination, or data transfer.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:236:http-client-library","reason":"Line 236 describes creating an API service layer with Axios or Fetch. This is expected frontend functionality, not unauthorized network access.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:346:http-client-library","reason":"The code imports Axios for a generic API client example. Importing a client library alone performs no network request.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:348:http-client-library","reason":"The example creates a generic Axios client whose base URL comes from project configuration. No hardcoded external destination or exfiltration behavior appears.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:510:http-client-library","reason":"Line 510 documents a standard Axios dependency installation command. It does not contact an unexplained service or send user data.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:453:path-traversal-sequence","reason":"The parent-directory sequence is a static TypeScript import from the component index beside a test directory. It does not accept input or access an arbitrary path.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:557:hidden-file-in-home-directory","reason":"Line 557 presents a local documentation path for a related PDF skill. It does not instruct this skill to read, modify, or disclose the hidden file.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:557:hidden-file-access","reason":"The hidden home-directory path is a parenthetical documentation reference. No filesystem operation or sensitive content access is requested.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:SKILL.md:349:environment-file-access","reason":"The example reads a Vite-exposed API base URL through import.meta.env. It does not open an environment file or access a credential.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Insecure Browser Token Persistence","severity":"medium","locations":[{"file":"SKILL.md","line_end":359,"line_start":354},{"file":"SKILL.md","line_end":408,"line_start":392}],"confidence":0.96,"description":"The examples read a bearer token from localStorage and persist the authentication token through Zustand. A successful XSS attack could extract the token.","confidence_reasoning":"The code directly reads localStorage for an Authorization header and configures Zustand persistence for the token. Browser scripts can access this storage."}],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"7a7cb8f24b8ffab8cc2f62e24f1208e9596515d920cb4705599ae0be99b5a071","subject_tree_hash":"a65d2b2d918b932171e9432599144b5ab1eea951d750e0acbeb3543fc286051d","subject_plugin_path":"skills/zl2023github/frontend-developer","audit_payload_hash":"1055ae4289b75616ed8b90e7ce102f2f","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"7a7cb8f24b8ffab8cc2f62e24f1208e9596515d920cb4705599ae0be99b5a071","treeHash":"a65d2b2d918b932171e9432599144b5ab1eea951d750e0acbeb3543fc286051d","pluginPath":"skills/zl2023github/frontend-developer","auditPayloadHash":"1055ae4289b75616ed8b90e7ce102f2f"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/zl2023github-frontend-developer/audits/4/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}