{"sample":true,"purpose":"Illustrative metadata-audit output shape; not a finding about the requester or their site.","input":{"url":"https://example.com"},"result":{"overallRisk":"medium","findingCounts":{"high":0,"medium":2,"low":1},"findings":[{"category":"http-header","riskLevel":"medium","label":"Server fingerprint exposed","recommendation":"Review whether revealing framework/server headers is necessary."},{"category":"security-header","riskLevel":"medium","label":"Security header absent","recommendation":"Review the relevant response-header policy."}]},"limitations":["Public-source results can be incomplete or stale.","A finding is a signal for review, not proof of compromise."],"nextStep":"For an authorized live audit, inspect POST /skills/metadata-audit payment terms first."}