{"data":{"skill":{"slug":"atdy-product-decision-agent","name":"product-decision-agent","icon":"📦","repo":"https://github.com/atdy/maoxuan-product-agent/tree/main/product-decision-agent/","status":"approved","author":"atdy","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"e181de60-5b7d-4842-a1b8-ab03bb86a28f","skill_id":"a9a6f49e-e610-4e6b-a9a7-7bfc6fe633e1","version":1,"content_hash":"253ed3716a3b982e357a45a721d76c28","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 17 static findings are false positives. The alerts come from documentation examples, Unicode matching, isolated tests, Markdown formatting, and entropy heuristics on plain UTF-8 Chinese text. No unsafe network request, command execution primitive, encrypted payload, prompt injection attempt, or data-exfiltration intent was found.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"scripts/quality_gate.py","line_end":138,"line_start":138},{"file":"scripts/test_quality_gate.py","line_end":54,"line_start":54}]},{"factor":"filesystem","evidence":[{"file":"scripts/test_quality_gate.py","line_end":7,"line_start":7},{"file":"scripts/test_quality_gate.py","line_end":61,"line_start":61}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":61,"line_start":61}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":8,"total_lines":2013,"audit_model":"codex","audited_at":"2026-07-10T03:20:38.406+00:00","created_at":"2026-07-10T03:54:13.646931+00:00","static_findings":[{"id":"network:scripts/quality_gate.py:138:hardcoded-url","file":"scripts/quality_gate.py","pattern":"Hardcoded URL","snippet":"# such as https://example.com?a=1 while still catching two questions","category":"network","line_end":138,"severity":"low","line_start":138},{"id":"obfuscation:scripts/quality_gate.py:141:unicode-escape-sequence","file":"scripts/quality_gate.py","pattern":"Unicode escape sequence","snippet":"re.findall(r\"?|\\?(?=[\\s\\u4e00-\\u9fff]|$)\", stripped)","category":"obfuscation","line_end":141,"severity":"low","line_start":141},{"id":"obfuscation:scripts/quality_gate.py:147:unicode-escape-sequence","file":"scripts/quality_gate.py","pattern":"Unicode escape sequence","snippet":"zh = len(re.findall(r\"[\\u4e00-\\u9fff]\", text))","category":"obfuscation","line_end":147,"severity":"low","line_start":147},{"id":"network:scripts/test_quality_gate.py:54:hardcoded-url","file":"scripts/test_quality_gate.py","pattern":"Hardcoded URL","snippet":"1. 请确认看板 https://example.com/report?cohort=new 是否采用同一口径。","category":"network","line_end":54,"severity":"low","line_start":54},{"id":"filesystem:scripts/test_quality_gate.py:7:temp-file-creation","file":"scripts/test_quality_gate.py","pattern":"Temp file creation","snippet":"import tempfile","category":"filesystem","line_end":7,"severity":"low","line_start":7},{"id":"filesystem:scripts/test_quality_gate.py:61:temp-file-creation","file":"scripts/test_quality_gate.py","pattern":"Temp file creation","snippet":"with tempfile.TemporaryDirectory() as temp_dir:","category":"filesystem","line_end":61,"severity":"low","line_start":61},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 复杂、模糊、多约束或需要取舍的问题:读 `references/reasoning-engine.md`。","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 明确属于某个产品/运营/数据/协作场景:读 `references/product-playbooks.md` 对应小节。","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 需要校准中文口吻和输出密度:读 `references/response-examples.md`。","category":"external_commands","line_end":59,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 维护或审查“后台推理是否来自完整方法转译”时:读 `references/methodology-basis.md`。默认回答用户时不要引用它。","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 维护样例输出质量时:运行 `scripts/quality_gate.py` 检查样例是否中文、可执行、无来源暴露。","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"obfuscation:agents/openai.yaml:4:heuristic-very-high-entropy-string-5-54-bits-lik","file":"agents/openai.yaml","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":"使用 $product-decision-agent 帮我诊断这个产品问题，判断真正卡点，并给出下一步最值得执行的方案。","category":"obfuscation","line_end":4,"severity":"high","line_start":4},{"id":"obfuscation:references/methodology-basis.md:1:heuristic-high-file-entropy-7-93-bits-possible-b","file":"references/methodology-basis.md","pattern":"[HEURISTIC] High file entropy (7.93 bits) - possible binary/encrypted content","snippet":"File: references/methodology-basis.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/product-playbooks.md:1:heuristic-high-file-entropy-7-82-bits-possible-b","file":"references/product-playbooks.md","pattern":"[HEURISTIC] High file entropy (7.82 bits) - possible binary/encrypted content","snippet":"File: references/product-playbooks.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/reasoning-engine.md:1:heuristic-high-file-entropy-7-79-bits-possible-b","file":"references/reasoning-engine.md","pattern":"[HEURISTIC] High file entropy (7.79 bits) - possible binary/encrypted content","snippet":"File: references/reasoning-engine.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/response-examples.md:1:heuristic-high-file-entropy-7-90-bits-possible-b","file":"references/response-examples.md","pattern":"[HEURISTIC] High file entropy (7.90 bits) - possible binary/encrypted content","snippet":"File: references/response-examples.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-91-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (7.91 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"network:scripts/quality_gate.py:138:hardcoded-url","reason":"The example.com URL appears only in a comment explaining question-mark parsing. The script contains no network client or request at this location.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/quality_gate.py:141:unicode-escape-sequence","reason":"The Unicode escapes define the Chinese character range in a regular expression. They are readable validation logic, not encoded or concealed instructions.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/quality_gate.py:147:unicode-escape-sequence","reason":"The Unicode escapes count Chinese characters for a language-ratio check. This is normal regular-expression syntax and does not hide executable content.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/test_quality_gate.py:54:hardcoded-url","reason":"The example.com URL is inert text inside a unit-test fixture. The test verifies that a URL query string is not counted as a user question.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/test_quality_gate.py:7:temp-file-creation","reason":"This line only imports Python's tempfile module for isolated tests. It does not create persistent files or access user data.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/test_quality_gate.py:61:temp-file-creation","reason":"TemporaryDirectory creates an automatically removed test workspace. The test writes a fixed sample file and does not touch paths outside that directory.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting around a local reference path. The line instructs the agent to read documentation and contains no shell execution syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The backticks delimit a local Markdown file path. This is a documentation-loading instruction, not Ruby or shell command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The reported text is a Markdown-formatted reference filename. No command interpreter, dynamic input, or executable expression is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The line uses backticks only to format a local methodology document name. It requests reading that file and does not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting around a bundled quality-check script, not shell backtick syntax. The referenced Python script only reads supplied local files and prints validation results.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:agents/openai.yaml:4:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The line is a plain UTF-8 Chinese default prompt with a readable skill variable. It contains no encoded, encrypted, or executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/methodology-basis.md:1:heuristic-high-file-entropy-7-93-bits-possible-b","reason":"The file is readable UTF-8 Markdown containing Chinese prose, headings, lists, and tables. The entropy heuristic is elevated by dense multilingual text, not binary or encrypted content.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:references/product-playbooks.md:1:heuristic-high-file-entropy-7-82-bits-possible-b","reason":"The file is readable UTF-8 Markdown organized as product-management playbooks. No encoded payload, binary data, or concealment mechanism was found.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:references/reasoning-engine.md:1:heuristic-high-file-entropy-7-79-bits-possible-b","reason":"The file contains structured Chinese product-decision guidance in plain Markdown. Its high entropy reflects varied natural-language content rather than obfuscation.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:references/response-examples.md:1:heuristic-high-file-entropy-7-90-bits-possible-b","reason":"The file is plain UTF-8 Markdown with readable Chinese input and output examples. There is no binary, encrypted, or encoded payload.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-91-bits-possible-b","reason":"SKILL.md is readable UTF-8 Markdown with YAML front matter and Chinese instructions. The heuristic does not correspond to actual obfuscation or hidden code.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}