{"data":{"skill":{"slug":"devinchen2014-socialdatax-media-save-organizer","name":"socialdatax-media-save-organizer","icon":"📦","repo":"https://github.com/devinchen2014/socialdatax-skills/tree/c14b6adea4ba2b551557115cdfffde4c17375cbf/modelscope-skills/socialdatax-media-save-organizer","status":"approved","author":"devinchen2014","authorVersion":null,"skillstoreRevision":3},"audit":{"id":"9b55ac8e-cb48-4b63-b073-469354b9695d","skill_id":"de1a512b-47d2-42fa-a34b-54990fb344b9","version":3,"content_hash":"v3:d453bfba4f8f4df13e0609a19b6e5f52c4d335e3:497379727c6fe8298c81b360f07bcc238cf4803e8382e2f99eb5cd147a8741f8:25dd5315c785ee73cb3d46fa19ff7b4dd53391e4ae338d84f4f04e9d7ee6e5fe:736b696c6c732f646576696e6368656e323031342f736f6369616c64617461782d6d656469612d736176652d6f7267616e697a6572:5a8e4844f00fc67e8fdfcabcb6858c36","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most detections are Markdown backticks, normal API authentication references, documentation links, or readable Chinese text rather than shell substitution, leaked secrets, or obfuscation. Two command locations execute an unpinned npm package through npx, exposing the host and inherited credentials to changing third-party code. No evidence of prompt injection or intentional exfiltration was found; external package implementation was not included for review.","remediation":[{"issue":"CLI examples execute socialdatax-skills@latest with automatic npm confirmation.","severity":"medium","suggestion":"Replace @latest with a reviewed exact version and lock dependencies. Obtain installation consent and run with minimal filesystem access and credentials."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":59,"line_start":31},{"file":"SKILL.md","line_end":67,"line_start":59},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":76,"line_start":68},{"file":"SKILL.md","line_end":78,"line_start":76},{"file":"SKILL.md","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":86,"line_start":86},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":101,"line_start":90},{"file":"SKILL.md","line_end":104,"line_start":101},{"file":"SKILL.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":111,"line_start":110},{"file":"SKILL.md","line_end":112,"line_start":111},{"file":"SKILL.md","line_end":113,"line_start":112},{"file":"SKILL.md","line_end":114,"line_start":113},{"file":"SKILL.md","line_end":115,"line_start":114},{"file":"SKILL.md","line_end":128,"line_start":115},{"file":"SKILL.md","line_end":129,"line_start":128},{"file":"SKILL.md","line_end":130,"line_start":129},{"file":"SKILL.md","line_end":131,"line_start":130},{"file":"SKILL.md","line_end":137,"line_start":131}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":130,"line_start":130}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":129,"line_start":129},{"file":"SKILL.md","line_end":131,"line_start":131}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":59,"line_start":31}],"confidence":0.97,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Although the delimiter is Markdown, the enclosed commands run npx -y socialdatax-skills@latest. Changing third-party code executes with host permissions and potentially inherited API credentials."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":78,"line_start":78}],"confidence":0.97,"description":"将以下本地保存子命令接在 `npx -y socialdatax-skills@latest` 后执行;纯本地 `download-media` 不接受 `--source-client`、`--so","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The prose explicitly directs execution through npx -y socialdatax-skills@latest. Automatic execution of an unpinned package permits compromised future releases to access the host."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":148,"audit_model":"codex","audited_at":"2026-10-29T04:55:45.306+00:00","created_at":"2026-10-29T05:06:04.985829+00:00","static_findings":[{"id":"external_commands:SKILL.md:9:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"<!-- AUTO-GENERATED from socialdatax-skill-source. Do not edit directly; run `node scripts/generate_","category":"external_commands","line_end":9,"severity":"medium","line_start":9},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"获取或管理 API Key:访问 <https://socialdatax.com/ai?from=modelscope>,按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCI","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":59,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":67,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 说明:本地保存使用 `--output-dir \"<directory>\"`;不要将内容页面 URL 当成 `download-media --url` 的媒体直链。","category":"external_commands","line_end":67,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 可选:`--source-client socialdatax-skills --source-platform modelscope --source-skill socialdatax-med","category":"external_commands","line_end":76,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"仅给定媒体直链时,本地 `download-media` 不需要 API Key;需要在线解析内容详情或 Bilibili 下载链接时,使用用户配置的 SOCIALDATAX_API_KEY。执行 C","category":"external_commands","line_end":78,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"将以下本地保存子命令接在 `npx -y socialdatax-skills@latest` 后执行;纯本地 `download-media` 不接受 `--source-client`、`--so","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"小红书:`xhs download-media --url \"<media_url>\" --output-dir \"<directory>\" --pretty`;从详情的 `image_items[]","category":"external_commands","line_end":80,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"抖音:`douyin download-media --url \"<media_url>\" --output-dir \"<directory>\" --pretty`;从 `images[].url`、","category":"external_commands","line_end":82,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"快手:`kuaishou download-media --url \"<media_url>\" --output-dir \"<directory>\" --pretty`;使用 `images[].ur","category":"external_commands","line_end":84,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"微博:`weibo download-media --url \"<media_url>\" --output-dir \"<directory>\" --pretty`;使用 `image_urls[]` ","category":"external_commands","line_end":86,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"X / Twitter:`x download-media --url \"<media_url>\" --output-dir \"<directory>\" --pretty`;使用 `media_ite","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Bilibili 使用本页 `bilibili download` 视频链接命令;不要把文章或动态链接当作视频下载。其 MCP 工具只提供下载链接,本地文件保存与合并由 CLI 执行。","category":"external_commands","line_end":101,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"结合命令结果和实际文件确认保存情况;若返回 `skipped_existing`,只有已有来源清单确认是同一素材时才记为已存在,否则另选空子目录保存。不要将跳过当作新下载成功或覆盖原文件;不编造文件名","category":"external_commands","line_end":104,"severity":"medium","line_start":101},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"对于 XHS `note_id`,要原样复制返回的完整 `note_id`;不要只传或只展示前缀。","category":"external_commands","line_end":104,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `xhs_get_note_detail_by_note_url`","category":"external_commands","line_end":111,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `douyin_get_video_detail_by_url`","category":"external_commands","line_end":112,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `kuaishou_get_video_detail_by_url`","category":"external_commands","line_end":113,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `weibo_get_post_detail_by_post_url`","category":"external_commands","line_end":114,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `x_get_post_detail_by_post_url`","category":"external_commands","line_end":115,"severity":"medium","line_start":114},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `bilibili_get_video_download_links`","category":"external_commands","line_end":128,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 本地 `download-media` 失败:不需要 API Key;保留错误信息,检查媒体直链、网络或代理、输出目录及写入权限。","category":"external_commands","line_end":129,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 在线详情或 Bilibili 下载链接调用失败:检查 `SOCIALDATAX_API_KEY`、参数和内容链接;非余额不足的网络或 API 异常可原样重试一次。","category":"external_commands","line_end":130,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 如果返回 `insufficient_balance` 或“积分不足”:不要重复重试;展示错误中的官方充值链接(https://socialdatax.com/dashboard/billing,","category":"external_commands","line_end":131,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 如果用户已经充值但仍提示余额不足:确认当前环境变量 `SOCIALDATAX_API_KEY` 是否来自刚充值的同一个账号;必要时重新复制官网后台的 API Key。","category":"external_commands","line_end":137,"severity":"medium","line_start":131},{"id":"network:SKILL.md:7:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"metadata: {\"openclaw\":{\"requires\":{\"env\":[],\"bins\":[]},\"primaryEnv\":\"SOCIALDATAX_API_KEY\",\"install\":","category":"network","line_end":7,"severity":"low","line_start":7},{"id":"network:SKILL.md:25:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"获取或管理 API Key:访问 <https://socialdatax.com/ai?from=modelscope>,按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCI","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:SKILL.md:130:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- 如果返回 `insufficient_balance` 或“积分不足”:不要重复重试;展示错误中的官方充值链接(https://socialdatax.com/dashboard/billing,","category":"network","line_end":130,"severity":"low","line_start":130},{"id":"env_access:SKILL.md:7:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"metadata: {\"openclaw\":{\"requires\":{\"env\":[],\"bins\":[]},\"primaryEnv\":\"SOCIALDATAX_API_KEY\",\"install\":","category":"env_access","line_end":7,"severity":"high","line_start":7},{"id":"env_access:SKILL.md:25:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"获取或管理 API Key:访问 <https://socialdatax.com/ai?from=modelscope>,按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCI","category":"env_access","line_end":25,"severity":"high","line_start":25},{"id":"env_access:SKILL.md:76:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"仅给定媒体直链时,本地 `download-media` 不需要 API Key;需要在线解析内容详情或 Bilibili 下载链接时,使用用户配置的 SOCIALDATAX_API_KEY。执行 C","category":"env_access","line_end":76,"severity":"high","line_start":76},{"id":"env_access:SKILL.md:129:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- 在线详情或 Bilibili 下载链接调用失败:检查 `SOCIALDATAX_API_KEY`、参数和内容链接;非余额不足的网络或 API 异常可原样重试一次。","category":"env_access","line_end":129,"severity":"high","line_start":129},{"id":"env_access:SKILL.md:131:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- 如果用户已经充值但仍提示余额不足:确认当前环境变量 `SOCIALDATAX_API_KEY` 是否来自刚充值的同一个账号;必要时重新复制官网后台的 API Key。","category":"env_access","line_end":131,"severity":"high","line_start":131},{"id":"obfuscation:SKILL.md:3:heuristic-very-high-entropy-string-6-10-bits-lik","file":"SKILL.md","pattern":"[HEURISTIC] Very high entropy string (6.10 bits) - likely encoded/encrypted payload","snippet":"用户提供社媒内容链接或媒体直链和输出目录时，保存支持平台的图片、视频或音频，并整理来源链接、本地文件路径及成功失败清单。支持小红书、抖音、快手、微博、X / T...","category":"obfuscation","line_end":3,"severity":"high","line_start":3},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-84-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.84 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"external_commands:SKILL.md:9:ruby-shell-backtick-execution","reason":"The backticks format a generator command inside an HTML maintenance comment. They are not shell substitution or an instruction to execute it during media saving.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"Backticks format the SOCIALDATAX_API_KEY variable name in setup documentation. No shell execution occurs in this passage.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Although the delimiter is Markdown, the enclosed commands run npx -y socialdatax-skills@latest. Changing third-party code executes with host permissions and potentially inherited API credentials.","verdict":"confirmed","confidence":0.97},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"This location closes a Markdown code fence and introduces parameter documentation. No Ruby or shell backtick execution occurs here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"Inline backticks distinguish output-directory options and media URL arguments. These are Markdown spans, not executable shell substitutions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The backticks show fixed source-attribution arguments, followed by workflow prerequisites. No executable backtick syntax or encoded command is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"This passage documents authentication and runtime prerequisites using Markdown spans. The separate npx invocation risk is retained under the command findings.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The prose explicitly directs execution through npx -y socialdatax-skills@latest. Automatic execution of an unpinned package permits compromised future releases to access the host.","verdict":"confirmed","confidence":0.97},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"Backticks delimit an XHS download subcommand and response-field names. No backtick execution exists; the shared unpinned runner risk is assessed separately.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"This is Markdown documentation for Douyin media fields and a download subcommand. It contains no shell substitution; the runner risk is retained separately.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"Backticks format the Kuaishou download subcommand and media-field names. They do not execute code; the unpinned runner is assessed separately.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The Weibo subcommand and response fields are inline Markdown examples. No Ruby or shell backtick execution appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"Markdown spans identify X media fields, download arguments, and a proxy option. No executable backtick expression is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The text names the Bilibili command and explains file verification and deduplication. Backticks are formatting, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"The skipped_existing status is formatted inline while requiring source verification before reporting success. No command substitution is instructed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"Backticks format the note_id field name. The instruction preserves identifier accuracy and executes nothing.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"This list item names an XHS MCP tool using Markdown. It is not shell syntax or a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"The Douyin MCP tool name is an inline code span. No shell execution expression exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"This entry documents a Kuaishou MCP tool name. Markdown delimiters are not executable backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"The Weibo MCP tool identifier is documentation only. No shell substitution or dynamic evaluation is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","reason":"Backticks format the X MCP tool identifier. The entry contains no executable shell expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The Bilibili MCP tool name is followed by safety and troubleshooting prose. These Markdown spans do not constitute shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"The passage names download-media and the API environment variable while explaining failures. Backticks only format identifiers.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"Inline formatting surrounds the API variable and an error status. The instructions describe troubleshooting, not backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The insufficient_balance status is inline Markdown in billing guidance. No executable backtick syntax is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"Backticks mark an environment variable name in account troubleshooting. They do not execute a shell command.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:7:hardcoded-url","reason":"The URL is a SocialDataX homepage metadata value. No request or sensitive-data transmission is specified by this field.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:25:hardcoded-url","reason":"The HTTPS link directs users to the documented service for API-key setup. No credentials are embedded or sent to an unrelated destination.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:130:hardcoded-url","reason":"The service billing URL is displayed after an insufficient-balance response. The text does not authorize payment or transmit secrets to that URL.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:7:generic-api-secret-keys","reason":"Metadata declares SOCIALDATAX_API_KEY as the primary authentication variable. It contains no key value, secret extraction, or disclosure instruction.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:25:generic-api-secret-keys","reason":"This is standard API-key setup guidance for the intended service. It names a variable without exposing a credential or requesting unrelated secrets.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:76:generic-api-secret-keys","reason":"The user-configured key authenticates online detail requests, while direct downloads explicitly need no key. No evidence of credential harvesting or disclosure appears here.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:129:generic-api-secret-keys","reason":"Troubleshooting checks the intended service credential after an API failure. It does not instruct agents to print the key or send it elsewhere.","verdict":"false_positive","confidence":0.97},{"id":"env_access:SKILL.md:131:generic-api-secret-keys","reason":"The guidance checks that the configured credential belongs to the funded account. No key value, unrelated secret access, or disclosure instruction is present.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:SKILL.md:3:heuristic-very-high-entropy-string-6-10-bits-lik","reason":"The flagged text is a readable Chinese description of supported platforms and media organization. No encoded payload or decoding instruction is present.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-84-bits-possible-b","reason":"The complete file is readable Chinese Markdown with YAML metadata and command examples. Its multilingual character distribution does not establish encryption or binary content.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"d453bfba4f8f4df13e0609a19b6e5f52c4d335e3","subject_content_hash":"497379727c6fe8298c81b360f07bcc238cf4803e8382e2f99eb5cd147a8741f8","subject_tree_hash":"25dd5315c785ee73cb3d46fa19ff7b4dd53391e4ae338d84f4f04e9d7ee6e5fe","subject_plugin_path":"skills/devinchen2014/socialdatax-media-save-organizer","audit_payload_hash":"5a8e4844f00fc67e8fdfcabcb6858c36","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"d453bfba4f8f4df13e0609a19b6e5f52c4d335e3","contentHash":"497379727c6fe8298c81b360f07bcc238cf4803e8382e2f99eb5cd147a8741f8","treeHash":"25dd5315c785ee73cb3d46fa19ff7b4dd53391e4ae338d84f4f04e9d7ee6e5fe","pluginPath":"skills/devinchen2014/socialdatax-media-save-organizer","auditPayloadHash":"5a8e4844f00fc67e8fdfcabcb6858c36"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/devinchen2014-socialdatax-media-save-organizer/audits/3/attestation","status":"superseded"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"superseded","verificationState":"not_verified"},"isLatest":false}}