{"data":{"skill":{"slug":"devinchen2014-xhs-creator-collaboration-evaluation","name":"xhs-creator-collaboration-evaluation","icon":"📦","repo":"https://github.com/devinchen2014/socialdatax-skills/tree/c14b6adea4ba2b551557115cdfffde4c17375cbf/modelscope-skills/xhs-creator-collaboration-evaluation","status":"approved","author":"devinchen2014","authorVersion":null,"skillstoreRevision":2,"license":null},"licenseCorrection":null,"audit":{"id":"d12ade5f-b9b5-410b-aba9-9da63df81246","skill_id":"5ef2285b-dd36-4622-ab3d-43d5437f0658","version":3,"content_hash":"v3:2d821629d9cf6def5fbc40718bb2420c989b2ca6:94bb5f83071611551c28299e47c2f070004775bae0e43f0975b1a784e3dec237:d6504e111c9da612b632bdfd5f0e4d2209de1bf57acc29e7fea1cf9324cfffdb:736b696c6c732f646576696e6368656e323031342f7868732d63726561746f722d636f6c6c61626f726174696f6e2d6576616c756174696f6e:622b06656ac651c94d2e3f0acb29d971","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Two command examples automatically execute an unpinned npm package, creating a supply-chain risk in an environment configured with an API key. The remaining 38 findings concern Markdown formatting, ordinary Chinese text, creator identifiers, service links, or documented authentication. No evidence found of prompt injection, credential exfiltration, or destructive intent in the supplied files; external package behavior was not reviewed.","remediation":[{"issue":"Both direct CLI examples execute socialdatax-skills@latest with automatic installation approval.","severity":"medium","suggestion":"Pin a reviewed package version and verify its provenance before execution. Explain installation changes and obtain authorization before running downloaded code."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":43,"line_start":31},{"file":"SKILL.md","line_end":47,"line_start":43},{"file":"SKILL.md","line_end":64,"line_start":47},{"file":"SKILL.md","line_end":69,"line_start":64},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":72,"line_start":72},{"file":"SKILL.md","line_end":83,"line_start":73},{"file":"SKILL.md","line_end":89,"line_start":83},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":104,"line_start":103},{"file":"SKILL.md","line_end":105,"line_start":104},{"file":"SKILL.md","line_end":106,"line_start":105},{"file":"SKILL.md","line_end":107,"line_start":106},{"file":"SKILL.md","line_end":108,"line_start":107},{"file":"SKILL.md","line_end":109,"line_start":108},{"file":"SKILL.md","line_end":122,"line_start":109},{"file":"SKILL.md","line_end":122,"line_start":122},{"file":"SKILL.md","line_end":124,"line_start":123},{"file":"SKILL.md","line_end":130,"line_start":124},{"file":"SKILL.md","line_end":130,"line_start":130}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":123,"line_start":123}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":113,"line_start":113},{"file":"SKILL.md","line_end":122,"line_start":122},{"file":"SKILL.md","line_end":124,"line_start":124},{"file":"SKILL.md","line_end":130,"line_start":130}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":43,"line_start":31}],"confidence":0.97,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This fenced example runs npx -y socialdatax-skills@latest, automatically downloading and executing a mutable third-party package. A compromised release could access local files and the configured API key."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":64,"line_start":47}],"confidence":0.97,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The additional CLI examples also run npx -y socialdatax-skills@latest without a fixed reviewed version. Automatic execution exposes local resources and credentials to future package changes."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":141,"audit_model":"codex","audited_at":"2026-11-02T12:09:18.66+00:00","created_at":"2026-11-02T13:21:57.92551+00:00","static_findings":[{"id":"external_commands:SKILL.md:9:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"<!-- AUTO-GENERATED from socialdatax-skill-source. Do not edit directly; run `node scripts/generate_","category":"external_commands","line_end":9,"severity":"medium","line_start":9},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"获取或管理 API Key:访问 <https://socialdatax.com/ai?from=modelscope>,按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCI","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":43,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":47,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":64,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":69,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 说明:候选达人的完整 `--user-id`;只有主页时先用 `xhs user-info --profile-url` 取得返回的用户 ID,不猜测 ID。","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 说明:部分表现、概览和趋势命令支持 `--note-scope daily|cooperation`;需要合作笔记对照时显式选择 `cooperation`,比较时保持相同范围。","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 可选:`--source-client socialdatax-skills --source-platform modelscope --source-skill xhs-creator-col","category":"external_commands","line_end":83,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"只有提供完整用户 ID 才调用 `pgy-creator-*`;这些命令不接受主页 URL。只有主页时使用已列出的普通资料入口取得 ID。","category":"external_commands","line_end":89,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"遇到 `pgy_commercial_data_unavailable` 或公开错误码 `1009`,保留已取得结果,记录该候选商业数据不可用,不用其他输入重试或将普通资料当作商业结果。","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `xhs_pgy_get_creator_profile`","category":"external_commands","line_end":104,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `xhs_pgy_get_creator_fans_profile`","category":"external_commands","line_end":105,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `xhs_pgy_get_creator_notes_performance`","category":"external_commands","line_end":106,"severity":"medium","line_start":105},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `xhs_get_user_info_by_profile_url`","category":"external_commands","line_end":107,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `xhs_pgy_get_creator_fans_summary`","category":"external_commands","line_end":108,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `xhs_pgy_get_creator_commercial_overview`","category":"external_commands","line_end":109,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `xhs_pgy_get_creator_metrics_trend`","category":"external_commands","line_end":122,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 非余额不足的网络或 API 异常:保留错误信息,检查 `SOCIALDATAX_API_KEY`、参数和链接格式后原样重试一次。 `pgy_commercial_data_unavailable`","category":"external_commands","line_end":122,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 如果返回 `insufficient_balance` 或“积分不足”:不要重复重试;展示错误中的官方充值链接(https://socialdatax.com/dashboard/billing,","category":"external_commands","line_end":124,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 如果用户已经充值但仍提示余额不足:确认当前环境变量 `SOCIALDATAX_API_KEY` 是否来自刚充值的同一个账号;必要时重新复制官网后台的 API Key。","category":"external_commands","line_end":130,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 调用失败:先确认 `SOCIALDATAX_API_KEY` 已配置;如果是 `insufficient_balance` 或“积分不足”,按上述官方充值链接说明完成充值后,按上述恢复规则继续,不","category":"external_commands","line_end":130,"severity":"medium","line_start":130},{"id":"network:SKILL.md:7:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"metadata: {\"openclaw\":{\"requires\":{\"env\":[\"SOCIALDATAX_API_KEY\"],\"bins\":[\"node\",\"npm\"]},\"primaryEnv\"","category":"network","line_end":7,"severity":"low","line_start":7},{"id":"network:SKILL.md:25:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"获取或管理 API Key:访问 <https://socialdatax.com/ai?from=modelscope>,按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCI","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:SKILL.md:123:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- 如果返回 `insufficient_balance` 或“积分不足”:不要重复重试;展示错误中的官方充值链接(https://socialdatax.com/dashboard/billing,","category":"network","line_end":123,"severity":"low","line_start":123},{"id":"env_access:SKILL.md:7:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"metadata: {\"openclaw\":{\"requires\":{\"env\":[\"SOCIALDATAX_API_KEY\"],\"bins\":[\"node\",\"npm\"]},\"primaryEnv\"","category":"env_access","line_end":7,"severity":"high","line_start":7},{"id":"env_access:SKILL.md:25:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"获取或管理 API Key:访问 <https://socialdatax.com/ai?from=modelscope>,按官网的 API Key 申请/管理入口操作。环境变量名固定使用 `SOCI","category":"env_access","line_end":25,"severity":"high","line_start":25},{"id":"env_access:SKILL.md:113:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"这是只读 skill,用于达人商业数据评估。仅进行已确认范围内的达人资料和商业数据查询,使用用户配置的 SOCIALDATAX_API_KEY;不联系达人、不发私信、不下单或签约,生成文件不含 API","category":"env_access","line_end":113,"severity":"high","line_start":113},{"id":"env_access:SKILL.md:122:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- 非余额不足的网络或 API 异常:保留错误信息,检查 `SOCIALDATAX_API_KEY`、参数和链接格式后原样重试一次。 `pgy_commercial_data_unavailable`","category":"env_access","line_end":122,"severity":"high","line_start":122},{"id":"env_access:SKILL.md:124:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- 如果用户已经充值但仍提示余额不足:确认当前环境变量 `SOCIALDATAX_API_KEY` 是否来自刚充值的同一个账号;必要时重新复制官网后台的 API Key。","category":"env_access","line_end":124,"severity":"high","line_start":124},{"id":"env_access:SKILL.md:130:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- 调用失败:先确认 `SOCIALDATAX_API_KEY` 已配置;如果是 `insufficient_balance` 或“积分不足”,按上述官方充值链接说明完成充值后,按上述恢复规则继续,不","category":"env_access","line_end":130,"severity":"high","line_start":130},{"id":"blocker:SKILL.md:33:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--user-id \"<user_id>\" --pretty --source-client socialdatax-skills \\","category":"blocker","line_end":33,"severity":"low","line_start":33},{"id":"blocker:SKILL.md:37:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--user-id \"<user_id>\" --pretty --source-client socialdatax-skills \\","category":"blocker","line_end":37,"severity":"low","line_start":37},{"id":"blocker:SKILL.md:41:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--user-id \"<user_id>\" --pretty --source-client socialdatax-skills \\","category":"blocker","line_end":41,"severity":"low","line_start":41},{"id":"blocker:SKILL.md:54:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--user-id \"<user_id>\" --pretty --source-client socialdatax-skills \\","category":"blocker","line_end":54,"severity":"low","line_start":54},{"id":"blocker:SKILL.md:58:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--user-id \"<user_id>\" --pretty --source-client socialdatax-skills \\","category":"blocker","line_end":58,"severity":"low","line_start":58},{"id":"blocker:SKILL.md:62:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--user-id \"<user_id>\" --pretty --source-client socialdatax-skills \\","category":"blocker","line_end":62,"severity":"low","line_start":62},{"id":"obfuscation:agents/openai.yaml:4:heuristic-very-high-entropy-string-5-70-bits-lik","file":"agents/openai.yaml","pattern":"[HEURISTIC] Very high entropy string (5.70 bits) - likely encoded/encrypted payload","snippet":"使用 $xhs-creator-collaboration-evaluation，结合品牌、目标受众、预算和候选达人名单，按需查询蒲公英商业数据并交付合作适配对...","category":"obfuscation","line_end":4,"severity":"high","line_start":4},{"id":"obfuscation:SKILL.md:3:heuristic-very-high-entropy-string-6-27-bits-lik","file":"SKILL.md","pattern":"[HEURISTIC] Very high entropy string (6.27 bits) - likely encoded/encrypted payload","snippet":"用户提供品牌或产品、目标受众、候选小红书达人和预算时，使用蒲公英报价、粉丝画像和内容表现比较合作适配度，交付候选对照表与待确认事项。SocialDataX 支持...","category":"obfuscation","line_end":3,"severity":"high","line_start":3},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-97-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.97 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"external_commands:SKILL.md:9:ruby-shell-backtick-execution","reason":"The backticks format a generator command inside an HTML maintenance comment. They are not Ruby execution or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The backticks format the SOCIALDATAX_API_KEY environment variable name in setup documentation. This line contains no executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"This fenced example runs npx -y socialdatax-skills@latest, automatically downloading and executing a mutable third-party package. A compromised release could access local files and the configured API key.","verdict":"confirmed","severity":"medium","confidence":0.97},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown fence delimiters around a section transition. The executable package risk belongs to the separate command-block finding.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The additional CLI examples also run npx -y socialdatax-skills@latest without a fixed reviewed version. Automatic execution exposes local resources and credentials to future package changes.","verdict":"confirmed","severity":"medium","confidence":0.97},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The match starts at a closing Markdown fence and continues into parameter documentation. These delimiters do not perform shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"Inline code identifies creator ID arguments and the profile lookup command. The guidance requires returned IDs rather than guessing and contains no backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The backticks delimit note-scope argument values in explanatory prose. No shell evaluates these Markdown spans.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The spans document fixed source attribution flags and creator command names. There is no command substitution or hidden execution in this prose.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"Inline code names the pgy-creator command family and an unavailable-data error. The surrounding text restricts valid inputs and retries, not shell behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The backticks format an API error identifier. The instruction stops unavailable commercial queries and does not execute its contents.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The matched text lists MCP tool names as inline Markdown code. These names are not Ruby expressions or shell substitutions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The fan-profile and notes-performance identifiers are documented MCP tool names. Backticks only provide text formatting.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"This list documents notes-performance and profile-resolution tools. It contains no executable shell or Ruby syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The match crosses inline Markdown spans containing MCP identifiers. It does not invoke a shell or evaluate their names.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The listed fan-summary and commercial-overview tools are ordinary documentation. Their Markdown delimiters are not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"This entry lists commercial-overview and metrics-trend MCP tool identifiers. No executable backtick expression is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The match spans the final tool identifier and later troubleshooting prose. These independent Markdown spans do not form executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"Backticks format the environment variable and an API error code in retry instructions. They do not evaluate commands or expose a key value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The inline spans identify an insufficient-balance error and the configured environment variable. The billing guidance contains no shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The backticks format authentication terminology across troubleshooting sections. The text does not construct or execute shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The FAQ formats the API key variable and balance error as inline code. No execution or command substitution occurs.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:7:hardcoded-url","reason":"The URL is the declared SocialDataX homepage in metadata, consistent with the requested data service. It contains no secrets or exfiltration parameters.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:25:hardcoded-url","reason":"The link directs users to SocialDataX API key management and explicitly rejects other domains. No credential is embedded or sent by this documentation.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:123:hardcoded-url","reason":"The hardcoded URL is the same provider's billing dashboard for insufficient balance. The instruction displays a link and does not initiate payment or transmit secrets.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:7:generic-api-secret-keys","reason":"Metadata declares SOCIALDATAX_API_KEY as the required authentication variable. It includes neither an actual secret nor instructions to collect unrelated credentials.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:25:generic-api-secret-keys","reason":"This setup paragraph specifies the service's environment variable name and official management page. No hardcoded credential or secret-disclosure request appears.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:113:generic-api-secret-keys","reason":"The boundary permits the user-configured key for confirmed read-only queries and explicitly excludes API keys from generated files. This is scoped authentication, not credential theft.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:122:generic-api-secret-keys","reason":"Troubleshooting checks the expected authentication configuration before one identical retry. It does not require printing, exporting, or sending the key elsewhere.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:124:generic-api-secret-keys","reason":"The text asks users to verify that their configured key belongs to the funded account. It does not request disclosure in chat or transfer to another service.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:130:generic-api-secret-keys","reason":"The FAQ repeats the expected environment variable configuration check. No secret value, broad environment inspection, or credential exfiltration is present.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:33:system-reconnaissance","reason":"The --user-id flag supplies a Xiaohongshu creator identifier to the profile endpoint. It is not an operating-system identity or reconnaissance command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:37:system-reconnaissance","reason":"The --user-id argument identifies the creator whose audience profile is requested. It does not inspect local accounts or host configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:41:system-reconnaissance","reason":"The --user-id flag selects a creator for content-performance retrieval. It has no connection to system user enumeration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:54:system-reconnaissance","reason":"This argument supplies the candidate creator ID to the fan-summary endpoint. It does not execute an identity-discovery utility.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:58:system-reconnaissance","reason":"The user-id parameter targets a creator's commercial overview. No local account, privilege, or operating-system information is requested.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:62:system-reconnaissance","reason":"This --user-id is a platform creator identifier for metrics trends. The match is not evidence of host reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:agents/openai.yaml:4:heuristic-very-high-entropy-string-5-70-bits-lik","reason":"The default prompt is readable Chinese describing candidate evaluation and the skill name. There is no encoded payload or decoding instruction.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:3:heuristic-very-high-entropy-string-6-27-bits-lik","reason":"The description is ordinary Chinese text about pricing, audience fit, and performance limits. Its multilingual character distribution does not indicate encryption.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-97-bits-possible-b","reason":"The complete file is readable Chinese Markdown with YAML metadata and visible CLI examples. No binary content, encrypted payload, or decoding mechanism was found.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"2d821629d9cf6def5fbc40718bb2420c989b2ca6","subject_content_hash":"94bb5f83071611551c28299e47c2f070004775bae0e43f0975b1a784e3dec237","subject_tree_hash":"d6504e111c9da612b632bdfd5f0e4d2209de1bf57acc29e7fea1cf9324cfffdb","subject_plugin_path":"skills/devinchen2014/xhs-creator-collaboration-evaluation","audit_payload_hash":"622b06656ac651c94d2e3f0acb29d971","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"2d821629d9cf6def5fbc40718bb2420c989b2ca6","contentHash":"94bb5f83071611551c28299e47c2f070004775bae0e43f0975b1a784e3dec237","treeHash":"d6504e111c9da612b632bdfd5f0e4d2209de1bf57acc29e7fea1cf9324cfffdb","pluginPath":"skills/devinchen2014/xhs-creator-collaboration-evaluation","auditPayloadHash":"622b06656ac651c94d2e3f0acb29d971"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/devinchen2014-xhs-creator-collaboration-evaluation/audits/3/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}