{"data":{"skill":{"slug":"dhturing-data-insurance-expert","name":"data-insurance-expert","icon":"📦","repo":"https://github.com/dhturing/turing-data-experts/tree/9c58ffa97ec5b760befef6f910eb23107cdcdbf4/skills/data-insurance-expert","status":"approved","author":"图灵数盟","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"615cb5b1-6ca5-4445-b2a3-be57a67c1ca5","skill_id":"2966a868-96d9-4837-b848-14260e119092","version":1,"content_hash":"v3:50b73f83991cf073cbdf3f5afad2bbac71dd3bae:d1b2acf20fe450334cf5036afea70331dce885c951b9a102aec52937af920669:99627acb7025f6e86e46fb7ea7243e90192198f525d59dcc4a4515f3570c7dd2:736b696c6c732f6468747572696e672f646174612d696e737572616e63652d657870657274:4ae84d2c00bb7e48d0909c49cfa82266","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 12 static findings are false positives caused by Markdown syntax, installation documentation, ordinary website links, or entropy heuristics applied to Chinese text. The reviewed files contain no executable commands, network operations, obfuscated payloads, or prompt injection attempts.","remediation":[],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"profile.md","line_end":38,"line_start":38},{"file":"profile.md","line_end":38,"line_start":38}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":33,"line_start":33}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":6,"line_start":6},{"file":"SKILL.md","line_end":12,"line_start":12}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":4,"total_lines":364,"audit_model":"codex","audited_at":"2026-09-27T03:13:53.097+00:00","created_at":"2026-09-30T12:14:17.610362+00:00","static_findings":[{"id":"filesystem:profile.md:38:hidden-file-in-home-directory","file":"profile.md","pattern":"Hidden file in home directory","snippet":"~/.claude/skills/data-insurance-expert/       # Claude Code","category":"filesystem","line_end":38,"severity":"high","line_start":38},{"id":"filesystem:profile.md:38:hidden-file-access","file":"profile.md","pattern":"Hidden file access","snippet":"~/.claude/skills/data-insurance-expert/       # Claude Code","category":"filesystem","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> 完整知识底座见 `references/knowledge-base.md`。","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **资料来源**:`图灵数盟内部资料库`","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"读取 `references/knowledge-base.md`(该文件为源资料逐字拷贝,权威版本)。","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"network:SKILL.md:6:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://www.turingtech.net.cn\"","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"network:SKILL.md:12:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> **作者**:图灵数盟(图灵数盟(深圳)数字产业有限公司)|[官网](https://www.turingtech.net.cn)|联系邮箱:public@turingtech.net.cn","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"obfuscation:profile.md:1:heuristic-high-file-entropy-6-34-bits-possible-b","file":"profile.md","pattern":"[HEURISTIC] High file entropy (6.34 bits) - possible binary/encrypted content","snippet":"File: profile.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:README.md:1:heuristic-high-file-entropy-7-29-bits-possible-b","file":"README.md","pattern":"[HEURISTIC] High file entropy (7.29 bits) - possible binary/encrypted content","snippet":"File: README.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/knowledge-base.md:1:heuristic-high-file-entropy-7-46-bits-possible-b","file":"references/knowledge-base.md","pattern":"[HEURISTIC] High file entropy (7.46 bits) - possible binary/encrypted content","snippet":"File: references/knowledge-base.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:SKILL.md:3:heuristic-very-high-entropy-string-5-81-bits-lik","file":"SKILL.md","pattern":"[HEURISTIC] Very high entropy string (5.81 bits) - likely encoded/encrypted payload","snippet":"识别数据资产可保风险，设计网络安全与损失保险方案，审查除外责任，以保险增信助力融资与交易。当用户需要数据保险专家相关的诊断、方案设计、SOP 执行或交付物产出时...","category":"obfuscation","line_end":3,"severity":"high","line_start":3},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-33-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (7.33 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"filesystem:profile.md:38:hidden-file-in-home-directory","reason":"The line only documents the standard Claude Code installation directory in a fenced text example. It does not read, write, or modify any hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:profile.md:38:hidden-file-access","reason":"The home-directory path is inert installation documentation. No filesystem access operation or instruction to inspect unrelated hidden data is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting around a relative documentation path. The line contains no Ruby or shell command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks format the Chinese name of an internal reference library. They do not invoke a command or interpolate executable content.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The line instructs the agent to read a bundled Markdown reference and uses backticks only for formatting. No shell execution syntax or untrusted command input exists.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:6:hardcoded-url","reason":"The URL is author homepage metadata in the YAML front matter. No request, data transmission, or automatic navigation is instructed.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:12:hardcoded-url","reason":"The URL is a visible author attribution link beside a public contact address. It is not used for network access or data exfiltration.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:profile.md:1:heuristic-high-file-entropy-6-34-bits-possible-b","reason":"profile.md is readable Chinese and English marketplace documentation with tables, links, and installation examples. Its entropy does not reflect encoded, encrypted, or binary content.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:README.md:1:heuristic-high-file-entropy-7-29-bits-possible-b","reason":"README.md is plain-text Chinese documentation describing capabilities, examples, and installation. No encoded payload or concealed executable content is present.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:references/knowledge-base.md:1:heuristic-high-file-entropy-7-46-bits-possible-b","reason":"The knowledge base is readable Chinese prose, tables, and checklists about data insurance. The high entropy is consistent with multilingual text and varied domain terminology, not obfuscation.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:SKILL.md:3:heuristic-very-high-entropy-string-5-81-bits-lik","reason":"The cited string is a readable Chinese skill description in YAML metadata. It contains no encoding markers, ciphertext, or executable payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-33-bits-possible-b","reason":"SKILL.md is readable Markdown containing metadata, an overview, an index, and output rules. Its measured entropy is not evidence of hidden or encrypted content.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[],"subject_marketplace_commit_sha":"50b73f83991cf073cbdf3f5afad2bbac71dd3bae","subject_content_hash":"d1b2acf20fe450334cf5036afea70331dce885c951b9a102aec52937af920669","subject_tree_hash":"99627acb7025f6e86e46fb7ea7243e90192198f525d59dcc4a4515f3570c7dd2","subject_plugin_path":"skills/dhturing/data-insurance-expert","audit_payload_hash":"4ae84d2c00bb7e48d0909c49cfa82266","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"50b73f83991cf073cbdf3f5afad2bbac71dd3bae","contentHash":"d1b2acf20fe450334cf5036afea70331dce885c951b9a102aec52937af920669","treeHash":"99627acb7025f6e86e46fb7ea7243e90192198f525d59dcc4a4515f3570c7dd2","pluginPath":"skills/dhturing/data-insurance-expert","auditPayloadHash":"4ae84d2c00bb7e48d0909c49cfa82266"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/dhturing-data-insurance-expert/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}