{"data":{"skill":{"slug":"dhturing-data-standardization-expert","name":"data-standardization-expert","icon":"📦","repo":"https://github.com/dhturing/turing-data-experts/tree/9c58ffa97ec5b760befef6f910eb23107cdcdbf4/skills/data-standardization-expert","status":"approved","author":"图灵数盟","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"accadfac-c6ba-4231-a81e-3a8341bc15a5","skill_id":"7ad14202-d4af-4d01-98ef-655236d129d1","version":1,"content_hash":"v3:50b73f83991cf073cbdf3f5afad2bbac71dd3bae:1b08881b8cc856d4ab56d77105ae61a00939cb0bdc0bebe8b03eced2692e79b9:9e6905b0a08e75857dc7491d0785b13bd95013b49f03d02f2864817f27711b61:736b696c6c732f6468747572696e672f646174612d7374616e64617264697a6174696f6e2d657870657274:6ecb4a9c6d4cd36bb7465106c7d99868","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 12 static findings are false positives caused by documentation paths, Markdown code spans, attribution links, Chinese text, or CRLF formatting. The reviewed files contain no executable commands, network requests, encoded payloads, prompt injection, or other semantic security concerns.","remediation":[],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"profile.md","line_end":38,"line_start":38},{"file":"profile.md","line_end":38,"line_start":38}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":33,"line_start":33}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":6,"line_start":6},{"file":"SKILL.md","line_end":12,"line_start":12}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":4,"total_lines":460,"audit_model":"codex","audited_at":"2026-09-27T03:05:27.548+00:00","created_at":"2026-09-30T12:16:26.864988+00:00","static_findings":[{"id":"filesystem:profile.md:38:hidden-file-in-home-directory","file":"profile.md","pattern":"Hidden file in home directory","snippet":"~/.claude/skills/data-standardization-expert/       # Claude Code","category":"filesystem","line_end":38,"severity":"high","line_start":38},{"id":"filesystem:profile.md:38:hidden-file-access","file":"profile.md","pattern":"Hidden file access","snippet":"~/.claude/skills/data-standardization-expert/       # Claude Code","category":"filesystem","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> 完整知识底座见 `references/knowledge-base.md`。","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **资料来源**:`图灵数盟内部资料库`","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"读取 `references/knowledge-base.md`(该文件为源资料逐字拷贝,权威版本)。","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"network:SKILL.md:6:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: \"https://www.turingtech.net.cn\"","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"network:SKILL.md:12:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> **作者**:图灵数盟(图灵数盟(深圳)数字产业有限公司)|[官网](https://www.turingtech.net.cn)|联系邮箱:public@turingtech.net.cn","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"obfuscation:profile.md:1:heuristic-high-file-entropy-6-10-bits-possible-b","file":"profile.md","pattern":"[HEURISTIC] High file entropy (6.10 bits) - possible binary/encrypted content","snippet":"File: profile.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:README.md:1:heuristic-high-file-entropy-7-12-bits-possible-b","file":"README.md","pattern":"[HEURISTIC] High file entropy (7.12 bits) - possible binary/encrypted content","snippet":"File: README.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/knowledge-base.md:1:heuristic-high-file-entropy-7-15-bits-possible-b","file":"references/knowledge-base.md","pattern":"[HEURISTIC] High file entropy (7.15 bits) - possible binary/encrypted content","snippet":"File: references/knowledge-base.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:SKILL.md:3:heuristic-very-high-entropy-string-5-84-bits-lik","file":"SKILL.md","pattern":"[HEURISTIC] Very high entropy string (5.84 bits) - likely encoded/encrypted payload","snippet":"梳理各级适用标准并落地实施，起草企业标准，参与团体标准制定，把企业实践固化为行业规则。当用户需要数据标准化专家相关的诊断、方案设计、SOP 执行或交付物产出时使...","category":"obfuscation","line_end":3,"severity":"high","line_start":3},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-15-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (7.15 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"filesystem:profile.md:38:hidden-file-in-home-directory","reason":"The path is displayed inside a fenced text block as the documented Claude Code installation destination. The skill does not access or modify that directory.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:profile.md:38:hidden-file-access","reason":"This is the same inert installation-path example in profile.md, not a filesystem operation. No command or instruction reads hidden user files.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"Backticks delimit the included references/knowledge-base.md path in Markdown. They are not Ruby or shell execution syntax in this document context.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Backticks provide Markdown formatting around a Chinese source label. The line contains no executable command or dynamic input.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The backticked value is a relative Markdown file reference that tells the agent which bundled document to read. No shell process is invoked.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:6:hardcoded-url","reason":"The URL is static homepage metadata for the named author. There is no request instruction, data transfer, or executable network behavior.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:12:hardcoded-url","reason":"The URL appears as an author attribution link beside a public contact address. It does not direct the agent to send or retrieve data.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:profile.md:1:heuristic-high-file-entropy-6-10-bits-possible-b","reason":"profile.md is readable Chinese and English marketplace documentation with tables and installation examples. No encoded, encrypted, or binary payload is present.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:README.md:1:heuristic-high-file-entropy-7-12-bits-possible-b","reason":"README.md is readable Chinese Markdown with CRLF line endings and ordinary documentation. Its multilingual byte distribution explains the heuristic without indicating obfuscation.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:references/knowledge-base.md:1:heuristic-high-file-entropy-7-15-bits-possible-b","reason":"The file is a readable Chinese knowledge base containing standards tables, procedures, and checklists. There is no opaque or encoded content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:3:heuristic-very-high-entropy-string-5-84-bits-lik","reason":"The flagged string is a plain Chinese description in YAML metadata. Natural-language multibyte text is not an encoded or encrypted payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-15-bits-possible-b","reason":"SKILL.md is readable YAML and Chinese Markdown describing the skill and its reference file. No obfuscation, binary data, or concealed instructions were found.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"50b73f83991cf073cbdf3f5afad2bbac71dd3bae","subject_content_hash":"1b08881b8cc856d4ab56d77105ae61a00939cb0bdc0bebe8b03eced2692e79b9","subject_tree_hash":"9e6905b0a08e75857dc7491d0785b13bd95013b49f03d02f2864817f27711b61","subject_plugin_path":"skills/dhturing/data-standardization-expert","audit_payload_hash":"6ecb4a9c6d4cd36bb7465106c7d99868","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"50b73f83991cf073cbdf3f5afad2bbac71dd3bae","contentHash":"1b08881b8cc856d4ab56d77105ae61a00939cb0bdc0bebe8b03eced2692e79b9","treeHash":"9e6905b0a08e75857dc7491d0785b13bd95013b49f03d02f2864817f27711b61","pluginPath":"skills/dhturing/data-standardization-expert","auditPayloadHash":"6ecb4a9c6d4cd36bb7465106c7d99868"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/dhturing-data-standardization-expert/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}