{"data":{"skill":{"slug":"dontbesilent2025-dbs-human-dispatch","name":"dbs-human-dispatch","icon":"📦","repo":"https://github.com/dontbesilent2025/dbskill/tree/bab93c0376ced995c30cb841cb0d12622a430bcc/skills/dbs-human-dispatch","status":"approved","author":"dontbesilent2025","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"650a3cff-5271-4a83-a4b0-89a6ed0cbe68","skill_id":"b42414c6-b49d-4c13-bdda-eccf39b35964","version":1,"content_hash":"v3:027ea254b1c6c4fa77a4a926351389d907a8a83f:5d992146b5e5376d6de2c5c0ca3341df684954c36dbd2faad94f19da7dd5a358:f6008517477958c2d6a0356a9fd6eea6e0872cd995a8085bff8571d354d6ff89:736b696c6c732f646f6e74626573696c656e74323032352f6462732d68756d616e2d6469737061746368:d64c0465b1b4f2a16bcdc67496701c7e","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 85 static alerts are false positives involving documented application storage, Python context managers, identifiers, controlled subprocesses, Markdown backticks, or readable Chinese text. Worker execution requires explicit opt-in and trusted configuration; external actions still depend on verified authorization and adapter behavior. No evidence found of malicious prompt injection, credential theft, or unauthorized exfiltration.","remediation":[],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"README.md","line_end":55,"line_start":55},{"file":"README.md","line_end":55,"line_start":55},{"file":"references/workflow.md","line_end":15,"line_start":15},{"file":"references/workflow.md","line_end":15,"line_start":15},{"file":"scripts/test_dispatch.py","line_end":8,"line_start":8},{"file":"scripts/test_dispatch.py","line_end":17,"line_start":17}]},{"factor":"scripts","evidence":[{"file":"scripts/dispatch.py","line_end":207,"line_start":207}]},{"factor":"external_commands","evidence":[{"file":"scripts/dispatch.py","line_end":156,"line_start":156},{"file":"scripts/dispatch.py","line_end":262,"line_start":262},{"file":"scripts/dispatch.py","line_end":272,"line_start":272},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":66,"line_start":66},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":86,"line_start":86},{"file":"SKILL.md","line_end":94,"line_start":94}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":10,"total_lines":804,"audit_model":"codex","audited_at":"2026-10-28T14:51:33.704+00:00","created_at":"2026-10-28T16:27:20.182095+00:00","static_findings":[{"id":"filesystem:README.md:55:hidden-file-in-home-directory","file":"README.md","pattern":"Hidden file in home directory","snippet":"人员与任务运行记录保存在用户本机的 `~/.dbs/human-dispatch/`,更新 Skill 不会覆盖这些记录。发往飞书或模型服务的资料按具体操作和既有授权确定。任务外发、文档回复和老板通知","category":"filesystem","line_end":55,"severity":"high","line_start":55},{"id":"filesystem:README.md:55:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"人员与任务运行记录保存在用户本机的 `~/.dbs/human-dispatch/`,更新 Skill 不会覆盖这些记录。发往飞书或模型服务的资料按具体操作和既有授权确定。任务外发、文档回复和老板通知","category":"filesystem","line_end":55,"severity":"medium","line_start":55},{"id":"sensitive:README.md:55:sqlite-database-file","file":"README.md","pattern":"SQLite database file","snippet":"人员与任务运行记录保存在用户本机的 `~/.dbs/human-dispatch/`,更新 Skill 不会覆盖这些记录。发往飞书或模型服务的资料按具体操作和既有授权确定。任务外发、文档回复和老板通知","category":"sensitive","line_end":55,"severity":"medium","line_start":55},{"id":"blocker:references/runtime.md:10:system-reconnaissance","file":"references/runtime.md","pattern":"System reconnaissance","snippet":"python3 scripts/dispatch.py transition --task-id TASK_ID --to assigned --evidence \"飞书创建返回的任务 ID 与链接\"","category":"blocker","line_end":10,"severity":"low","line_start":10},{"id":"blocker:references/runtime.md:11:system-reconnaissance","file":"references/runtime.md","pattern":"System reconnaissance","snippet":"python3 scripts/dispatch.py subscribe --task-id TASK_ID","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"blocker:references/runtime.md:24:system-reconnaissance","file":"references/runtime.md","pattern":"System reconnaissance","snippet":"- `self_open_ids`:Agent 所使用身份的 open_id 列表,跳过全部由这些身份产生的编辑;混合编辑事件仍入队。持续监听前必须配置全部写入身份。","category":"blocker","line_end":24,"severity":"low","line_start":24},{"id":"blocker:references/runtime.md:43:system-reconnaissance","file":"references/runtime.md","pattern":"System reconnaissance","snippet":"- SQLite 按 event_id 去重,按登记文档匹配;未知文档不保存正文。","category":"blocker","line_end":43,"severity":"low","line_start":43},{"id":"blocker:references/runtime.md:49:system-reconnaissance","file":"references/runtime.md","pattern":"System reconnaissance","snippet":"- 老板或 Agent 核查外部结果后,用 `resolve --job-id ID --result processed --evidence TEXT` 结案,或 `--result retry`","category":"blocker","line_end":49,"severity":"low","line_start":49},{"id":"filesystem:references/workflow.md:15:hidden-file-in-home-directory","file":"references/workflow.md","pattern":"Hidden file in home directory","snippet":"默认 `~/.dbs/human-dispatch/<项目名与路径摘要>/`。跨 Agent 共享同一目录;跨机器使用同一个服务和存储,不把 SQLite 文件放进云同步目录实现并发。通过 `--st","category":"filesystem","line_end":15,"severity":"high","line_start":15},{"id":"filesystem:references/workflow.md:15:hidden-file-access","file":"references/workflow.md","pattern":"Hidden file access","snippet":"默认 `~/.dbs/human-dispatch/<项目名与路径摘要>/`。跨 Agent 共享同一目录;跨机器使用同一个服务和存储,不把 SQLite 文件放进云同步目录实现并发。通过 `--st","category":"filesystem","line_end":15,"severity":"medium","line_start":15},{"id":"sensitive:references/workflow.md:15:sqlite-database-file","file":"references/workflow.md","pattern":"SQLite database file","snippet":"默认 `~/.dbs/human-dispatch/<项目名与路径摘要>/`。跨 Agent 共享同一目录;跨机器使用同一个服务和存储,不把 SQLite 文件放进云同步目录实现并发。通过 `--st","category":"sensitive","line_end":15,"severity":"medium","line_start":15},{"id":"blocker:references/workflow.md:21:system-reconnaissance","file":"references/workflow.md","pattern":"System reconnaissance","snippet":"| id | 稳定唯一任务 ID,允许英文、数字、下划线和连字符 |","category":"blocker","line_end":21,"severity":"low","line_start":21},{"id":"scripts:scripts/dispatch.py:207:with-statement-deprecated-scope-confusion","file":"scripts/dispatch.py","pattern":"with statement (deprecated, scope confusion)","snippet":"with (root / 'config.json').open('x') as f:","category":"scripts","line_end":207,"severity":"medium","line_start":207},{"id":"external_commands:scripts/dispatch.py:156:python-subprocess-run","file":"scripts/dispatch.py","pattern":"Python subprocess.run","snippet":"result = subprocess.run(cfg['agent_command'], input=json.dumps(payload, ensure_ascii=False), text=Tr","category":"external_commands","line_end":156,"severity":"high","line_start":156},{"id":"external_commands:scripts/dispatch.py:262:python-subprocess-run","file":"scripts/dispatch.py","pattern":"Python subprocess.run","snippet":"result = subprocess.run(cmd, text=True, capture_output=True, timeout=60, shell=False)","category":"external_commands","line_end":262,"severity":"high","line_start":262},{"id":"external_commands:scripts/dispatch.py:272:python-subprocess-popen","file":"scripts/dispatch.py","pattern":"Python subprocess.Popen","snippet":"child = subprocess.Popen([cfg['cli'], 'event', '+subscribe', '--event-types', 'drive.file.edit_v1'],","category":"external_commands","line_end":272,"severity":"high","line_start":272},{"id":"sensitive:scripts/dispatch.py:35:sqlite-database-file","file":"scripts/dispatch.py","pattern":"SQLite database file","snippet":"return Path.home() / '.dbs/human-dispatch' / (cwd.name + '-' + hashlib.sha256(str(cwd).encode()).hex","category":"sensitive","line_end":35,"severity":"medium","line_start":35},{"id":"sensitive:scripts/dispatch.py:39:sqlite-database-file","file":"scripts/dispatch.py","pattern":"SQLite database file","snippet":"db = sqlite3.connect(root / 'state.sqlite3', timeout=10)","category":"sensitive","line_end":39,"severity":"medium","line_start":39},{"id":"blocker:scripts/dispatch.py:14:system-reconnaissance","file":"scripts/dispatch.py","pattern":"System reconnaissance","snippet":"import uuid","category":"blocker","line_end":16,"severity":"low","line_start":14},{"id":"blocker:scripts/dispatch.py:42:system-reconnaissance","file":"scripts/dispatch.py","pattern":"System reconnaissance","snippet":"CREATE TABLE IF NOT EXISTS tasks(id TEXT PRIMARY KEY, doc TEXT UNIQUE, data TEXT NOT NULL);","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:scripts/dispatch.py:43:system-reconnaissance","file":"scripts/dispatch.py","pattern":"System reconnaissance","snippet":"CREATE TABLE IF NOT EXISTS history(id INTEGER PRIMARY KEY, task_id TEXT, at REAL, data TEXT);","category":"blocker","line_end":43,"severity":"low","line_start":43},{"id":"blocker:scripts/dispatch.py:44:system-reconnaissance","file":"scripts/dispatch.py","pattern":"System reconnaissance","snippet":"CREATE TABLE IF NOT EXISTS events(id TEXT PRIMARY KEY, task_id TEXT, data TEXT NOT NULL);","category":"blocker","line_end":44,"severity":"low","line_start":44},{"id":"blocker:scripts/dispatch.py:45:system-reconnaissance","file":"scripts/dispatch.py","pattern":"System reconnaissance","snippet":"CREATE TABLE IF NOT EXISTS jobs(id TEXT PRIMARY KEY, task_id TEXT, state TEXT,","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"blocker:scripts/dispatch.py:47:system-reconnaissance","file":"scripts/dispatch.py","pattern":"System reconnaissance","snippet":"CREATE TABLE IF NOT EXISTS job_events(job_id TEXT, event_id TEXT UNIQUE);","category":"blocker","line_end":47,"severity":"low","line_start":47},{"id":"blocker:scripts/dispatch.py:76:system-reconnaissance","file":"scripts/dispatch.py","pattern":"System reconnaissance","snippet":"raise ValueError('invalid task id')","category":"blocker","line_end":76,"severity":"low","line_start":76},{"id":"blocker:scripts/dispatch.py:97:system-reconnaissance","file":"scripts/dispatch.py","pattern":"System reconnaissance","snippet":"raise ValueError('event_id required; use raw events, not compact output')","category":"blocker","line_end":97,"severity":"low","line_start":97},{"id":"blocker:scripts/dispatch.py:117:system-reconnaissance","file":"scripts/dispatch.py","pattern":"System reconnaissance","snippet":"jid = pending['id'] if pending else uuid.uuid4().hex","category":"blocker","line_end":117,"severity":"low","line_start":117},{"id":"blocker:scripts/dispatch.py:141:system-reconnaissance","file":"scripts/dispatch.py","pattern":"System reconnaissance","snippet":"for candidate in db.execute(\"SELECT * FROM jobs WHERE state='pending' AND ready<=? AND task_id NOT I","category":"blocker","line_end":141,"severity":"low","line_start":141},{"id":"blocker:scripts/dispatch.py:152:system-reconnaissance","file":"scripts/dispatch.py","pattern":"System reconnaissance","snippet":"'events': [json.loads(r[0]) for r in db.execute('SELECT e.data FROM events e JOIN job_events j ON e.","category":"blocker","line_end":152,"severity":"low","line_start":152},{"id":"blocker:scripts/dispatch.py:239:system-reconnaissance","file":"scripts/dispatch.py","pattern":"System reconnaissance","snippet":"raise ValueError('invalid transition: ' + old + ' -> ' + a.to)","category":"blocker","line_end":239,"severity":"low","line_start":239},{"id":"filesystem:scripts/test_dispatch.py:8:temp-file-creation","file":"scripts/test_dispatch.py","pattern":"Temp file creation","snippet":"import tempfile","category":"filesystem","line_end":8,"severity":"low","line_start":8},{"id":"filesystem:scripts/test_dispatch.py:17:temp-file-creation","file":"scripts/test_dispatch.py","pattern":"Temp file creation","snippet":"self.tmp = tempfile.TemporaryDirectory()","category":"filesystem","line_end":17,"severity":"low","line_start":17},{"id":"sensitive:scripts/test_dispatch.py:19:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.db = runtime.connect(self.root)","category":"sensitive","line_end":19,"severity":"medium","line_start":19},{"id":"sensitive:scripts/test_dispatch.py:26:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.db.execute('INSERT INTO tasks VALUES(?,?,?)', ('test-1', 'docTest', json.dumps(self.record)))","category":"sensitive","line_end":26,"severity":"medium","line_start":26},{"id":"sensitive:scripts/test_dispatch.py:27:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.db.commit()","category":"sensitive","line_end":27,"severity":"medium","line_start":27},{"id":"sensitive:scripts/test_dispatch.py:30:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.db.close()","category":"sensitive","line_end":30,"severity":"medium","line_start":30},{"id":"sensitive:scripts/test_dispatch.py:38:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"first = runtime.ingest(self.db, self.cfg, self.event())","category":"sensitive","line_end":38,"severity":"medium","line_start":38},{"id":"sensitive:scripts/test_dispatch.py:39:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(runtime.ingest(self.db, self.cfg, self.event()), {'duplicate': 'e1'})","category":"sensitive","line_end":39,"severity":"medium","line_start":39},{"id":"sensitive:scripts/test_dispatch.py:40:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(runtime.ingest(self.db, self.cfg, self.event('e2'))['queued'], first['queued'])","category":"sensitive","line_end":40,"severity":"medium","line_start":40},{"id":"sensitive:scripts/test_dispatch.py:41:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(self.db.execute('SELECT count(*) FROM jobs').fetchone()[0], 1)","category":"sensitive","line_end":41,"severity":"medium","line_start":41},{"id":"sensitive:scripts/test_dispatch.py:42:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertNotIn('DO_NOT_STORE', self.db.execute('SELECT data FROM events').fetchone()[0])","category":"sensitive","line_end":42,"severity":"medium","line_start":42},{"id":"sensitive:scripts/test_dispatch.py:45:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(runtime.ingest(self.db, self.cfg, self.event(doc='unknown'))['ignored'], 'unregiste","category":"sensitive","line_end":45,"severity":"medium","line_start":45},{"id":"sensitive:scripts/test_dispatch.py:47:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(runtime.ingest(self.db, self.cfg, self.event(operator='bot'))['ignored'], 'self_edi","category":"sensitive","line_end":47,"severity":"medium","line_start":47},{"id":"sensitive:scripts/test_dispatch.py:49:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.db.execute('UPDATE tasks SET data=?', (json.dumps(self.record),))","category":"sensitive","line_end":49,"severity":"medium","line_start":49},{"id":"sensitive:scripts/test_dispatch.py:50:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.db.commit()","category":"sensitive","line_end":50,"severity":"medium","line_start":50},{"id":"sensitive:scripts/test_dispatch.py:51:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(runtime.ingest(self.db, self.cfg, self.event())['ignored'], 'inactive_task')","category":"sensitive","line_end":51,"severity":"medium","line_start":51},{"id":"sensitive:scripts/test_dispatch.py:57:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertIn('queued', runtime.ingest(self.db, self.cfg, event))","category":"sensitive","line_end":57,"severity":"medium","line_start":57},{"id":"sensitive:scripts/test_dispatch.py:60:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"runtime.ingest(self.db, self.cfg, self.event())","category":"sensitive","line_end":60,"severity":"medium","line_start":60},{"id":"sensitive:scripts/test_dispatch.py:62:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"runtime.dispatch(self.db, self.cfg, True, self.root)","category":"sensitive","line_end":62,"severity":"medium","line_start":62},{"id":"sensitive:scripts/test_dispatch.py:63:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(self.db.execute('SELECT state FROM jobs').fetchone()[0], 'pending')","category":"sensitive","line_end":63,"severity":"medium","line_start":63},{"id":"sensitive:scripts/test_dispatch.py:66:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"runtime.ingest(self.db, self.cfg, self.event())","category":"sensitive","line_end":66,"severity":"medium","line_start":66},{"id":"sensitive:scripts/test_dispatch.py:69:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"out = runtime.dispatch(self.db, self.cfg, True, self.root)","category":"sensitive","line_end":69,"severity":"medium","line_start":69},{"id":"sensitive:scripts/test_dispatch.py:71:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(runtime.task(self.db, 'test-1')['state'], 'assigned')","category":"sensitive","line_end":71,"severity":"medium","line_start":71},{"id":"sensitive:scripts/test_dispatch.py:74:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"runtime.ingest(self.db, self.cfg, self.event())","category":"sensitive","line_end":74,"severity":"medium","line_start":74},{"id":"sensitive:scripts/test_dispatch.py:76:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(runtime.dispatch(self.db, self.cfg, True, self.root)['state'], 'uncertain')","category":"sensitive","line_end":76,"severity":"medium","line_start":76},{"id":"sensitive:scripts/test_dispatch.py:77:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"runtime.ingest(self.db, self.cfg, self.event('e2'))","category":"sensitive","line_end":77,"severity":"medium","line_start":77},{"id":"sensitive:scripts/test_dispatch.py:78:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(runtime.dispatch(self.db, self.cfg, True, self.root)['waiting'], 'no_ready_job')","category":"sensitive","line_end":78,"severity":"medium","line_start":78},{"id":"sensitive:scripts/test_dispatch.py:81:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"runtime.ingest(self.db, self.cfg, self.event())","category":"sensitive","line_end":81,"severity":"medium","line_start":81},{"id":"sensitive:scripts/test_dispatch.py:83:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(runtime.dispatch(self.db, self.cfg, True, self.root)['state'], 'uncertain')","category":"sensitive","line_end":83,"severity":"medium","line_start":83},{"id":"sensitive:scripts/test_dispatch.py:84:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(runtime.dispatch(self.db, self.cfg, True, self.root)['waiting'], 'no_ready_job')","category":"sensitive","line_end":84,"severity":"medium","line_start":84},{"id":"sensitive:scripts/test_dispatch.py:87:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"runtime.ingest(self.db, self.cfg, self.event())","category":"sensitive","line_end":87,"severity":"medium","line_start":87},{"id":"sensitive:scripts/test_dispatch.py:88:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.db.execute(\"UPDATE jobs SET state='running'\")","category":"sensitive","line_end":88,"severity":"medium","line_start":88},{"id":"sensitive:scripts/test_dispatch.py:89:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.db.commit()","category":"sensitive","line_end":89,"severity":"medium","line_start":89},{"id":"sensitive:scripts/test_dispatch.py:106:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"runtime.ingest(self.db, self.cfg, self.event())","category":"sensitive","line_end":106,"severity":"medium","line_start":106},{"id":"sensitive:scripts/test_dispatch.py:108:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.db.execute('UPDATE tasks SET data=?', (json.dumps(self.record),))","category":"sensitive","line_end":108,"severity":"medium","line_start":108},{"id":"sensitive:scripts/test_dispatch.py:109:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.db.commit()","category":"sensitive","line_end":109,"severity":"medium","line_start":109},{"id":"sensitive:scripts/test_dispatch.py:111:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(runtime.dispatch(self.db, self.cfg, True, self.root)['waiting'], 'no_ready_job')","category":"sensitive","line_end":111,"severity":"medium","line_start":111},{"id":"sensitive:scripts/test_dispatch.py:112:sqlite-database-file","file":"scripts/test_dispatch.py","pattern":"SQLite database file","snippet":"self.assertEqual(self.db.execute('SELECT state FROM jobs').fetchone()[0], 'processed')","category":"sensitive","line_end":112,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. 可以运行 `python3 scripts/dispatch.py doctor` 检查可执行文件。工具存在只证明安装,继续核实身份、scope 和资源可访问性。","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`lark-cli` 与 `feishu-cli` 是候选工具名,命令方言可能不同。先检查其 `--help`,确认支持所需子命令,才选用对应适配;配套脚本只执行经过配置的 lark 兼容方言。没有 ","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"确认自动外发范围后派单。纯文字模式直接交付说明,记录为 `draft`;只有用户确认已转发或接口返回成功,才记录 `assigned`。使用稳定任务 ID 和 CLI 支持的幂等键,重试前查询是否已成","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"可以用脚本 `register` 保存任务 JSON;更新授权或范围应经老板确认。运行时资料默认保存在用户目录,禁止写回 Skill 包。","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 接单:记录 `accepted`,本人协商后才能认定工期达成一致。","category":"external_commands","line_end":66,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 提交验收:记录 `submitted`,进入逐项核验。","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"结论分为 `passed`、`needs_revision` 或 `needs_owner`。修订意见限定在原范围;新增工作单独派单。员工报告拒绝或老板取消时使用 `declined`/`cancel","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`scripts/dispatch.py` 提供本地任务登记、状态转换、文件编辑事件监听、去重、静默合并、单 worker 领取锁和处理记录。它将已登记任务作为 JSON 通过 stdin 交给用户配","category":"external_commands","line_end":86,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"完成当前任务后直接结束。用户的请求超出本 Skill 的范围、任务完成后用户的材料里出现明确的后续需求,或用户询问下一步时,用一句话说明还需要哪种能力,不点名其他 Skill;当前环境已经安装 `/d","category":"external_commands","line_end":94,"severity":"medium","line_start":94},{"id":"obfuscation:agents/openai.yaml:4:heuristic-very-high-entropy-string-5-58-bits-lik","file":"agents/openai.yaml","pattern":"[HEURISTIC] Very high entropy string (5.58 bits) - likely encoded/encrypted payload","snippet":"使用 $dbs-human-dispatch，结合现有人员资料与工具，把当前任务交给适合的人并跟进反馈、验收和汇报。","category":"obfuscation","line_end":4,"severity":"high","line_start":4},{"id":"obfuscation:assets/person-profile.md:1:heuristic-high-file-entropy-6-57-bits-possible-b","file":"assets/person-profile.md","pattern":"[HEURISTIC] High file entropy (6.57 bits) - possible binary/encrypted content","snippet":"File: assets/person-profile.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:assets/task-brief.md:1:heuristic-high-file-entropy-6-87-bits-possible-b","file":"assets/task-brief.md","pattern":"[HEURISTIC] High file entropy (6.87 bits) - possible binary/encrypted content","snippet":"File: assets/task-brief.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:README.md:1:heuristic-high-file-entropy-7-42-bits-possible-b","file":"README.md","pattern":"[HEURISTIC] High file entropy (7.42 bits) - possible binary/encrypted content","snippet":"File: README.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/feishu.md:1:heuristic-high-file-entropy-6-84-bits-possible-b","file":"references/feishu.md","pattern":"[HEURISTIC] High file entropy (6.84 bits) - possible binary/encrypted content","snippet":"File: references/feishu.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/runtime.md:1:heuristic-high-file-entropy-7-17-bits-possible-b","file":"references/runtime.md","pattern":"[HEURISTIC] High file entropy (7.17 bits) - possible binary/encrypted content","snippet":"File: references/runtime.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/workflow.md:1:heuristic-high-file-entropy-7-30-bits-possible-b","file":"references/workflow.md","pattern":"[HEURISTIC] High file entropy (7.30 bits) - possible binary/encrypted content","snippet":"File: references/workflow.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-95-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (7.95 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"filesystem:README.md:55:hidden-file-in-home-directory","reason":"This paragraph documents application-owned task storage, not access to unrelated hidden files. The runtime creates a project-specific state directory with mode 0700.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:55:hidden-file-access","reason":"The hidden path holds the documented local delegation records. The paragraph explicitly requires authorization for external actions and rejects commands embedded in employee content.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:README.md:55:sqlite-database-file","reason":"This is documentation of the skill's own records, not instructions to retrieve another application's database. No credential database access appears here.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/runtime.md:10:system-reconnaissance","reason":"The example updates a task state using a task identifier and delivery evidence. It does not query operating system identities or inventory.","verdict":"false_positive","confidence":1},{"id":"blocker:references/runtime.md:11:system-reconnaissance","reason":"This example subscribes to a registered task document, defaulting to dry-run. The task identifier is not a system reconnaissance command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/runtime.md:24:system-reconnaissance","reason":"The text describes configured Feishu open_id values used to suppress the agent's own edits. It does not collect operating system identity information.","verdict":"false_positive","confidence":1},{"id":"blocker:references/runtime.md:43:system-reconnaissance","reason":"The paragraph explains event identifier deduplication and registered-document matching. These are queue safeguards, not machine enumeration.","verdict":"false_positive","confidence":1},{"id":"blocker:references/runtime.md:49:system-reconnaissance","reason":"The command resolves an uncertain queue job after checking external results. Its job identifier selects a local record, not a system identity.","verdict":"false_positive","confidence":1},{"id":"filesystem:references/workflow.md:15:hidden-file-in-home-directory","reason":"The path is the documented project-specific application state directory. The runtime creates it with restrictive permissions rather than searching unrelated home-directory files.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/workflow.md:15:hidden-file-access","reason":"The paragraph explains shared local task storage and an explicit state-directory override. It does not direct covert file access or alteration.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/workflow.md:15:sqlite-database-file","reason":"SQLite stores the skill's own task queue. The guidance discourages cloud-synchronized database concurrency and does not request access to unrelated sensitive databases.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/workflow.md:21:system-reconnaissance","reason":"This table row defines the allowed characters for a stable task identifier. It contains no system inspection command.","verdict":"false_positive","confidence":1},{"id":"scripts:scripts/dispatch.py:207:with-statement-deprecated-scope-confusion","reason":"This is a standard Python file context manager, not JavaScript's deprecated with statement. Exclusive creation preserves any existing configuration.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/dispatch.py:156:python-subprocess-run","reason":"The worker uses a trusted configured argument array, shell=False, JSON stdin, and a timeout. Execution requires --allow-agent; document content never constructs argv.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:scripts/dispatch.py:262:python-subprocess-run","reason":"The configured CLI receives fixed subscription arguments and a validated document token with shell=False. Subscription defaults to dry-run unless --execute is supplied.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/dispatch.py:272:python-subprocess-popen","reason":"The explicitly requested listener starts the configured CLI with a fixed event subscription argument array. It requires configured self identities and never interpolates document content.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:scripts/dispatch.py:35:sqlite-database-file","reason":"This constructs a project-scoped state path using the working directory name and a path digest. It does not locate or read unrelated databases.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/dispatch.py:39:sqlite-database-file","reason":"The database connection targets state.sqlite3 inside the application state directory. The preceding mkdir requests mode 0700; this is task persistence, not credential extraction.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/dispatch.py:14:system-reconnaissance","reason":"Importing uuid supports random queue job identifiers. The code uses uuid4, not hardware-address discovery or system identity enumeration.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/dispatch.py:42:system-reconnaissance","reason":"This SQL creates the local tasks table with a task primary key. The id column is not an operating system command.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/dispatch.py:43:system-reconnaissance","reason":"This SQL defines task history identifiers and timestamps. It neither executes system commands nor enumerates host information.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/dispatch.py:44:system-reconnaissance","reason":"This statement creates an events table for deduplication and task association. Identifier column names do not indicate reconnaissance.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/dispatch.py:45:system-reconnaissance","reason":"The SQL creates the local jobs table and queue lifecycle fields. No host inspection occurs.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/dispatch.py:47:system-reconnaissance","reason":"The job_events table associates queue jobs with unique event identifiers. It does not inspect operating system accounts.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/dispatch.py:76:system-reconnaissance","reason":"This validation error rejects task identifiers outside the allowed character set and length. It is input validation, not reconnaissance.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/dispatch.py:97:system-reconnaissance","reason":"The error requires a nonempty event identifier for deduplication. It performs no system discovery.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/dispatch.py:117:system-reconnaissance","reason":"The expression reuses a pending job identifier or generates a random UUID. Neither operation reads host identity information.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/dispatch.py:141:system-reconnaissance","reason":"This local SQL query selects ready jobs while excluding tasks with uncertain work. It is queue coordination, not system enumeration.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/dispatch.py:152:system-reconnaissance","reason":"The parameterized query loads events belonging to the selected job. The identifiers refer exclusively to application queue records.","verdict":"false_positive","confidence":1},{"id":"blocker:scripts/dispatch.py:239:system-reconnaissance","reason":"This exception rejects task state changes outside the declared transition table. It contains no operating system command.","verdict":"false_positive","confidence":1},{"id":"filesystem:scripts/test_dispatch.py:8:temp-file-creation","reason":"The standard-library tempfile import supports isolated offline test storage. Importing it does not create an unsafe predictable temporary file.","verdict":"false_positive","confidence":1},{"id":"filesystem:scripts/test_dispatch.py:17:temp-file-creation","reason":"TemporaryDirectory creates isolated test storage with cleanup in tearDown. The tests do not overwrite fixed shared temporary paths.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:19:sqlite-database-file","reason":"The connection uses the fresh TemporaryDirectory created in setUp. It does not open a production or credential database.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:26:sqlite-database-file","reason":"This parameterized insertion stores a synthetic task fixture in the temporary test database. It contains no real employee or credential data.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:27:sqlite-database-file","reason":"The commit persists only synthetic setup data in the isolated test database. No sensitive external database is accessed.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:30:sqlite-database-file","reason":"This closes the temporary database connection before directory cleanup. It is resource management, not sensitive data access.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:38:sqlite-database-file","reason":"The test ingests a synthetic edit event into its temporary database. It exercises queue behavior without employee data or network requests.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:39:sqlite-database-file","reason":"This assertion verifies that a repeated synthetic event is deduplicated. All records belong to the isolated test fixture.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:40:sqlite-database-file","reason":"This assertion checks coalescing of a second synthetic event into the existing job. It does not handle production data.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:41:sqlite-database-file","reason":"The SQL counts jobs in the temporary test database to verify coalescing. It reads no unrelated data.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:42:sqlite-database-file","reason":"This test verifies that a dummy verification token is absent from stored events. The marker is synthetic, not a credential.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:45:sqlite-database-file","reason":"The assertion verifies that events for unknown documents are ignored. It operates solely on synthetic records in temporary storage.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:47:sqlite-database-file","reason":"The assertion tests suppression of the configured bot's own synthetic edit event. No employee database or real identity is accessed.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:49:sqlite-database-file","reason":"This parameterized update marks the synthetic task as passed. The database is confined to the test's TemporaryDirectory.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:50:sqlite-database-file","reason":"The commit saves a synthetic terminal-state fixture. It does not affect actual task records or sensitive databases.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:51:sqlite-database-file","reason":"This assertion confirms that completed synthetic tasks ignore later events. It validates a safeguard using temporary test data.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:57:sqlite-database-file","reason":"The test checks that a mixed bot-and-employee fixture event remains queued. The identities and database are synthetic.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:60:sqlite-database-file","reason":"This synthetic event prepares the missing-worker test. It is stored only in the isolated temporary database.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:62:sqlite-database-file","reason":"The call is inside assertRaises because no worker is configured. It verifies refusal to execute and never launches a real agent.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:63:sqlite-database-file","reason":"This assertion reads the temporary queue state after rejected dispatch. It verifies that the pending job is preserved.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:66:sqlite-database-file","reason":"The test queues a synthetic event before exercising the local subprocess bridge. No production database is involved.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:69:sqlite-database-file","reason":"The worker is a hardcoded local Python fixture that validates stdin and prints a synthetic receipt. It sends no network requests or employee messages.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/test_dispatch.py:71:sqlite-database-file","reason":"The assertion reads the synthetic task to ensure processing does not imply acceptance. It accesses only the temporary database.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:74:sqlite-database-file","reason":"This queues a synthetic event for testing asynchronous acknowledgement rejection. There is no real employee or credential data.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:76:sqlite-database-file","reason":"A fixed local Python fixture returns accepted rather than processed. The assertion verifies that this leaves the temporary job uncertain.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/test_dispatch.py:77:sqlite-database-file","reason":"This adds a second synthetic event after an uncertain result. It tests queue safety using isolated temporary storage.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:78:sqlite-database-file","reason":"The assertion verifies that uncertain work blocks another dispatch for the synthetic task. It does not access sensitive external records.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:81:sqlite-database-file","reason":"The event prepares the failed-worker test in a temporary database. It contains only synthetic identifiers.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:83:sqlite-database-file","reason":"The configured test worker is a fixed Python command that exits with code 1. The assertion checks uncertain state without invoking a real agent.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/test_dispatch.py:84:sqlite-database-file","reason":"This assertion verifies that failed work is not automatically retried. The queue and task are isolated test fixtures.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:87:sqlite-database-file","reason":"The synthetic event initializes the concurrent-connection locking test. It does not read production records.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:88:sqlite-database-file","reason":"This fixed SQL update simulates an already running worker in the temporary database. It is a concurrency fixture, not unauthorized state modification.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:89:sqlite-database-file","reason":"The commit exposes the synthetic running-job fixture to a second test connection. It affects no user database.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:106:sqlite-database-file","reason":"This queues a synthetic event for the cancellation safeguard test. Only the temporary test database is used.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:108:sqlite-database-file","reason":"The parameterized update marks the synthetic task cancelled. It cannot modify actual employee records because storage is a TemporaryDirectory.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:109:sqlite-database-file","reason":"This commit persists the cancelled test fixture. It does not write to a production or credential database.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:111:sqlite-database-file","reason":"The assertion verifies that cancellation prevents worker invocation. The configured sentinel would fail if incorrectly run; no real agent is configured.","verdict":"false_positive","confidence":1},{"id":"sensitive:scripts/test_dispatch.py:112:sqlite-database-file","reason":"This query verifies that the cancelled task's queued job was skipped and marked processed. It reads only synthetic queue state.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Backticks format a documented Python doctor command in Markdown, not Ruby execution. The implementation checks executable availability and explicitly reports authorization as unverified.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"Backticks identify CLI names and the help flag in explanatory prose. This guidance checks compatibility and does not execute shell substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The backticks surround draft and assigned task-state labels. The paragraph requires confirmed delivery and authorization rather than executing commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The register token is Markdown formatting for an optional local persistence command. The text requires owner confirmation for authorization changes and prohibits package-local runtime records.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The backticks format the accepted state label. The sentence requires the assignee's confirmation and contains no executable shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The submitted token is a task-state name in Markdown prose. No Ruby or shell evaluation is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"Backticks mark acceptance, revision, escalation, refusal, and cancellation states. The text constrains workflow decisions rather than running commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"Backticks identify the bundled Python script in documentation. The paragraph describes JSON stdin transfer to a user-configured worker, not shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The /dbs token is a suggested user invocation only when already installed. Markdown backticks do not run commands or install another skill.","verdict":"false_positive","confidence":1},{"id":"obfuscation:agents/openai.yaml:4:heuristic-very-high-entropy-string-5-58-bits-lik","reason":"The YAML value is readable Chinese asking for task delegation and follow-up. It contains no encoded payload or decoding instruction.","verdict":"false_positive","confidence":1},{"id":"obfuscation:assets/person-profile.md:1:heuristic-high-file-entropy-6-57-bits-possible-b","reason":"The complete file is a readable Chinese personnel profile template. Its fields cover verified skills, availability, consent, and minimal sharing, not encrypted content.","verdict":"false_positive","confidence":1},{"id":"obfuscation:assets/task-brief.md:1:heuristic-high-file-entropy-6-87-bits-possible-b","reason":"The file is ordinary Chinese Markdown defining deliverables, acceptance criteria, timing, and feedback. No encoded or binary payload appears.","verdict":"false_positive","confidence":1},{"id":"obfuscation:README.md:1:heuristic-high-file-entropy-7-42-bits-possible-b","reason":"The complete README is readable Chinese documentation with installation examples, operating modes, and data safeguards. No decoding mechanism or concealed payload appears.","verdict":"false_positive","confidence":1},{"id":"obfuscation:references/feishu.md:1:heuristic-high-file-entropy-6-84-bits-possible-b","reason":"The file contains readable Chinese Feishu integration guidance, CLI examples, and official reference links. It is not encrypted or obfuscated program content.","verdict":"false_positive","confidence":1},{"id":"obfuscation:references/runtime.md:1:heuristic-high-file-entropy-7-17-bits-possible-b","reason":"The complete file documents queue commands, trusted worker configuration, authorization, and recovery in readable Chinese. No concealed executable payload appears.","verdict":"false_positive","confidence":1},{"id":"obfuscation:references/workflow.md:1:heuristic-high-file-entropy-7-30-bits-possible-b","reason":"This is readable Chinese workflow documentation and a task-field table. The high entropy signal does not correspond to encoded or encrypted content.","verdict":"false_positive","confidence":1},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-95-bits-possible-b","reason":"The complete file contains ordinary YAML metadata and Chinese task-delegation instructions. It explicitly treats employee material as untrusted and prohibits unauthorized actions.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"027ea254b1c6c4fa77a4a926351389d907a8a83f","subject_content_hash":"5d992146b5e5376d6de2c5c0ca3341df684954c36dbd2faad94f19da7dd5a358","subject_tree_hash":"f6008517477958c2d6a0356a9fd6eea6e0872cd995a8085bff8571d354d6ff89","subject_plugin_path":"skills/dontbesilent2025/dbs-human-dispatch","audit_payload_hash":"d64c0465b1b4f2a16bcdc67496701c7e","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"027ea254b1c6c4fa77a4a926351389d907a8a83f","contentHash":"5d992146b5e5376d6de2c5c0ca3341df684954c36dbd2faad94f19da7dd5a358","treeHash":"f6008517477958c2d6a0356a9fd6eea6e0872cd995a8085bff8571d354d6ff89","pluginPath":"skills/dontbesilent2025/dbs-human-dispatch","auditPayloadHash":"d64c0465b1b4f2a16bcdc67496701c7e"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/dontbesilent2025-dbs-human-dispatch/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}