{"data":{"skill":{"slug":"dustinliang666-blip-lava-news-heat","name":"lava-news-heat","icon":"📦","repo":"https://github.com/dustinliang666-blip/lava-mcp/tree/f9369732c3956024666c80835b72dc7d22df5a43/","status":"approved","author":"dustinliang666-blip","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"60ca4383-331a-4f88-be6e-05efd3e8614d","skill_id":"f9bfc066-eba9-4484-91b4-bacc3d034dac","version":1,"content_hash":"v3:4699d5d8d8b53ee8ddbe0a18430bcdf40abcc835:016b9612973668533df0a04caabb4107ed7e77b1322b3d3846549e1d49dfbde0:3333a874732f6c936b2f2797c16b5cff60af5993fbe61a92901fbf2cf0949502:736b696c6c732f64757374696e6c69616e673636362d626c69702f6c6176612d6e6577732d68656174:0845607a5b7f7777beb7fdfd9244b333","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 31 static alerts are false positives involving documented URLs, Markdown formatting, public discovery metadata, source identifiers, or readable Chinese text. No evidence found of prompt injection, credential exfiltration, executable payloads, or local system reconnaissance. The remote service implementation was not supplied, so its behavior and data handling remain unverified.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"glama.json","line_end":1,"line_start":1},{"file":"server.json","line_end":2,"line_start":2},{"file":"server.json","line_end":7,"line_start":7},{"file":"server.json","line_end":9,"line_start":9},{"file":"server.json","line_end":15,"line_start":15},{"file":"server.json","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":53,"line_start":53}]},{"factor":"filesystem","evidence":[{"file":"README.md","line_end":41,"line_start":41}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":39,"line_start":35},{"file":"SKILL.md","line_end":39,"line_start":39}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":5,"total_lines":218,"audit_model":"codex","audited_at":"2026-10-28T15:55:28.125+00:00","created_at":"2026-10-28T16:58:28.339612+00:00","static_findings":[{"id":"network:glama.json:1:hardcoded-url","file":"glama.json","pattern":"Hardcoded URL","snippet":"{\"$schema\":\"https://glama.ai/mcp/schemas/server.json\",\"maintainers\":[\"dustinliang666-blip\"]}","category":"network","line_end":1,"severity":"low","line_start":1},{"id":"filesystem:README.md:41:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"- Glama:[`glama.json`](./glama.json) · 线上 `/.well-known/glama.json`","category":"filesystem","line_end":41,"severity":"medium","line_start":41},{"id":"network:server.json:2:hardcoded-url","file":"server.json","pattern":"Hardcoded URL","snippet":"\"$schema\": \"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json\",","category":"network","line_end":2,"severity":"low","line_start":2},{"id":"network:server.json:7:hardcoded-url","file":"server.json","pattern":"Hardcoded URL","snippet":"\"websiteUrl\": \"https://lava.ai-dolphin.com/subscribe/docs\",","category":"network","line_end":7,"severity":"low","line_start":7},{"id":"network:server.json:9:hardcoded-url","file":"server.json","pattern":"Hardcoded URL","snippet":"\"url\": \"https://github.com/dustinliang666-blip/lava-mcp\",","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:server.json:15:hardcoded-url","file":"server.json","pattern":"Hardcoded URL","snippet":"\"url\": \"https://lava.ai-dolphin.com/subscribe/v1/mcp\",","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:server.json:19:hardcoded-url","file":"server.json","pattern":"Hardcoded URL","snippet":"\"description\": \"填 Bearer 加空格再加你的 API Key(在 https://lava.ai-dolphin.com/subscribe 免费开通领取);亦支持 OAuth 2","category":"network","line_end":19,"severity":"low","line_start":19},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **拿 API Key**:登录熔岩 → 左侧点「AI数据服务」→ 上方点「API Key」:首次登录已自动送代金券并生成「默认」Key(`lvk_` 开头,默认脱敏,点眼睛显示、点复制),接入","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 地址:`https://lava.ai-dolphin.com/subscribe/v1/mcp`","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 请求头:`Authorization` = `Bearer lvk_你的Key`(Bearer 后有一个空格)","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"数据源:熔岩远程 MCP `https://lava.ai-dolphin.com/subscribe/v1/mcp`(Streamable HTTP,请求头 `Authorization: Bear","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **个股热度**:`get_stock_news_heat(stock_name 或 ts_code, days=7)`","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 看 `data.heat.mentions`(提及数)、`data.heat.agencies`(参与机构/大V数),再读 `list[].summary` 归纳要点。","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **个股关联概念**:`get_stock_concept_heat(stock_name, days=30)` → 取 `list[]` 前 5 个概念及其 `mentions`。","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **概念内个股排行**:`get_concept_stock_heat(concept, days=7)` → 列出提及最多的个股。","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **关键词追踪**:`search_news_flow(keyword, since)`。","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **全市场热榜**:`get_market_hot_stocks(window=24h)` / `get_market_hot_concepts(window=24h)`;问“靠谱的人在提什么”用","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **新冒头**:`get_first_mention_stocks(hours=24)` → 此前 7 天没人提、刚被第一次提到的股票。","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **新闻点名**:`get_news_stock_hits(hours=24)` 看全市场;`get_news_stock_hits(stock_name)` 看某股被哪些媒体点名。","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **单股多时间窗**:`get_stock_heat_windows(stock_name) → windows[](1h~7d)与 hourly_24h[] 逐小时走势。","category":"external_commands","line_end":39,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **机构/大V可信度**(可选):对 `agency_id` 用 `get_agency_pit` / `get_agency_history` 看机构/大V分(约 450~1500,中位约 1","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"network:SKILL.md:10:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"1. **拿 API Key**:登录熔岩 → 左侧点「AI数据服务」→ 上方点「API Key」:首次登录已自动送代金券并生成「默认」Key(`lvk_` 开头,默认脱敏,点眼睛显示、点复制),接入","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- 地址:`https://lava.ai-dolphin.com/subscribe/v1/mcp`","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"分软件的详细步骤:https://lava.ai-dolphin.com/subscribe#ai-office","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"数据源:熔岩远程 MCP `https://lava.ai-dolphin.com/subscribe/v1/mcp`(Streamable HTTP,请求头 `Authorization: Bear","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:SKILL.md:52:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- 文档:https://lava.ai-dolphin.com/subscribe/docs","category":"network","line_end":52,"severity":"low","line_start":52},{"id":"network:SKILL.md:53:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- OpenAPI:https://lava.ai-dolphin.com/subscribe/v1/openapi.json","category":"network","line_end":53,"severity":"low","line_start":53},{"id":"blocker:SKILL.md:47:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- 机构/大V请使用返回的 agency_id 指代。","category":"blocker","line_end":47,"severity":"low","line_start":47},{"id":"obfuscation:README.md:1:heuristic-high-file-entropy-6-58-bits-possible-b","file":"README.md","pattern":"[HEURISTIC] High file entropy (6.58 bits) - possible binary/encrypted content","snippet":"File: README.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:server.json:5:heuristic-very-high-entropy-string-5-75-bits-lik","file":"server.json","pattern":"[HEURISTIC] Very high entropy string (5.75 bits) - likely encoded/encrypted payload","snippet":"查A股个股/概念热度、全市场热榜、加速榜、日频面板、机构覆盖度、高分加权、首提流和新闻点名。只读结构化数据，支持量化交易工具与 AI Agent 股市研究接入。","category":"obfuscation","line_end":5,"severity":"high","line_start":5},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-91-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.91 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"network:glama.json:1:hardcoded-url","reason":"The URL identifies the Glama JSON schema for registry metadata. It does not specify a credential destination or an executable request.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:41:hidden-file-access","reason":"The path /.well-known/glama.json names public web discovery metadata. This documentation neither reads hidden local files nor requests sensitive filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"network:server.json:2:hardcoded-url","reason":"This is the MCP registry JSON schema reference. It is declarative validation metadata, not a data transmission instruction.","verdict":"false_positive","confidence":0.99},{"id":"network:server.json:7:hardcoded-url","reason":"The websiteUrl field links to Lava documentation. It contains no credential, payload, or instruction to disclose user data.","verdict":"false_positive","confidence":0.99},{"id":"network:server.json:9:hardcoded-url","reason":"The repository URL identifies the public source repository. It does not initiate execution or transmit private information.","verdict":"false_positive","confidence":0.99},{"id":"network:server.json:15:hardcoded-url","reason":"This HTTPS endpoint is the explicitly documented Lava MCP data service. Authentication is declared separately as a secret header for the intended provider.","verdict":"false_positive","confidence":0.97},{"id":"network:server.json:19:hardcoded-url","reason":"The header description explains obtaining a provider API key and using Bearer authentication. The adjacent isSecret flag marks the credential as sensitive.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"Backticks format the lvk_ API key prefix in human setup instructions. There is no shell command, Ruby program, or execution directive.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"Backticks format the HTTPS MCP endpoint as inline Markdown. They do not invoke a shell or execute the URL.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"Backticks mark an HTTP header name and an example Bearer credential. These are connector configuration values, not executable commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"The Markdown describes the remote service URL and authorization header. No shell execution or command substitution appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The inline expression documents a read-only MCP stock news query. It is tool-call notation in Markdown, not a shell or Ruby invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"Backticks identify response fields for mention counts, source counts, and summaries. They describe data interpretation without executing code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"The line documents a stock-to-concept lookup and response fields. Markdown inline formatting is incorrectly classified as shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The expression names a read-only concept stock ranking tool. No local command execution is requested.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The inline expression describes keyword search through MCP. There is no shell interpreter, executable payload, or command construction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The line lists market ranking and weighted ranking MCP queries. Backticks are documentation delimiters, not command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The documented tool retrieves newly mentioned stocks over a time window. It does not execute external system commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"Both inline expressions describe news-hit queries against the data service. No shell or Ruby execution appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"An unmatched Markdown backtick spans descriptions of heat windows, historical panels, coverage, and source scores. The text contains no shell execution mechanism.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"Inline identifiers describe source IDs and optional source scoring tools. This is documented MCP usage, not Ruby or shell code.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:10:hardcoded-url","reason":"The HTTPS URL directs users to the provider account interface for obtaining their own API key. It does not request unrelated credentials or secrets.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The endpoint is the intended Lava MCP connector configured by the user. Network access is essential to the stated remote research workflow.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:17:hardcoded-url","reason":"The URL links to client setup documentation on the provider domain. No data upload or code execution is instructed.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:22:hardcoded-url","reason":"The line explicitly identifies the remote data source and its Bearer authentication scheme. It sends the provider credential to the intended HTTPS service.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:52:hardcoded-url","reason":"This reference links to provider API documentation. It contains no secret, executable download, or instruction to disclose private data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:53:hardcoded-url","reason":"The URL references the provider OpenAPI specification. It documents the intended service interface rather than an exfiltration destination.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:47:system-reconnaissance","reason":"The instruction uses returned agency_id values to identify financial information sources. It does not enumerate operating system users, processes, devices, or credentials.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:README.md:1:heuristic-high-file-entropy-6-58-bits-possible-b","reason":"The README contains readable Chinese documentation, Markdown tables, URLs, and tool names. No evidence found of encrypted payloads or executable decoding logic.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:server.json:5:heuristic-very-high-entropy-string-5-75-bits-lik","reason":"The flagged string is a readable Chinese description of A-share research features. It is ordinary natural-language metadata, not an encoded payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-91-bits-possible-b","reason":"The skill contains readable Chinese instructions, YAML front matter, and tool documentation. No evidence found of concealed executable content or payload decoding.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"4699d5d8d8b53ee8ddbe0a18430bcdf40abcc835","subject_content_hash":"016b9612973668533df0a04caabb4107ed7e77b1322b3d3846549e1d49dfbde0","subject_tree_hash":"3333a874732f6c936b2f2797c16b5cff60af5993fbe61a92901fbf2cf0949502","subject_plugin_path":"skills/dustinliang666-blip/lava-news-heat","audit_payload_hash":"0845607a5b7f7777beb7fdfd9244b333","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"4699d5d8d8b53ee8ddbe0a18430bcdf40abcc835","contentHash":"016b9612973668533df0a04caabb4107ed7e77b1322b3d3846549e1d49dfbde0","treeHash":"3333a874732f6c936b2f2797c16b5cff60af5993fbe61a92901fbf2cf0949502","pluginPath":"skills/dustinliang666-blip/lava-news-heat","auditPayloadHash":"0845607a5b7f7777beb7fdfd9244b333"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/dustinliang666-blip-lava-news-heat/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}