{"data":{"skill":{"slug":"hessianz-chilemai","name":"chilemai","icon":"📦","repo":"https://github.com/hessianz/chilemai/tree/83f46eb66036472828157002e0700c55d1d2cc65/","status":"approved","author":"hessianz","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"9de6a16c-8327-4179-89a9-3694891f9b44","skill_id":"072e2e8a-6daf-4339-95d8-c9d955b46a04","version":1,"content_hash":"v3:03fad901c6372b6cd8e5a832fccabbac50bc422f:d9586060a3dd41a76d85acac72c798a034e8a03041859aade1aa53ffdeb79438:7af97fb7d22da7af95bde66bbbe71fd30885c49fe0d828a497f0e7cb986f7471:736b696c6c732f6865737369616e7a2f6368696c656d6169:307dff7fe157e498928eab19a9d5eaaf","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 58 static alerts are false positives involving documented endpoints, installation paths, formatting, variable names, offline tests, and readable Chinese documentation. No evidence found of malicious execution, credential theft, concealed payloads, or prompt injection. The workflow uses an authenticated ordering service, requires explicit order confirmation, and leaves payment to the user.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"mcp-config.example.json","line_end":5,"line_start":5},{"file":"README.md","line_end":62,"line_start":62},{"file":"README.md","line_end":76,"line_start":76}]},{"factor":"filesystem","evidence":[{"file":"README.md","line_end":76,"line_start":76},{"file":"README.md","line_end":80,"line_start":80},{"file":"README.md","line_end":76,"line_start":76},{"file":"README.md","line_end":80,"line_start":80},{"file":"scripts/chilemai.py","line_end":155,"line_start":155},{"file":"scripts/chilemai.py","line_end":160,"line_start":160},{"file":"scripts/chilemai.py","line_end":176,"line_start":176}]},{"factor":"external_commands","evidence":[{"file":"scripts/chilemai.py","line_end":5,"line_start":5},{"file":"scripts/chilemai.py","line_end":564,"line_start":564},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":47,"line_start":41},{"file":"SKILL.md","line_end":49,"line_start":47},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":58,"line_start":50},{"file":"SKILL.md","line_end":69,"line_start":58},{"file":"SKILL.md","line_end":70,"line_start":69},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":72,"line_start":72},{"file":"SKILL.md","line_end":80,"line_start":74},{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":83,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":89,"line_start":86},{"file":"SKILL.md","line_end":91,"line_start":89},{"file":"SKILL.md","line_end":99,"line_start":91},{"file":"SKILL.md","line_end":106,"line_start":99},{"file":"SKILL.md","line_end":107,"line_start":106},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":112,"line_start":109},{"file":"SKILL.md","line_end":114,"line_start":112},{"file":"SKILL.md","line_end":114,"line_start":114},{"file":"SKILL.md","line_end":119,"line_start":115},{"file":"SKILL.md","line_end":123,"line_start":119},{"file":"SKILL.md","line_end":125,"line_start":123},{"file":"SKILL.md","line_end":126,"line_start":125},{"file":"SKILL.md","line_end":126,"line_start":126},{"file":"SKILL.md","line_end":127,"line_start":127},{"file":"SKILL.md","line_end":135,"line_start":129},{"file":"SKILL.md","line_end":135,"line_start":135},{"file":"SKILL.md","line_end":140,"line_start":137},{"file":"SKILL.md","line_end":140,"line_start":140},{"file":"SKILL.md","line_end":146,"line_start":145},{"file":"SKILL.md","line_end":146,"line_start":146},{"file":"SKILL.md","line_end":147,"line_start":147},{"file":"SKILL.md","line_end":148,"line_start":148},{"file":"tests/test_chilemai.py","line_end":150,"line_start":150}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":15,"total_lines":1960,"audit_model":"codex","audited_at":"2026-10-18T14:07:57.105+00:00","created_at":"2026-10-18T15:03:13.69783+00:00","static_findings":[{"id":"network:mcp-config.example.json:5:hardcoded-url","file":"mcp-config.example.json","pattern":"Hardcoded URL","snippet":"\"url\": \"https://mcp.mcd.cn\",","category":"network","line_end":5,"severity":"low","line_start":5},{"id":"network:README.md:62:hardcoded-url","file":"README.md","pattern":"Hardcoded URL","snippet":"\"url\": \"https://mcp.mcd.cn\",","category":"network","line_end":62,"severity":"low","line_start":62},{"id":"network:README.md:76:hardcoded-url","file":"README.md","pattern":"Hardcoded URL","snippet":"git clone https://github.com/HessianZ/chilemai.git ~/.workbuddy/skills/chilemai","category":"network","line_end":76,"severity":"low","line_start":76},{"id":"filesystem:README.md:76:hidden-file-in-home-directory","file":"README.md","pattern":"Hidden file in home directory","snippet":"git clone https://github.com/HessianZ/chilemai.git ~/.workbuddy/skills/chilemai","category":"filesystem","line_end":76,"severity":"high","line_start":76},{"id":"filesystem:README.md:80:hidden-file-in-home-directory","file":"README.md","pattern":"Hidden file in home directory","snippet":"解压后把目录重命名为 `chilemai` 放进 `~/.workbuddy/skills/`。","category":"filesystem","line_end":80,"severity":"high","line_start":80},{"id":"filesystem:README.md:76:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"git clone https://github.com/HessianZ/chilemai.git ~/.workbuddy/skills/chilemai","category":"filesystem","line_end":76,"severity":"medium","line_start":76},{"id":"filesystem:README.md:80:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"解压后把目录重命名为 `chilemai` 放进 `~/.workbuddy/skills/`。","category":"filesystem","line_end":80,"severity":"medium","line_start":80},{"id":"external_commands:scripts/chilemai.py:5:ruby-shell-backtick-execution","file":"scripts/chilemai.py","pattern":"Ruby/shell backtick execution","snippet":"`query-meals` 返回的菜单名称又与营养库存在差异(如 \"纯牛奶(盒装)\" vs \"纯牛奶(盒装)\")。","category":"external_commands","line_end":5,"severity":"medium","line_start":5},{"id":"external_commands:scripts/chilemai.py:564:ruby-shell-backtick-execution","file":"scripts/chilemai.py","pattern":"Ruby/shell backtick execution","snippet":"# 兼容 `--goal low-cal` 与位置式 `low-cal` 两种写法","category":"external_commands","line_end":564,"severity":"medium","line_start":564},{"id":"filesystem:scripts/chilemai.py:155:hard-link-creation","file":"scripts/chilemai.py","pattern":"Hard link creation","snippet":"lines = [ln for ln in text.splitlines() if ln.strip()]","category":"filesystem","line_end":155,"severity":"medium","line_start":155},{"id":"filesystem:scripts/chilemai.py:160:hard-link-creation","file":"scripts/chilemai.py","pattern":"Hard link creation","snippet":"for i, ln in enumerate(lines):","category":"filesystem","line_end":160,"severity":"medium","line_start":160},{"id":"filesystem:scripts/chilemai.py:176:hard-link-creation","file":"scripts/chilemai.py","pattern":"Hard link creation","snippet":"for ln in lines[header_idx + 1 :]:","category":"filesystem","line_end":176,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 麦当劳 MCP Server 已接入(配置见 `mcp-config.example.json`)","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":47,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":49,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"参数细节见 `references/mcp-tools.md`,四种场景的完整调用序见 `references/order-flow.md`,","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"营养目标的筛选口径见 `references/goals.md`。","category":"external_commands","line_end":58,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| goal | high-protein / low-cal / low-fat / low-sodium / low-carb / light / any | 默认 `any` |","category":"external_commands","line_end":69,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **到店自取 / 得来速** → `query-nearby-stores`","category":"external_commands","line_end":70,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 用户指定收藏店时用 `searchType=1`;按当前位置找最近店时用 `searchType=2` 带 `city` + `keyword`","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `beType=1` 自取(不传 beCode);`beType=5` 得来速(**记下 beCode**)","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **麦乐送 / 团餐** → `delivery-query-addresses` 取地址 → `delivery-query-stores` 取门店与 beCode","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"默认挑**距离最近且在营业**的门店(用 `businessStatus` 与营业时间过滤)。展示时至少给:","category":"external_commands","line_end":80,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `query-meals`(需 storeCode / orderType / beType)→ 在售餐品、编码 `code`、价格","category":"external_commands","line_end":80,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `list-nutrition-foods` → 餐品营养数据(原始约 160 条,去重后 158 条)","category":"external_commands","line_end":83,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"这两份数据的名称**并不严格一致**(`纯牛奶(盒装)` vs `纯牛奶(盒装)`),而且营养表是","category":"external_commands","line_end":83,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":89,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":91,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"脚本把结果分成三类;`alias` 只给候选名称,**不再输出可直接合计的营养数值**:","category":"external_commands","line_end":99,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"套餐需用 `query-meal-detail` 查清实际选择的主食、配餐、饮品与份数,再逐项核实营养。","category":"external_commands","line_end":106,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"用 `plan` 从在售且营养精确匹配的单品中组合一餐。先确认菜单价格原值的单位,","category":"external_commands","line_end":107,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"再明确传 `--price-unit yuan`(元)或 `fen`(分),不能根据数值大小猜单位:","category":"external_commands","line_end":107,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":112,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":114,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`plan` 输出 JSON:`items` 可交给算价,`nutrition` 是整餐合计,`menu_subtotal_cents`","category":"external_commands","line_end":114,"severity":"medium","line_start":114},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"是**菜单估价(分)**,`coverage` 说明数据覆盖。默认组合 1–3 份单品、至少一份主食,","category":"external_commands","line_end":119,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"核心口径与优惠比较详见 `references/goals.md`:","category":"external_commands","line_end":123,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `filter` 仅用于查看单品,不能先用单品蛋白下限裁掉整餐组合的原料","category":"external_commands","line_end":125,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 价格一律走 `calculate-price`(返回值单位是**分**,展示要 ÷100)","category":"external_commands","line_end":126,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 省钱诉求:先 `auto-bind-coupons` 一键领券,再 `query-store-coupons` 看本店可用券,","category":"external_commands","line_end":126,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"把 `couponId` / `couponCode` 带进 `calculate-price`,对比用券前后的差价","category":"external_commands","line_end":127,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `--budget` 只限制菜单估价,不含优惠、配送费和打包费;找券后方案时可不设此参数。","category":"external_commands","line_end":135,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `create-order`;`orderType=1` 必须带 `takeWayCode`(取自 `calculate-price` 的 `takeWayList`)","category":"external_commands","line_end":135,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. 用户回复\"支付完成 / 失败\"后,用 `query-order` 核对最新状态","category":"external_commands","line_end":140,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`create-order` 超时或结果不明时,不直接重试;按 `references/order-flow.md` 核查已有订单,","category":"external_commands","line_end":140,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `beCode`:**到店自取绝不能传**;得来速 / 外送 / 团餐必传","category":"external_commands","line_end":146,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `orderType`:到店自取与得来速为 `1`,麦乐送与团餐为 `2`","category":"external_commands","line_end":146,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `takeWayCode`:仅 `orderType=1` 需要","category":"external_commands","line_end":147,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `calculate-price` / `create-order` 的价格字段单位是**分**;菜单原值单位另行核实","category":"external_commands","line_end":148,"severity":"medium","line_start":148},{"id":"external_commands:tests/test_chilemai.py:150:python-subprocess-run","file":"tests/test_chilemai.py","pattern":"Python subprocess.run","snippet":"return subprocess.run(","category":"external_commands","line_end":150,"severity":"high","line_start":150},{"id":"obfuscation:CONTEST_DECLARATION.md:1:heuristic-high-file-entropy-7-26-bits-possible-b","file":"CONTEST_DECLARATION.md","pattern":"[HEURISTIC] High file entropy (7.26 bits) - possible binary/encrypted content","snippet":"File: CONTEST_DECLARATION.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:MCP_INTEGRATION.md:1:heuristic-high-file-entropy-6-62-bits-possible-b","file":"MCP_INTEGRATION.md","pattern":"[HEURISTIC] High file entropy (6.62 bits) - possible binary/encrypted content","snippet":"File: MCP_INTEGRATION.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:README.md:1:heuristic-high-file-entropy-7-39-bits-possible-b","file":"README.md","pattern":"[HEURISTIC] High file entropy (7.39 bits) - possible binary/encrypted content","snippet":"File: README.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/goals.md:1:heuristic-high-file-entropy-7-30-bits-possible-b","file":"references/goals.md","pattern":"[HEURISTIC] High file entropy (7.30 bits) - possible binary/encrypted content","snippet":"File: references/goals.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/mcp-tools.md:1:heuristic-high-file-entropy-6-11-bits-possible-b","file":"references/mcp-tools.md","pattern":"[HEURISTIC] High file entropy (6.11 bits) - possible binary/encrypted content","snippet":"File: references/mcp-tools.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/order-flow.md:1:heuristic-high-file-entropy-6-30-bits-possible-b","file":"references/order-flow.md","pattern":"[HEURISTIC] High file entropy (6.30 bits) - possible binary/encrypted content","snippet":"File: references/order-flow.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-45-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (7.45 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:workbuddy.md:1:heuristic-high-file-entropy-7-28-bits-possible-b","file":"workbuddy.md","pattern":"[HEURISTIC] High file entropy (7.28 bits) - possible binary/encrypted content","snippet":"File: workbuddy.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"network:mcp-config.example.json:5:hardcoded-url","reason":"The HTTPS endpoint is the documented McDonald's MCP service required for the stated ordering workflow. Authentication uses a placeholder, with no unrelated destination or credential exfiltration shown.","verdict":"false_positive","confidence":0.98},{"id":"network:README.md:62:hardcoded-url","reason":"This configuration example repeats the declared MCP service endpoint for user setup. It does not execute a request or introduce an unrelated recipient.","verdict":"false_positive","confidence":0.98},{"id":"network:README.md:76:hardcoded-url","reason":"The GitHub URL identifies this skill's public repository in a manual installation command. No private data is uploaded by this clone example.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:76:hidden-file-in-home-directory","reason":"The hidden directory is the documented WorkBuddy skill installation location. The manual clone command does not access credentials or modify unrelated configuration.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:80:hidden-file-in-home-directory","reason":"This sentence explains where users should place the downloaded skill directory. It describes ordinary installation, not concealed access to sensitive home-directory files.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:76:hidden-file-access","reason":"The path is the intended WorkBuddy installation directory for a user-run clone command. No sensitive hidden file is read or exported.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:80:hidden-file-access","reason":"The reference is a manual installation destination in prose. It does not instruct the agent to inspect hidden files or collect private configuration.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chilemai.py:5:ruby-shell-backtick-execution","reason":"The backticks enclose a tool name inside the Python module docstring. They are literal documentation characters, not executable shell or Ruby syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:scripts/chilemai.py:564:ruby-shell-backtick-execution","reason":"The backticks occur in a Python comment describing accepted argument forms. Comments do not execute commands.","verdict":"false_positive","confidence":1},{"id":"filesystem:scripts/chilemai.py:155:hard-link-creation","reason":"The token ln is a local line variable in a text-processing list comprehension. No filesystem linking command or API is invoked.","verdict":"false_positive","confidence":1},{"id":"filesystem:scripts/chilemai.py:160:hard-link-creation","reason":"The token ln is the loop variable receiving each nutrition text line. This enumerate loop does not create hard links.","verdict":"false_positive","confidence":1},{"id":"filesystem:scripts/chilemai.py:176:hard-link-creation","reason":"This loop iterates over nutrition text lines using the variable ln. There is no hard-link operation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks format a configuration filename in Markdown. The prerequisite does not contain shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The triple backticks delimit a Markdown workflow diagram. The enclosed phase descriptions are not shell or Ruby code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"This is a closing Markdown fence followed by formatted reference paths. Neither construct executes a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The backticks format relative documentation paths. They do not represent executable command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The matched text contains a reference path and a formatted default value in Markdown. No shell execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"Backticks mark a goal default and MCP tool identifiers in workflow prose. These are Markdown literals, not shell expressions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The text names the nearby-store MCP tool and its search parameters. Inline code formatting does not execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The backticks distinguish MCP search parameter names and values. There is no Ruby or shell execution syntax in use.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The backticks format pickup and drive-through parameter values. They are documentation, not executable expressions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"This line documents MCP address and store lookup tools for delivery. The backticks are only inline Markdown formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The range describes store availability filtering and menu lookup using formatted identifiers. It contains no shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The line names the menu MCP tool and product code field. Backticks denote identifiers rather than external command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The backticks format a nutrition tool name and example product names. They do not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The quoted product names illustrate punctuation differences between data sources. Markdown code spans are not command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"This fenced example runs the bundled Python matcher on explicit menu and nutrition files. It contains no backtick substitution or injected shell arguments.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The match spans a closing code fence and an inline result category. Both are Markdown formatting, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"This section explains uncertain nutrition matches and names a meal-detail MCP tool. Its backticks only format identifiers.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"The matched prose requires checking bundle composition and introduces the local planner. Tool and command names are formatted as Markdown literals.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The backticks format the planner name and explicit price-unit options. No command substitution is used.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"This line documents yuan and fen argument choices. Inline backticks are Markdown, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The fenced command runs the bundled meal planner with fixed file paths and nutritional limits. There is no backtick expansion or unrelated command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"The range closes a Markdown example and describes planner output fields. These backticks do not execute anything.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","reason":"Backticks identify planner output keys such as items and nutrition. The line is an output description, not an external command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The range explains estimated prices, data coverage, and a reference document. Backticks are used only for Markdown code spans.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"The matched section links nutrition guidance and describes the filter subcommand. It does not contain shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The range distinguishes filtering from official price calculation using formatted names. These are not executable shell expressions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"This line documents the official price-calculation MCP tool and currency conversion. The backticks only format its name.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"The line names coupon tools used for the stated savings workflow. Markdown quoting is not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"The backticks distinguish coupon identifiers and a price-calculation tool. No shell interpreter or command substitution is involved.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The range describes budget limitations and confirmation before order creation. Backticks format an argument and an MCP tool name.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"The line documents order parameters after the explicit user-confirmation step. Its backticks are Markdown formatting, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"The range requires checking payment status and avoiding blind order retries. Formatted MCP names do not execute shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"This safety instruction requires checking existing orders after an uncertain result. Backticks mark a tool name and reference path.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"The matched lines document required parameter combinations for ordering modes. Their inline code spans do not invoke an interpreter.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The backticks format orderType and its permitted numeric values. No executable command is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"This line specifies when the takeWayCode parameter is required. Its backticks only provide Markdown formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","reason":"The line documents currency units returned by MCP tools. Backticks around tool names are not shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:tests/test_chilemai.py:150:python-subprocess-run","reason":"The offline test invokes the bundled script through sys.executable with an argument list and no shell. Callers supply fixed test arguments and fixtures, not attacker-controlled command strings.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:CONTEST_DECLARATION.md:1:heuristic-high-file-entropy-7-26-bits-possible-b","reason":"The file is readable Chinese contest, compliance, and disclaimer text. No encoded payload or executable decoder is present; declarations are not treated as independent security proof.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:MCP_INTEGRATION.md:1:heuristic-high-file-entropy-6-62-bits-possible-b","reason":"The file contains readable Chinese integration documentation, tables, and workflow examples. The entropy alert does not identify concealed executable content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:README.md:1:heuristic-high-file-entropy-7-39-bits-possible-b","reason":"The README is readable Chinese installation and usage documentation with ordinary Markdown examples. No encrypted payload, decoding routine, or hidden execution instruction was found.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/goals.md:1:heuristic-high-file-entropy-7-30-bits-possible-b","reason":"The file contains readable Chinese nutrition thresholds, tables, and pricing guidance. There is no concealed binary or encrypted executable material.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/mcp-tools.md:1:heuristic-high-file-entropy-6-11-bits-possible-b","reason":"The file is a readable Chinese MCP tool reference with parameter tables and sample data. No obfuscated payload or execution mechanism is present.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/order-flow.md:1:heuristic-high-file-entropy-6-30-bits-possible-b","reason":"The file contains readable Chinese ordering workflows and explicit API examples. The content is not encrypted or concealed executable code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-45-bits-possible-b","reason":"The skill consists of readable Chinese workflow instructions and Markdown examples. It includes confirmation safeguards, with no encoded payload or instruction to override the audit.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:workbuddy.md:1:heuristic-high-file-entropy-7-28-bits-possible-b","reason":"The file is readable Chinese development history with tables and literal tool names. Historical testing claims are contextual documentation, not concealed code or audit authority.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"03fad901c6372b6cd8e5a832fccabbac50bc422f","subject_content_hash":"d9586060a3dd41a76d85acac72c798a034e8a03041859aade1aa53ffdeb79438","subject_tree_hash":"7af97fb7d22da7af95bde66bbbe71fd30885c49fe0d828a497f0e7cb986f7471","subject_plugin_path":"skills/hessianz/chilemai","audit_payload_hash":"307dff7fe157e498928eab19a9d5eaaf","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"03fad901c6372b6cd8e5a832fccabbac50bc422f","contentHash":"d9586060a3dd41a76d85acac72c798a034e8a03041859aade1aa53ffdeb79438","treeHash":"7af97fb7d22da7af95bde66bbbe71fd30885c49fe0d828a497f0e7cb986f7471","pluginPath":"skills/hessianz/chilemai","auditPayloadHash":"307dff7fe157e498928eab19a9d5eaaf"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/hessianz-chilemai/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}