{"data":{"skill":{"slug":"hunxuankai-wxpusher-integration","name":"wxpusher-integration","icon":"📦","repo":"https://github.com/hunxuankai/wxpusher-integration/tree/67fdb08b4fa574f2c4c2213838dc142f837e9ea2/skills/wxpusher-integration","status":"approved","author":"hunxuankai","authorVersion":"1.0.4","skillstoreRevision":2},"audit":{"id":"53ad1098-d3e3-41e1-8a16-96a2ea19b79e","skill_id":"396209a1-c698-4a2d-b1e5-17c0252af325","version":2,"content_hash":"v3:87cebd6f2460da36107e4bd50cab89d51c0b33db:ea8fe6dae416cebf5bdf5a08a3ea3f5edb8d9fcf85e5d4993d92a7cd2015dd2c:1a07a31e406fbaa92e95936043ccb3e1ed5282d7073d7f9b476991a7ccd76f0c:736b696c6c732f68756e7875616e6b61692f77787075736865722d696e746567726174696f6e:07ffe783215d0bf216b14bb0687a7158","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 24 static findings are false positives involving documented endpoints, placeholder configuration, Markdown syntax, installation paths, and readable Chinese text. No evidence found of prompt injection, credential exfiltration, concealed execution, or unauthorized messaging. The skill requires scoped authorization for live pushes, prefers POST, and documents credential redaction and service limitations.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"references/api.md","line_end":48,"line_start":48},{"file":"references/api.md","line_end":66,"line_start":66},{"file":"references/api.md","line_end":130,"line_start":130},{"file":"references/api.md","line_end":139,"line_start":139},{"file":"references/api.md","line_end":153,"line_start":153},{"file":"references/api.md","line_end":177,"line_start":177},{"file":"references/api.md","line_end":198,"line_start":198},{"file":"references/api.md","line_end":222,"line_start":222},{"file":"references/api.md","line_end":244,"line_start":244},{"file":"references/api.md","line_end":251,"line_start":251}]},{"factor":"env_access","evidence":[{"file":"references/configuration.md","line_end":34,"line_start":34}]},{"factor":"filesystem","evidence":[{"file":"references/maintenance.md","line_end":77,"line_start":77}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":81,"line_start":81}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":8,"total_lines":998,"audit_model":"codex","audited_at":"2026-10-18T17:14:32.574+00:00","created_at":"2026-10-18T18:02:56.282093+00:00","static_findings":[{"id":"network:references/api.md:48:hardcoded-url","file":"references/api.md","pattern":"Hardcoded URL","snippet":"POST https://wxpusher.zjiecode.com/api/send/message","category":"network","line_end":48,"severity":"low","line_start":48},{"id":"network:references/api.md:66:hardcoded-url","file":"references/api.md","pattern":"Hardcoded URL","snippet":"\"url\": \"https://example.invalid/result\"","category":"network","line_end":66,"severity":"low","line_start":66},{"id":"network:references/api.md:130:hardcoded-url","file":"references/api.md","pattern":"Hardcoded URL","snippet":"GET https://wxpusher.zjiecode.com/api/send/query/status?sendRecordId=<id>","category":"network","line_end":130,"severity":"low","line_start":130},{"id":"network:references/api.md:139:hardcoded-url","file":"references/api.md","pattern":"Hardcoded URL","snippet":"DELETE https://wxpusher.zjiecode.com/api/send/message","category":"network","line_end":139,"severity":"low","line_start":139},{"id":"network:references/api.md:153:hardcoded-url","file":"references/api.md","pattern":"Hardcoded URL","snippet":"GET https://wxpusher.zjiecode.com/api/send/message/","category":"network","line_end":153,"severity":"low","line_start":153},{"id":"network:references/api.md:177:hardcoded-url","file":"references/api.md","pattern":"Hardcoded URL","snippet":"POST https://wxpusher.zjiecode.com/api/send/message/simple-push","category":"network","line_end":177,"severity":"low","line_start":177},{"id":"network:references/api.md:198:hardcoded-url","file":"references/api.md","pattern":"Hardcoded URL","snippet":"GET https://wxpusher.zjiecode.com/api/send/message/<spt>/<url-encoded-content>","category":"network","line_end":198,"severity":"low","line_start":198},{"id":"network:references/api.md:222:hardcoded-url","file":"references/api.md","pattern":"Hardcoded URL","snippet":"GET https://wxpusher.zjiecode.com/api/fun/wxuser/v2","category":"network","line_end":222,"severity":"low","line_start":222},{"id":"network:references/api.md:244:hardcoded-url","file":"references/api.md","pattern":"Hardcoded URL","snippet":"POST https://wxpusher.zjiecode.com/api/fun/create/qrcode","category":"network","line_end":244,"severity":"low","line_start":244},{"id":"network:references/api.md:251:hardcoded-url","file":"references/api.md","pattern":"Hardcoded URL","snippet":"GET https://wxpusher.zjiecode.com/api/fun/scan-qrcode-uid?code=<code>","category":"network","line_end":251,"severity":"low","line_start":251},{"id":"sensitive:references/api.md:330:environment-file-access","file":"references/api.md","pattern":"Environment file access","snippet":"- 只在 `.env.example` 写空值或明显占位符。不要提交真实 token、UID、Topic","category":"sensitive","line_end":330,"severity":"high","line_start":330},{"id":"env_access:references/configuration.md:34:dotenv-library","file":"references/configuration.md","pattern":"dotenv library","snippet":"```dotenv","category":"env_access","line_end":34,"severity":"low","line_start":34},{"id":"sensitive:references/configuration.md:30:environment-file-access","file":"references/configuration.md","pattern":"Environment file access","snippet":"## `.env.example`","category":"sensitive","line_end":30,"severity":"high","line_start":30},{"id":"sensitive:references/configuration.md:50:environment-file-access","file":"references/configuration.md","pattern":"Environment file access","snippet":"1. 复制 `.env.example` 为被 `.gitignore` 忽略的本地文件(名称服从项目惯例)。","category":"sensitive","line_end":50,"severity":"high","line_start":50},{"id":"sensitive:references/integration-patterns.md:113:environment-file-access","file":"references/integration-patterns.md","pattern":"Environment file access","snippet":"- `.env.example`/部署说明只含空值或占位符;","category":"sensitive","line_end":113,"severity":"high","line_start":113},{"id":"filesystem:references/maintenance.md:77:hidden-file-access","file":"references/maintenance.md","pattern":"Hidden file access","snippet":"- Codex 支持用户级 `$HOME/.agents/skills`,并可选读取 `agents/openai.yaml`;","category":"filesystem","line_end":77,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"成功:必须解析 JSON,检查顶层及返回的逐目标业务 `code`;目标失败时","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"如果宿主读取 `agents/openai.yaml`,只能将其用于界面标签;该文件是可选项,","category":"external_commands","line_end":81,"severity":"medium","line_start":81},{"id":"obfuscation:references/api.md:1:heuristic-high-file-entropy-7-43-bits-possible-b","file":"references/api.md","pattern":"[HEURISTIC] High file entropy (7.43 bits) - possible binary/encrypted content","snippet":"File: references/api.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/configuration.md:1:heuristic-high-file-entropy-7-39-bits-possible-b","file":"references/configuration.md","pattern":"[HEURISTIC] High file entropy (7.39 bits) - possible binary/encrypted content","snippet":"File: references/configuration.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/integration-patterns.md:1:heuristic-high-file-entropy-7-45-bits-possible-b","file":"references/integration-patterns.md","pattern":"[HEURISTIC] High file entropy (7.45 bits) - possible binary/encrypted content","snippet":"File: references/integration-patterns.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/maintenance.md:1:heuristic-high-file-entropy-7-50-bits-possible-b","file":"references/maintenance.md","pattern":"[HEURISTIC] High file entropy (7.50 bits) - possible binary/encrypted content","snippet":"File: references/maintenance.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/troubleshooting.md:1:heuristic-high-file-entropy-7-57-bits-possible-b","file":"references/troubleshooting.md","pattern":"[HEURISTIC] High file entropy (7.57 bits) - possible binary/encrypted content","snippet":"File: references/troubleshooting.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-39-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (7.39 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"network:references/api.md:48:hardcoded-url","reason":"This is the documented WxPusher HTTPS send endpoint, matching the requested integration purpose. The surrounding example uses placeholders and does not execute a request.","verdict":"false_positive","confidence":0.99},{"id":"network:references/api.md:66:hardcoded-url","reason":"The example.invalid address is an explicitly nonfunctional placeholder for an optional message link. It is not a destination for collecting data.","verdict":"false_positive","confidence":1},{"id":"network:references/api.md:130:hardcoded-url","reason":"This documents a status lookup using a placeholder sendRecordId on the same WxPusher HTTPS service. No request execution or unrelated data transfer appears.","verdict":"false_positive","confidence":0.99},{"id":"network:references/api.md:139:hardcoded-url","reason":"This documents deletion of a message landing page, not an automatic destructive action. Adjacent text explains shared-target effects and warns about query-token logging.","verdict":"false_positive","confidence":0.98},{"id":"network:references/api.md:153:hardcoded-url","reason":"This is a documented optional GET send endpoint with placeholder parameters. The text recommends POST to reduce URL exposure and requires redacted logging.","verdict":"false_positive","confidence":0.98},{"id":"network:references/api.md:177:hardcoded-url","reason":"This documents the WxPusher SPT POST endpoint for simple notifications. The example uses a placeholder token, and surrounding text treats SPT as a secret.","verdict":"false_positive","confidence":0.99},{"id":"network:references/api.md:198:hardcoded-url","reason":"This documents the optional SPT GET endpoint rather than executing it. Adjacent guidance requires segment encoding, protects tokens from logs, and recommends POST where appropriate.","verdict":"false_positive","confidence":0.98},{"id":"network:references/api.md:222:hardcoded-url","reason":"This documents a WxPusher application user-list endpoint and its pagination parameters. It does not instruct exporting recipient records to an unrelated destination.","verdict":"false_positive","confidence":0.98},{"id":"network:references/api.md:244:hardcoded-url","reason":"This is reference documentation for creating a WxPusher subscription QR code. It describes required fields and validity limits without making a live request.","verdict":"false_positive","confidence":0.99},{"id":"network:references/api.md:251:hardcoded-url","reason":"This documents QR scan lookup using a placeholder code. The following text requires polling intervals and cancellation, and cautions against copying uncertain SDK authentication parameters.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/api.md:330:environment-file-access","reason":"The flagged sentence requires empty values or placeholders in .env.example and prohibits committing real credentials or recipient data. It is protective guidance, not secret-file extraction.","verdict":"false_positive","confidence":1},{"id":"env_access:references/configuration.md:34:dotenv-library","reason":"dotenv is only a Markdown code-fence language label. The block contains empty credential variables and nonsecret defaults, not a library import or runtime environment access.","verdict":"false_positive","confidence":1},{"id":"sensitive:references/configuration.md:30:environment-file-access","reason":"This is a heading introducing .env.example documentation. The following example explicitly permits only empty values or obvious placeholders.","verdict":"false_positive","confidence":1},{"id":"sensitive:references/configuration.md:50:environment-file-access","reason":"This describes copying a placeholder template into a project-local file excluded by .gitignore. Adjacent instructions prohibit exposing real values and default to mock tests.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/integration-patterns.md:113:environment-file-access","reason":"This delivery checklist requires .env.example and deployment documentation to contain only empty values or placeholders. It neither reads credentials nor directs their disclosure.","verdict":"false_positive","confidence":1},{"id":"filesystem:references/maintenance.md:77:hidden-file-access","reason":"The line describes a user-level skill installation directory and optional interface metadata. It contains no hidden-file read operation or request to collect private files.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The backticks format the JSON business-response field code in Markdown. The sentence requires response validation and contains no shell or Ruby execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The backticks format an optional interface-metadata path in Markdown. The sentence restricts its use to interface labels and does not execute it.","verdict":"false_positive","confidence":1},{"id":"obfuscation:references/api.md:1:heuristic-high-file-entropy-7-43-bits-possible-b","reason":"The complete file is readable Chinese and English API documentation with ordinary Markdown tables and placeholder examples. No evidence found of encrypted content or hidden payloads.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/configuration.md:1:heuristic-high-file-entropy-7-39-bits-possible-b","reason":"The complete file contains readable Chinese configuration guidance, empty environment examples, and deployment snippets. Multibyte prose does not establish obfuscation; no concealed payload was found.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/integration-patterns.md:1:heuristic-high-file-entropy-7-45-bits-possible-b","reason":"The file is readable Chinese architecture, retry, and test guidance with transparent text templates. No encoded executable content or decryption behavior appears.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/maintenance.md:1:heuristic-high-file-entropy-7-50-bits-possible-b","reason":"The file contains readable Chinese maintenance history, source links, and labeled SHA-256 provenance fingerprints. These hashes are audit records, not concealed executable payloads.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/troubleshooting.md:1:heuristic-high-file-entropy-7-57-bits-possible-b","reason":"The complete file is readable Chinese diagnostic guidance with Markdown tables and a plain-text retry decision block. No evidence found of encrypted or executable hidden content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-39-bits-possible-b","reason":"The file contains normal YAML frontmatter and readable Chinese workflow instructions. Its multibyte text does not conceal code, and the workflow explicitly limits live sends and credential disclosure.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"87cebd6f2460da36107e4bd50cab89d51c0b33db","subject_content_hash":"ea8fe6dae416cebf5bdf5a08a3ea3f5edb8d9fcf85e5d4993d92a7cd2015dd2c","subject_tree_hash":"1a07a31e406fbaa92e95936043ccb3e1ed5282d7073d7f9b476991a7ccd76f0c","subject_plugin_path":"skills/hunxuankai/wxpusher-integration","audit_payload_hash":"07ffe783215d0bf216b14bb0687a7158","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"87cebd6f2460da36107e4bd50cab89d51c0b33db","contentHash":"ea8fe6dae416cebf5bdf5a08a3ea3f5edb8d9fcf85e5d4993d92a7cd2015dd2c","treeHash":"1a07a31e406fbaa92e95936043ccb3e1ed5282d7073d7f9b476991a7ccd76f0c","pluginPath":"skills/hunxuankai/wxpusher-integration","auditPayloadHash":"07ffe783215d0bf216b14bb0687a7158"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/hunxuankai-wxpusher-integration/audits/2/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}