{"data":{"skill":{"slug":"longbridge-longbridge-portfolio","name":"longbridge-portfolio","icon":"📦","repo":"https://github.com/longbridge/skills/tree/main/skills/longbridge-portfolio","status":"approved","author":"longbridge","authorVersion":"1.0.0","skillstoreRevision":3},"audit":{"id":"d1f7233c-5418-4c4a-a815-7bc14b9fc667","skill_id":"70ea85d5-13e5-4614-8acd-1cf6570b94e1","version":6,"content_hash":"v3:656be3040aef5c047555a908cd5c695d22a4a548:7d508d189a407fb5dd17770a5261178c19623bcfa3f1146cbfa00b952a0b2450:e325f01b21482659991e9f6f322ef99b13e5eb7e546451a585c1ea6927256f30:736b696c6c732f6c6f6e676272696467652f6c6f6e676272696467652d706f7274666f6c696f:c403a871561327c01080072fa5bb0bef","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 58 static alerts are false positives caused by Markdown formatting or ordinary financial guidance; no Ruby backtick execution, system reconnaissance, or prompt injection was found. The skill still has high-impact capabilities because it can access private brokerage data and execute real-money account changes through the Longbridge CLI or discovered MCP tools.","remediation":[{"issue":"Order and recurring-investment commands can change a brokerage account and commit real money.","severity":"high","suggestion":"Require host-enforced confirmation with an exact action preview. Disable unattended mutations and reject stale or ambiguous confirmations."},{"issue":"Account responses can contain balances, holdings, statements, and linked bank-card details.","severity":"medium","suggestion":"Request minimum permissions, redact unnecessary identifiers, avoid verbose output, and prevent account data from entering logs or unrelated prompts."},{"issue":"The MCP fallback discovers tools at runtime without a named server or command allowlist.","severity":"medium","suggestion":"Restrict fallback to a verified Longbridge MCP server and explicit read or mutation tools. Apply the same confirmation policy to every mutation."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"references/assets.md","line_end":6,"line_start":6},{"file":"references/assets.md","line_end":30,"line_start":23},{"file":"references/bank-cards.md","line_end":25,"line_start":18},{"file":"references/cash-flow.md","line_end":6,"line_start":6},{"file":"references/cash-flow.md","line_end":31,"line_start":24},{"file":"references/fund-positions.md","line_end":6,"line_start":6},{"file":"references/fund-positions.md","line_end":25,"line_start":18},{"file":"references/margin-ratio.md","line_end":6,"line_start":6},{"file":"references/margin-ratio.md","line_end":29,"line_start":22},{"file":"references/max-qty.md","line_end":6,"line_start":6},{"file":"references/max-qty.md","line_end":40,"line_start":33},{"file":"references/order.md","line_end":46,"line_start":39},{"file":"references/portfolio.md","line_end":8,"line_start":8},{"file":"references/portfolio.md","line_end":33,"line_start":26},{"file":"references/positions.md","line_end":6,"line_start":6},{"file":"references/positions.md","line_end":25,"line_start":18},{"file":"references/statement.md","line_end":6,"line_start":6},{"file":"references/statement.md","line_end":41,"line_start":34},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":66,"line_start":66},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":72,"line_start":72},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":77,"line_start":77},{"file":"SKILL.md","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":110,"line_start":110},{"file":"SKILL.md","line_end":111,"line_start":111},{"file":"SKILL.md","line_end":121,"line_start":121},{"file":"SKILL.md","line_end":122,"line_start":122},{"file":"SKILL.md","line_end":123,"line_start":123},{"file":"SKILL.md","line_end":124,"line_start":124},{"file":"SKILL.md","line_end":125,"line_start":125},{"file":"SKILL.md","line_end":138,"line_start":129}]}],"critical_findings":[],"high_findings":[{"title":"Authenticated Brokerage Transactions","locations":[{"file":"SKILL.md","line_end":80,"line_start":72},{"file":"references/order.md","line_end":16,"line_start":13},{"file":"references/dca.md","line_end":24,"line_start":20}],"confidence":0.99,"description":"The skill can buy, sell, cancel, or replace orders and create recurring purchases. Mistakes or compromised execution can cause direct financial loss.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The cited instructions explicitly authorize account mutations and recurring real-money purchases. Preview and confirmation controls reduce risk but do not remove the capability."}],"medium_findings":[{"title":"Sensitive Brokerage Data Access","locations":[{"file":"SKILL.md","line_end":80,"line_start":60},{"file":"references/assets.md","line_end":6,"line_start":3},{"file":"references/bank-cards.md","line_end":4,"line_start":1},{"file":"references/statement.md","line_end":6,"line_start":3}],"confidence":0.98,"description":"The skill reads balances, holdings, statements, and linked bank-card information from an authenticated brokerage account. Mishandling responses could expose private financial data.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The cited command descriptions explicitly retrieve account assets, statements, and bank cards. Access requires brokerage permissions, confirming the data is account-bound."},{"title":"Dynamic MCP Tool Discovery","locations":[{"file":"SKILL.md","line_end":115,"line_start":113}],"confidence":0.9,"description":"The skill directs the agent to discover MCP tools at runtime when the CLI is unavailable. No explicit server or tool allowlist is defined.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The fallback instruction explicitly requests runtime tool discovery. The surrounding skill includes account reads and financial mutations, increasing the impact of incorrect tool selection."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":20,"total_lines":1330,"audit_model":"codex","audited_at":"2026-08-08T09:47:24.458+00:00","created_at":"2026-08-08T15:00:32.983987+00:00","static_findings":[{"id":"external_commands:references/assets.md:6:ruby-shell-backtick-execution","file":"references/assets.md","pattern":"Ruby/shell backtick execution","snippet":"Returns: currency, `net_assets`, `total_cash`, `buy_power`, `max_finance_amount`, `remaining_finance","category":"external_commands","line_end":6,"severity":"medium","line_start":6},{"id":"external_commands:references/assets.md:23:ruby-shell-backtick-execution","file":"references/assets.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":30,"severity":"medium","line_start":23},{"id":"external_commands:references/bank-cards.md:18:ruby-shell-backtick-execution","file":"references/bank-cards.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":25,"severity":"medium","line_start":18},{"id":"external_commands:references/cash-flow.md:6:ruby-shell-backtick-execution","file":"references/cash-flow.md","pattern":"Ruby/shell backtick execution","snippet":"Returns: `flow_name`, symbol, `business_type`, balance, currency, `business_time`, description. Defa","category":"external_commands","line_end":6,"severity":"medium","line_start":6},{"id":"external_commands:references/cash-flow.md:24:ruby-shell-backtick-execution","file":"references/cash-flow.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":31,"severity":"medium","line_start":24},{"id":"blocker:references/dca.md:9:system-reconnaissance","file":"references/dca.md","pattern":"System reconnaissance","snippet":"- If the user did not specify the **amount**, ask. Do not default.","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:references/dca.md:10:system-reconnaissance","file":"references/dca.md","pattern":"System reconnaissance","snippet":"- If the user did not specify the **frequency** (`daily` / `weekly` / `fortnightly` / `monthly`), as","category":"blocker","line_end":10,"severity":"low","line_start":10},{"id":"blocker:references/dca.md:11:system-reconnaissance","file":"references/dca.md","pattern":"System reconnaissance","snippet":"- If the user said \"weekly\" without naming a `day-of-week`, ask.","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"blocker:references/dca.md:12:system-reconnaissance","file":"references/dca.md","pattern":"System reconnaissance","snippet":"- If the user said \"monthly\" without naming a `day-of-month`, ask.","category":"blocker","line_end":12,"severity":"low","line_start":12},{"id":"blocker:references/dca.md:13:system-reconnaissance","file":"references/dca.md","pattern":"System reconnaissance","snippet":"- If the user did not specify when to **stop** (or that the plan is open-ended), confirm explicitly.","category":"blocker","line_end":13,"severity":"low","line_start":13},{"id":"blocker:references/dca.md:22:system-reconnaissance","file":"references/dca.md","pattern":"System reconnaissance","snippet":"1. **Preview** — describe exactly what you are about to do (symbol, amount + currency, frequency, da","category":"blocker","line_end":22,"severity":"low","line_start":22},{"id":"blocker:references/dca.md:49:system-reconnaissance","file":"references/dca.md","pattern":"System reconnaissance","snippet":"If the user gives a **symbol** but no plan id for pause/resume/stop/update, first run `longbridge dc","category":"blocker","line_end":49,"severity":"low","line_start":49},{"id":"blocker:references/dca.md:85:system-reconnaissance","file":"references/dca.md","pattern":"System reconnaissance","snippet":"For pause / resume / stop / update — list plan id + symbol + amount + frequency + new state, then as","category":"blocker","line_end":85,"severity":"low","line_start":85},{"id":"external_commands:references/fund-positions.md:6:ruby-shell-backtick-execution","file":"references/fund-positions.md","pattern":"Ruby/shell backtick execution","snippet":"Returns: symbol, name, `current_net_asset_value`, `cost_net_asset_value`, currency, `holding_units`.","category":"external_commands","line_end":6,"severity":"medium","line_start":6},{"id":"external_commands:references/fund-positions.md:18:ruby-shell-backtick-execution","file":"references/fund-positions.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":25,"severity":"medium","line_start":18},{"id":"external_commands:references/margin-ratio.md:6:ruby-shell-backtick-execution","file":"references/margin-ratio.md","pattern":"Ruby/shell backtick execution","snippet":"Returns: `im_factor` (initial), `mm_factor` (maintenance), `fm_factor` (forced liquidation). Example","category":"external_commands","line_end":6,"severity":"medium","line_start":6},{"id":"external_commands:references/margin-ratio.md:22:ruby-shell-backtick-execution","file":"references/margin-ratio.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":29,"severity":"medium","line_start":22},{"id":"external_commands:references/max-qty.md:6:ruby-shell-backtick-execution","file":"references/max-qty.md","pattern":"Ruby/shell backtick execution","snippet":"Returns: `cash_max_qty` (cash only), `margin_max_qty` (with margin financing). Example: longbridge m","category":"external_commands","line_end":6,"severity":"medium","line_start":6},{"id":"external_commands:references/max-qty.md:33:ruby-shell-backtick-execution","file":"references/max-qty.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":40,"severity":"medium","line_start":33},{"id":"external_commands:references/order.md:39:ruby-shell-backtick-execution","file":"references/order.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":46,"severity":"medium","line_start":39},{"id":"blocker:references/performance-attribution.md:3:system-reconnaissance","file":"references/performance-attribution.md","pattern":"System reconnaissance","snippet":"Decomposes a portfolio's return into attributable components using Brinson-Hood-Beebower sector attr","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"external_commands:references/portfolio.md:8:ruby-shell-backtick-execution","file":"references/portfolio.md","pattern":"Ruby/shell backtick execution","snippet":"Returns: overview (`total_asset`, `market_cap`, `total_cash`, `total_pl`, `total_today_pl`, `margin_","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:references/portfolio.md:26:ruby-shell-backtick-execution","file":"references/portfolio.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":33,"severity":"medium","line_start":26},{"id":"external_commands:references/positions.md:6:ruby-shell-backtick-execution","file":"references/positions.md","pattern":"Ruby/shell backtick execution","snippet":"Returns: symbol, name, quantity, `available_quantity`, `cost_price`, currency, market. Example: long","category":"external_commands","line_end":6,"severity":"medium","line_start":6},{"id":"external_commands:references/positions.md:18:ruby-shell-backtick-execution","file":"references/positions.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":25,"severity":"medium","line_start":18},{"id":"blocker:references/profit-analysis.md:68:system-reconnaissance","file":"references/profit-analysis.md","pattern":"System reconnaissance","snippet":"| Invalid date range               | 日期格式须为 YYYY-MM-DD,开始日期须早于结束日期   | 日期格式須為 YYYY-MM-DD,開始日期須早於結束日期","category":"blocker","line_end":68,"severity":"low","line_start":68},{"id":"external_commands:references/statement.md:6:ruby-shell-backtick-execution","file":"references/statement.md","pattern":"Ruby/shell backtick execution","snippet":"Without a subcommand, lists available statements (equivalent to `statement list`). Example: longbrid","category":"external_commands","line_end":6,"severity":"medium","line_start":6},{"id":"external_commands:references/statement.md:34:ruby-shell-backtick-execution","file":"references/statement.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":41,"severity":"medium","line_start":34},{"id":"blocker:references/tax-harvesting.md:45:system-reconnaissance","file":"references/tax-harvesting.md","pattern":"System reconnaissance","snippet":"When suggesting substitutes to avoid wash-sale, recommend securities that are economically similar b","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **ChatGPT usage**: If you are using this skill inside ChatGPT, type `@longbridge` to connect — Lon","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run `longbridge <cmd> --help` for current flags and output fields.","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `assets` — account net assets, cash, buying power, margin breakdown","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `cash-flow` — cash flow records (deposits, withdrawals, dividends)","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `portfolio` — total assets, P&L, holdings, intraday P&L","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `positions` — current stock positions across all sub-accounts 🔐","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `fund-positions` — current fund positions across all sub-accounts 🔐","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `margin-ratio` — margin ratio requirements for a symbol","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `max-qty` — estimated max buy or sell quantity","category":"external_commands","line_end":66,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `profit-analysis` — profit and loss analysis","category":"external_commands","line_end":67,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `statement` — download and export account statements (daily/monthly)","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `bank-cards` — list bank cards for the current account","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `withdrawals` — withdrawal history 🔐","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `deposits` — deposit history 🔐","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `order` — list, detail, buy, sell, cancel, replace orders 🔐 ⚠️ mutating","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `dca` — recurring investment: list, create, pause, resume, cancel 🔐 ⚠️ mutating","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `margin-ratio`, `max-qty`: Public — no login required","category":"external_commands","line_end":77,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `assets`, `cash-flow`, `portfolio`, `profit-analysis`: 🔐 Requires Quote permission","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `positions`, `fund-positions`, `statement`, `bank-cards`, `withdrawals`, `deposits`: 🔐 Requires T","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `order`, `dca` (mutating operations): 🔐 Requires Trade permission — **always present a preview be","category":"external_commands","line_end":80,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `command not found: longbridge` | Install longbridge-terminal |","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `not logged in` / `unauthorized` | Run `longbridge auth login`; tick Trade permission |","category":"external_commands","line_end":110,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `order` / `dca` mutation | Always preview plan first; wait for user confirmation before executing ","category":"external_commands","line_end":111,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Real-time market quotes | `longbridge-market-data` |","category":"external_commands","line_end":121,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Fundamental analysis | `longbridge-fundamentals` |","category":"external_commands","line_end":122,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Watchlist management | `longbridge-watchlist` |","category":"external_commands","line_end":123,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Institutional** shareholders / fund holders (not my account) | `longbridge-research` |","category":"external_commands","line_end":124,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| IPO subscription orders | `longbridge-market-data` (ipo command) |","category":"external_commands","line_end":125,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":138,"severity":"medium","line_start":129}],"finding_verdicts":[{"id":"external_commands:references/assets.md:6:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/assets.md:23:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in CLI help text. No Ruby or shell command substitution occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/bank-cards.md:18:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in CLI help text. No Ruby or shell command substitution occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/cash-flow.md:6:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/cash-flow.md:24:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in CLI help text. No Ruby or shell command substitution occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/dca.md:9:system-reconnaissance","reason":"This prose requires missing transaction details, previews, or explicit confirmation. It does not inspect the host system or collect system reconnaissance data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/dca.md:10:system-reconnaissance","reason":"This prose requires missing transaction details, previews, or explicit confirmation. It does not inspect the host system or collect system reconnaissance data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/dca.md:11:system-reconnaissance","reason":"This prose requires missing transaction details, previews, or explicit confirmation. It does not inspect the host system or collect system reconnaissance data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/dca.md:12:system-reconnaissance","reason":"This prose requires missing transaction details, previews, or explicit confirmation. It does not inspect the host system or collect system reconnaissance data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/dca.md:13:system-reconnaissance","reason":"This prose requires missing transaction details, previews, or explicit confirmation. It does not inspect the host system or collect system reconnaissance data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/dca.md:22:system-reconnaissance","reason":"This prose requires missing transaction details, previews, or explicit confirmation. It does not inspect the host system or collect system reconnaissance data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/dca.md:49:system-reconnaissance","reason":"This instruction performs a scoped Longbridge plan lookup by symbol. It queries an authorized brokerage resource, not host or operating-system reconnaissance.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/dca.md:85:system-reconnaissance","reason":"This prose requires missing transaction details, previews, or explicit confirmation. It does not inspect the host system or collect system reconnaissance data.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/fund-positions.md:6:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/fund-positions.md:18:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in CLI help text. No Ruby or shell command substitution occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/margin-ratio.md:6:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/margin-ratio.md:22:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in CLI help text. No Ruby or shell command substitution occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/max-qty.md:6:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/max-qty.md:33:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in CLI help text. No Ruby or shell command substitution occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/order.md:39:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in CLI help text. No Ruby or shell command substitution occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/performance-attribution.md:3:system-reconnaissance","reason":"The matched text is ordinary portfolio-analysis guidance or validation text. It contains no host discovery, environment inspection, or system reconnaissance behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/portfolio.md:8:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/portfolio.md:26:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in CLI help text. No Ruby or shell command substitution occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/positions.md:6:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/positions.md:18:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in CLI help text. No Ruby or shell command substitution occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/profit-analysis.md:68:system-reconnaissance","reason":"The matched text is ordinary portfolio-analysis guidance or validation text. It contains no host discovery, environment inspection, or system reconnaissance behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/statement.md:6:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/statement.md:34:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in CLI help text. No Ruby or shell command substitution occurs at this location.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tax-harvesting.md:45:system-reconnaissance","reason":"The matched text is ordinary portfolio-analysis guidance or validation text. It contains no host discovery, environment inspection, or system reconnaissance behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The backticks format an expected Longbridge CLI command in Markdown. This is not Ruby or shell backtick execution, and no untrusted shell interpolation appears.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"The backticks format an expected Longbridge CLI command in Markdown. This is not Ruby or shell backtick execution, and no untrusted shell interpolation appears.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The backticks format a field name, command name, or status text in Markdown. No executable Ruby or shell construct appears at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The matched backticks open a Markdown code fence. They do not invoke Ruby, a shell, or any external process.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Authenticated Brokerage Transactions","severity":"high","locations":[{"file":"SKILL.md","line_end":80,"line_start":72},{"file":"references/order.md","line_end":16,"line_start":13},{"file":"references/dca.md","line_end":24,"line_start":20}],"confidence":0.99,"description":"The skill can buy, sell, cancel, or replace orders and create recurring purchases. Mistakes or compromised execution can cause direct financial loss.","confidence_reasoning":"The cited instructions explicitly authorize account mutations and recurring real-money purchases. Preview and confirmation controls reduce risk but do not remove the capability."},{"title":"Sensitive Brokerage Data Access","severity":"medium","locations":[{"file":"SKILL.md","line_end":80,"line_start":60},{"file":"references/assets.md","line_end":6,"line_start":3},{"file":"references/bank-cards.md","line_end":4,"line_start":1},{"file":"references/statement.md","line_end":6,"line_start":3}],"confidence":0.98,"description":"The skill reads balances, holdings, statements, and linked bank-card information from an authenticated brokerage account. Mishandling responses could expose private financial data.","confidence_reasoning":"The cited command descriptions explicitly retrieve account assets, statements, and bank cards. Access requires brokerage permissions, confirming the data is account-bound."},{"title":"Dynamic MCP Tool Discovery","severity":"medium","locations":[{"file":"SKILL.md","line_end":115,"line_start":113}],"confidence":0.9,"description":"The skill directs the agent to discover MCP tools at runtime when the CLI is unavailable. No explicit server or tool allowlist is defined.","confidence_reasoning":"The fallback instruction explicitly requests runtime tool discovery. The surrounding skill includes account reads and financial mutations, increasing the impact of incorrect tool selection."}],"subject_marketplace_commit_sha":"656be3040aef5c047555a908cd5c695d22a4a548","subject_content_hash":"7d508d189a407fb5dd17770a5261178c19623bcfa3f1146cbfa00b952a0b2450","subject_tree_hash":"e325f01b21482659991e9f6f322ef99b13e5eb7e546451a585c1ea6927256f30","subject_plugin_path":"skills/longbridge/longbridge-portfolio","audit_payload_hash":"c403a871561327c01080072fa5bb0bef","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"656be3040aef5c047555a908cd5c695d22a4a548","contentHash":"7d508d189a407fb5dd17770a5261178c19623bcfa3f1146cbfa00b952a0b2450","treeHash":"e325f01b21482659991e9f6f322ef99b13e5eb7e546451a585c1ea6927256f30","pluginPath":"skills/longbridge/longbridge-portfolio","auditPayloadHash":"c403a871561327c01080072fa5bb0bef"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/longbridge-longbridge-portfolio/audits/6/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":3,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}