{"data":{"skill":{"slug":"longbridge-longbridge-research","name":"longbridge-research","icon":"📦","repo":"https://github.com/longbridge/skills/tree/main/skills/longbridge-research","status":"approved","author":"longbridge","authorVersion":"1.0.0","skillstoreRevision":3},"audit":{"id":"129948c2-ac94-4975-a0eb-d0af0cb2d2ac","skill_id":"b4f92552-ddd8-416d-877d-a63ccedb3497","version":6,"content_hash":"v3:656be3040aef5c047555a908cd5c695d22a4a548:b806365d1988f72dfdde947dbdc00f203f441e61c21f02ba1f9c561ca31be217:fce3a2ee7b4c9088924e106e7331dccbbc4adb351b5a14b84eb7af7b893f3e9c:736b696c6c732f6c6f6e676272696467652f6c6f6e676272696467652d7265736561726368:7f3987afc580ca79a9148219e1b60d8a","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 46 static alerts are false positives caused by Markdown formatting, CLI documentation, or ordinary prose. No shell backtick execution, reconnaissance, prompt injection, or exfiltration intent was found. However, the finance-calendar workflow accesses private portfolio data despite metadata stating that login is unnecessary.","remediation":[{"issue":"Portfolio access is inconsistent with the declared login requirement.","severity":"medium","suggestion":"Declare account authorization and portfolio access in metadata, then request explicit user approval before reading holdings or watchlists."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"references/forecast-eps.md","line_end":29,"line_start":22},{"file":"references/fund-holder.md","line_end":34,"line_start":27},{"file":"references/industry-peers.md","line_end":8,"line_start":4},{"file":"references/industry-peers.md","line_end":16,"line_start":8},{"file":"references/industry-peers.md","line_end":16,"line_start":16},{"file":"references/industry-peers.md","line_end":36,"line_start":29},{"file":"references/industry-rank.md","line_end":6,"line_start":6},{"file":"references/industry-rank.md","line_end":52,"line_start":45},{"file":"references/insider-trades.md","line_end":38,"line_start":31},{"file":"references/institution-rating.md","line_end":52,"line_start":45},{"file":"references/shareholder.md","line_end":55,"line_start":6},{"file":"references/shareholder.md","line_end":62,"line_start":55},{"file":"references/short-positions.md","line_end":8,"line_start":8},{"file":"references/short-positions.md","line_end":33,"line_start":10},{"file":"references/short-positions.md","line_end":40,"line_start":33},{"file":"references/short-trades.md","line_end":8,"line_start":8},{"file":"references/short-trades.md","line_end":33,"line_start":10},{"file":"references/short-trades.md","line_end":40,"line_start":33},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":86,"line_start":86},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":90,"line_start":90},{"file":"SKILL.md","line_end":91,"line_start":91},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":139,"line_start":139},{"file":"SKILL.md","line_end":151,"line_start":151},{"file":"SKILL.md","line_end":152,"line_start":152},{"file":"SKILL.md","line_end":153,"line_start":153},{"file":"SKILL.md","line_end":169,"line_start":157}]},{"factor":"network","evidence":[{"file":"references/insider-trades.md","line_end":20,"line_start":20}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Undeclared Access to Private Portfolio Data","locations":[{"file":"SKILL.md","line_end":13,"line_start":10},{"file":"references/finance-calendar.md","line_end":20,"line_start":16},{"file":"references/finance-calendar.md","line_end":60,"line_start":54}],"confidence":0.97,"description":"SKILL.md declares that login is unnecessary, while finance-calendar requires authorization and retrieves holdings and watchlists. This can expose private investment data unexpectedly.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The metadata and workflow directly contradict each other, and the workflow explicitly requests authorized holdings and watchlist data."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":26,"total_lines":2020,"audit_model":"codex","audited_at":"2026-08-08T09:56:11.623+00:00","created_at":"2026-08-08T15:00:52.85303+00:00","static_findings":[{"id":"blocker:references/competitive-analysis.md:79:system-reconnaissance","file":"references/competitive-analysis.md","pattern":"System reconnaissance","snippet":"| Invalid symbol / `param_error`   | 请确认股票代码,如 NVDA.US                   | 請確認股票代碼 / Check symbol fo","category":"blocker","line_end":79,"severity":"low","line_start":79},{"id":"blocker:references/finance-calendar.md:41:system-reconnaissance","file":"references/finance-calendar.md","pattern":"System reconnaissance","snippet":"- **Filtering & Priority**: Prioritize high-importance events. Specific filtering strategies are det","category":"blocker","line_end":41,"severity":"low","line_start":41},{"id":"blocker:references/finance-calendar.md:131:system-reconnaissance","file":"references/finance-calendar.md","pattern":"System reconnaissance","snippet":"- Sentence length ≤ 30 words; avoid long compound sentences","category":"blocker","line_end":131,"severity":"low","line_start":131},{"id":"external_commands:references/forecast-eps.md:22:ruby-shell-backtick-execution","file":"references/forecast-eps.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":29,"severity":"medium","line_start":22},{"id":"external_commands:references/fund-holder.md:27:ruby-shell-backtick-execution","file":"references/fund-holder.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":34,"severity":"medium","line_start":27},{"id":"blocker:references/fund-holder.md:6:network-reconnaissance","file":"references/fund-holder.md","pattern":"Network reconnaissance","snippet":"Returns: fund name, ticker, currency, weight (position ratio), and report date. Pass --count -1 to r","category":"blocker","line_end":6,"severity":"low","line_start":6},{"id":"external_commands:references/industry-peers.md:4:ruby-shell-backtick-execution","file":"references/industry-peers.md","pattern":"Ruby/shell backtick execution","snippet":"Industry peer group tree for a BK `counter_id`","category":"external_commands","line_end":8,"severity":"medium","line_start":4},{"id":"external_commands:references/industry-peers.md:8:ruby-shell-backtick-execution","file":"references/industry-peers.md","pattern":"Ruby/shell backtick execution","snippet":"Use `industry-rank` to discover industry Counter IDs, then pass one here.","category":"external_commands","line_end":16,"severity":"medium","line_start":8},{"id":"external_commands:references/industry-peers.md:16:ruby-shell-backtick-execution","file":"references/industry-peers.md","pattern":"Ruby/shell backtick execution","snippet":"BK `counter_id` from `industry-rank`, e.g. BK/US/IN00258","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:references/industry-peers.md:29:ruby-shell-backtick-execution","file":"references/industry-peers.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":36,"severity":"medium","line_start":29},{"id":"external_commands:references/industry-rank.md:6:ruby-shell-backtick-execution","file":"references/industry-rank.md","pattern":"Ruby/shell backtick execution","snippet":"Returns a ranked list of industries. The \"Counter ID\" column contains BK `counter_ids` (e.g. BK/US/I","category":"external_commands","line_end":6,"severity":"medium","line_start":6},{"id":"external_commands:references/industry-rank.md:45:ruby-shell-backtick-execution","file":"references/industry-rank.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":52,"severity":"medium","line_start":45},{"id":"external_commands:references/insider-trades.md:31:ruby-shell-backtick-execution","file":"references/insider-trades.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":38,"severity":"medium","line_start":31},{"id":"network:references/insider-trades.md:20:fetch-api-call","file":"references/insider-trades.md","pattern":"Fetch API call","snippet":"Number of Form 4 filings to fetch (default: 20)","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"external_commands:references/institution-rating.md:45:ruby-shell-backtick-execution","file":"references/institution-rating.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":52,"severity":"medium","line_start":45},{"id":"external_commands:references/shareholder.md:6:ruby-shell-backtick-execution","file":"references/shareholder.md","pattern":"Ruby/shell backtick execution","snippet":"Without flags: institution list (change direction, sort). --top: Top20 major shareholders across mul","category":"external_commands","line_end":55,"severity":"medium","line_start":6},{"id":"external_commands:references/shareholder.md:55:ruby-shell-backtick-execution","file":"references/shareholder.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":62,"severity":"medium","line_start":55},{"id":"blocker:references/shareholder.md:8:system-reconnaissance","file":"references/shareholder.md","pattern":"System reconnaissance","snippet":"Example: longbridge shareholder AAPL.US Example: longbridge shareholder AAPL.US --top Example: longb","category":"blocker","line_end":8,"severity":"low","line_start":8},{"id":"blocker:references/shareholder.md:20:system-reconnaissance","file":"references/shareholder.md","pattern":"System reconnaissance","snippet":"--object-id <ID>","category":"blocker","line_end":20,"severity":"low","line_start":20},{"id":"external_commands:references/short-positions.md:8:ruby-shell-backtick-execution","file":"references/short-positions.md","pattern":"Ruby/shell backtick execution","snippet":"US: bi-weekly FINRA short interest data (`short_interest`, `rate`, `days_to_cover`, `close`). HK: da","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:references/short-positions.md:10:ruby-shell-backtick-execution","file":"references/short-positions.md","pattern":"Ruby/shell backtick execution","snippet":"For daily short sale volume (shares sold short each day), use `short-trades`.","category":"external_commands","line_end":33,"severity":"medium","line_start":10},{"id":"external_commands:references/short-positions.md:33:ruby-shell-backtick-execution","file":"references/short-positions.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":40,"severity":"medium","line_start":33},{"id":"external_commands:references/short-trades.md:8:ruby-shell-backtick-execution","file":"references/short-trades.md","pattern":"Ruby/shell backtick execution","snippet":"US: FINRA/NASDAQ daily short volume (`nus_amount`, `ny_amount`, `total_amount`, `rate`, `close`). Da","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:references/short-trades.md:10:ruby-shell-backtick-execution","file":"references/short-trades.md","pattern":"Ruby/shell backtick execution","snippet":"For total open short interest (cumulative undisclosed positions), use `short-positions`.","category":"external_commands","line_end":33,"severity":"medium","line_start":10},{"id":"external_commands:references/short-trades.md:33:ruby-shell-backtick-execution","file":"references/short-trades.md","pattern":"Ruby/shell backtick execution","snippet":"Print verbose request info (host, elapsed) to stderr, prefixed with `*` like curl -v","category":"external_commands","line_end":40,"severity":"medium","line_start":33},{"id":"blocker:references/stock-research.md:60:system-reconnaissance","file":"references/stock-research.md","pattern":"System reconnaissance","snippet":"| Invalid symbol / `param_error`   | 请确认股票代码格式,例如 NVDA.US                 | 請確認股票代碼格式 / Check symbol","category":"blocker","line_end":60,"severity":"low","line_start":60},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **ChatGPT usage**: If you are using this skill inside ChatGPT, type `@longbridge` to connect — Lon","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run `longbridge <cmd> --help` for current flags and output fields.","category":"external_commands","line_end":81,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `institution-rating` — buy/hold/sell distribution and recent rating events","category":"external_commands","line_end":83,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `forecast-eps` — forward EPS and revenue estimates by period","category":"external_commands","line_end":84,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `consensus` — consensus price target and aggregated analyst view","category":"external_commands","line_end":85,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `finance-calendar` — upcoming earnings, dividends, IPOs, macro events","category":"external_commands","line_end":86,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `shareholder` — institutional shareholders and ownership percentage","category":"external_commands","line_end":87,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `fund-holder` — funds and ETFs holding a given symbol","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `insider-trades` — SEC Form 4 insider trade history (US stocks)","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `investors` — SEC 13F institutional portfolio holdings","category":"external_commands","line_end":90,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `short-positions` — undisclosed short positions held over time","category":"external_commands","line_end":91,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `short-trades` — daily short sale volume","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `industry-rank` — industry ranking list by market and indicator","category":"external_commands","line_end":93,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `industry-peers` — industry peer group tree for a BK counter_id","category":"external_commands","line_end":94,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `command not found: longbridge` | Install longbridge-terminal |","category":"external_commands","line_end":139,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Post-earnings analysis | `longbridge-earnings` |","category":"external_commands","line_end":151,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Financial statements | `longbridge-fundamentals` |","category":"external_commands","line_end":152,"severity":"medium","line_start":152},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Morning briefing / sector intel | `longbridge-intel` |","category":"external_commands","line_end":153,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":169,"severity":"medium","line_start":157},{"id":"blocker:SKILL.md:94:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"### `industry-peers` — industry peer group tree for a BK counter_id","category":"blocker","line_end":96,"severity":"low","line_start":94}],"finding_verdicts":[{"id":"blocker:references/competitive-analysis.md:79:system-reconnaissance","reason":"The line is an invalid-symbol error response in a documentation table, with no system discovery or host inspection.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/finance-calendar.md:41:system-reconnaissance","reason":"The line describes event filtering priorities and contains no instruction to inspect a system or environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/finance-calendar.md:131:system-reconnaissance","reason":"The line is a sentence-length style rule and has no reconnaissance behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/forecast-eps.md:22:ruby-shell-backtick-execution","reason":"The backticks format an asterisk in CLI help text; they are Markdown delimiters, not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/fund-holder.md:27:ruby-shell-backtick-execution","reason":"The backticks format an asterisk in CLI help text; no shell expression or executable code is present.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/fund-holder.md:6:network-reconnaissance","reason":"The line documents returned fund-holder fields and a result-count option, not network discovery.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/industry-peers.md:4:ruby-shell-backtick-execution","reason":"The backticks mark the counter_id field name in documentation and do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/industry-peers.md:8:ruby-shell-backtick-execution","reason":"The backticks identify another Longbridge subcommand in prose; no shell backtick syntax is used.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/industry-peers.md:16:ruby-shell-backtick-execution","reason":"The inline code marks field and command names in an argument description, with no execution construct.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/industry-peers.md:29:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in copied CLI help output, not executable shell content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/industry-rank.md:6:ruby-shell-backtick-execution","reason":"The backticks format counter_ids and industry-peers as documentation identifiers; they do not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/industry-rank.md:45:ruby-shell-backtick-execution","reason":"The backticks format a literal verbose-output prefix in help text and contain no executable expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/insider-trades.md:31:ruby-shell-backtick-execution","reason":"The cited backticks are Markdown around an asterisk in CLI help text, not a shell command.","verdict":"false_positive","confidence":0.99},{"id":"network:references/insider-trades.md:20:fetch-api-call","reason":"Fetch is an ordinary verb describing a count option; the line contains no Fetch API call or URL.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/institution-rating.md:45:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in CLI help output and do not represent shell evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/shareholder.md:6:ruby-shell-backtick-execution","reason":"This is fenced CLI documentation with inline field formatting; no Ruby backtick operator or shell evaluation appears.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/shareholder.md:55:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in help text and are not an execution mechanism.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/shareholder.md:8:system-reconnaissance","reason":"The line lists shareholder command examples using public ticker symbols and does not inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/shareholder.md:20:system-reconnaissance","reason":"The line defines an object-id CLI option for shareholder records, not a system identifier discovery operation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/short-positions.md:8:ruby-shell-backtick-execution","reason":"The backticks format financial dataset field names in prose and contain no executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/short-positions.md:10:ruby-shell-backtick-execution","reason":"The backticks identify a related Longbridge subcommand in documentation and do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/short-positions.md:33:ruby-shell-backtick-execution","reason":"The cited backticks format an asterisk in CLI help output, with no shell evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/short-trades.md:8:ruby-shell-backtick-execution","reason":"The backticks mark short-volume field names as inline code and are not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/short-trades.md:10:ruby-shell-backtick-execution","reason":"The backticks identify a related command in prose; they do not perform command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/short-trades.md:33:ruby-shell-backtick-execution","reason":"The backticks format a literal asterisk in help text and contain no executable shell content.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/stock-research.md:60:system-reconnaissance","reason":"The line handles invalid ticker input and does not request system, network, or environment information.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks format the @longbridge plugin mention; it is not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The line documents a constrained Longbridge help invocation; Markdown backticks are delimiters and no untrusted shell interpolation is shown.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The backticks format a subcommand heading and do not execute the named command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The backticks format a subcommand heading and contain no shell expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The backticks mark the consensus command name as inline code, not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The backticks format the finance-calendar command heading and do not invoke it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The backticks format the shareholder command heading and are ordinary Markdown.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The backticks format the fund-holder command heading and contain no executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The backticks format the insider-trades command heading and do not perform shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The backticks identify the investors command in a heading; they are not an execution operator.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The backticks format the short-positions command heading and contain no executable shell content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The backticks format the short-trades command heading and do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"The backticks mark the industry-rank subcommand name as inline code, not shell evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The backticks format the industry-peers command heading and are not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","reason":"The inline text is a documented error message in a table, not a command being executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The backticks format a related skill name and do not invoke a process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","reason":"The backticks format a related skill name and contain no executable shell expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"The backticks format a related skill name and do not cause command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"The cited characters open a fenced Markdown file-layout block and are not Ruby or shell backticks.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:94:system-reconnaissance","reason":"The line describes an industry peer-group command and does not inspect local system properties.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Undeclared Access to Private Portfolio Data","severity":"medium","locations":[{"file":"SKILL.md","line_end":13,"line_start":10},{"file":"references/finance-calendar.md","line_end":20,"line_start":16},{"file":"references/finance-calendar.md","line_end":60,"line_start":54}],"confidence":0.97,"description":"SKILL.md declares that login is unnecessary, while finance-calendar requires authorization and retrieves holdings and watchlists. This can expose private investment data unexpectedly.","confidence_reasoning":"The metadata and workflow directly contradict each other, and the workflow explicitly requests authorized holdings and watchlist data."}],"subject_marketplace_commit_sha":"656be3040aef5c047555a908cd5c695d22a4a548","subject_content_hash":"b806365d1988f72dfdde947dbdc00f203f441e61c21f02ba1f9c561ca31be217","subject_tree_hash":"fce3a2ee7b4c9088924e106e7331dccbbc4adb351b5a14b84eb7af7b893f3e9c","subject_plugin_path":"skills/longbridge/longbridge-research","audit_payload_hash":"7f3987afc580ca79a9148219e1b60d8a","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"656be3040aef5c047555a908cd5c695d22a4a548","contentHash":"b806365d1988f72dfdde947dbdc00f203f441e61c21f02ba1f9c561ca31be217","treeHash":"fce3a2ee7b4c9088924e106e7331dccbbc4adb351b5a14b84eb7af7b893f3e9c","pluginPath":"skills/longbridge/longbridge-research","auditPayloadHash":"7f3987afc580ca79a9148219e1b60d8a"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/longbridge-longbridge-research/audits/6/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}