{"data":{"skill":{"slug":"longbridge-longbridge-technical","name":"longbridge-technical","icon":"📦","repo":"https://github.com/longbridge/skills/tree/main/skills/longbridge-technical","status":"approved","author":"longbridge","authorVersion":"1.0.0","skillstoreRevision":3},"audit":{"id":"8c0763d6-2a81-4ff1-863f-97ca0f4958f9","skill_id":"5b873e12-a94a-4510-acf6-bdfe96bf997c","version":6,"content_hash":"v3:656be3040aef5c047555a908cd5c695d22a4a548:fa6167e690b4a72110fee47a118dbd02f2e392c9c395ed8f6410060ce0ccfe4a:ec712b4221007a699f2ff9820ecb1fbd14402a8232fa4372ba77d88caef81a39:736b696c6c732f6c6f6e676272696467652f6c6f6e676272696467652d746563686e6963616c:12093a2ee4761e4a83a854ee9ccc5d08","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most alerts are false positives from Markdown backticks, calculations, multilingual text, and conventional device redirection. Package installation and predictable temporary paths present genuine risks. Missing relative scripts and unquoted symbol placeholders add command-execution exposure.","remediation":[{"issue":"Predictable shared temporary file paths permit tampering, data disclosure, or symlink attacks.","severity":"medium","suggestion":"Create unique temporary files with restrictive permissions and delete them after analysis."},{"issue":"Unpinned pip installation instructions expose users to dependency and package-index compromise.","severity":"medium","suggestion":"Declare reviewed, pinned dependencies with hashes and require explicit approval before installation."},{"issue":"The skill executes a relative signal engine that is absent from the package.","severity":"high","suggestion":"Bundle and review the script, verify its integrity, and resolve it from the trusted skill directory."},{"issue":"Shell examples interpolate symbols without validation or quoting.","severity":"high","suggestion":"Allow only documented symbol characters and pass values as separate process arguments."}],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"references/elliott-wave.md","line_end":31,"line_start":31},{"file":"references/elliott-wave.md","line_end":55,"line_start":55},{"file":"references/elliott-wave.md","line_end":280,"line_start":280},{"file":"references/turtle-signal.md","line_end":27,"line_start":27},{"file":"references/turtle-signal.md","line_end":31,"line_start":31}]},{"factor":"env_access","evidence":[{"file":"references/elliott-wave.md","line_end":66,"line_start":66},{"file":"references/elliott-wave.md","line_end":78,"line_start":78},{"file":"references/elliott-wave.md","line_end":166,"line_start":166},{"file":"references/elliott-wave.md","line_end":245,"line_start":245}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":38,"line_start":36},{"file":"SKILL.md","line_end":40,"line_start":38},{"file":"SKILL.md","line_end":42,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":81,"line_start":44},{"file":"SKILL.md","line_end":84,"line_start":81},{"file":"SKILL.md","line_end":91,"line_start":84},{"file":"SKILL.md","line_end":97,"line_start":91},{"file":"SKILL.md","line_end":98,"line_start":97},{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":99,"line_start":99},{"file":"SKILL.md","line_end":110,"line_start":100},{"file":"SKILL.md","line_end":111,"line_start":110},{"file":"SKILL.md","line_end":112,"line_start":111},{"file":"SKILL.md","line_end":116,"line_start":112},{"file":"SKILL.md","line_end":123,"line_start":116}]}],"critical_findings":[],"high_findings":[{"title":"Unvalidated Symbol Interpolation in Shell Commands","locations":[{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"references/turtle-signal.md","line_end":31,"line_start":31}],"confidence":0.82,"description":"Shell examples place user-supplied symbols directly into commands without validation or quoting. Metacharacters could alter commands when substituted verbatim.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The command templates visibly interpolate symbol placeholders without quoting or an allowlist. Exploitation depends on verbatim shell construction from untrusted input."},{"title":"Missing Relative Script Creates Path-Hijack Risk","locations":[{"file":"references/elliott-wave.md","line_end":55,"line_start":52},{"file":"references/elliott-wave.md","line_end":280,"line_start":275}],"confidence":0.96,"description":"The skill directs execution of scripts/signal_engine.py, but the package contains no script. A same-named working-directory file could execute without provenance.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The documented command executes a relative Python path, while the complete package tree has no scripts directory. This directly enables unintended local code execution."}],"medium_findings":[{"title":"Temp directory access","locations":[{"file":"references/elliott-wave.md","line_end":31,"line_start":31}],"confidence":0.95,"description":"- Always redirect CLI output to a temp file (e.g. `/tmp/kline_day.json`) — the CLI may","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The skill mandates a predictable shared temporary path. Another local process could replace or read this file before analysis."},{"title":"Temp directory access","locations":[{"file":"references/elliott-wave.md","line_end":55,"line_start":55}],"confidence":0.94,"description":"python3 scripts/signal_engine.py --kline /tmp/kline_day.json --symbol SYMBOL","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The analysis script reads a fixed file under /tmp. Predictable names permit input tampering and symlink attacks."},{"title":"Temp directory access","locations":[{"file":"references/elliott-wave.md","line_end":280,"line_start":280}],"confidence":0.94,"description":"python3 scripts/signal_engine.py --kline /tmp/kline_day.json --symbol AAPL.US","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"This command reads market data from the same predictable shared path. The file lacks uniqueness, ownership checks, and integrity validation."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":84,"line_start":81}],"confidence":0.93,"description":"Auto-detect fractal (分型), bi (笔), zhongshu (中枢), buy/sell signals (1/2/3 buy). Requires `pip install","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill directs users to install czsc with pip. Package installation can execute build hooks and introduces supply-chain risk."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":91,"line_start":84}],"confidence":0.93,"description":"BOS (Break of Structure), ChoCH, FVG (Fair Value Gap), Order Block detection. Requires `pip install ","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill directs installation of smartmoneyconcepts. Unpinned Python packages can execute installation code and change the environment."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":98,"line_start":98}],"confidence":0.95,"description":"| `ModuleNotFoundError: czsc` | Run `pip install czsc` before using Chan Theory |","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This line explicitly instructs pip to install an unpinned third-party package. Installation may execute package-controlled code."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":99,"line_start":99}],"confidence":0.95,"description":"| `ModuleNotFoundError: smartmoneyconcepts` | Run `pip install smartmoneyconcepts` before using SMC ","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This line explicitly instructs pip to install smartmoneyconcepts without a version or hash. That creates supply-chain exposure."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":10,"total_lines":1737,"audit_model":"codex","audited_at":"2026-08-08T10:01:45.899+00:00","created_at":"2026-08-08T15:01:03.474322+00:00","static_findings":[{"id":"filesystem:references/elliott-wave.md:31:temp-directory-access","file":"references/elliott-wave.md","pattern":"Temp directory access","snippet":"- Always redirect CLI output to a temp file (e.g. `/tmp/kline_day.json`) — the CLI may","category":"filesystem","line_end":31,"severity":"medium","line_start":31},{"id":"filesystem:references/elliott-wave.md:55:temp-directory-access","file":"references/elliott-wave.md","pattern":"Temp directory access","snippet":"python3 scripts/signal_engine.py --kline /tmp/kline_day.json --symbol SYMBOL","category":"filesystem","line_end":55,"severity":"medium","line_start":55},{"id":"filesystem:references/elliott-wave.md:280:temp-directory-access","file":"references/elliott-wave.md","pattern":"Temp directory access","snippet":"python3 scripts/signal_engine.py --kline /tmp/kline_day.json --symbol AAPL.US","category":"filesystem","line_end":280,"severity":"medium","line_start":280},{"id":"env_access:references/elliott-wave.md:66:configuration-library","file":"references/elliott-wave.md","pattern":"Configuration library","snippet":"**If `agreed` is false → output \"结构待确认 / Structure Unconfirmed\", do not force a stage label.**","category":"env_access","line_end":66,"severity":"low","line_start":66},{"id":"env_access:references/elliott-wave.md:78:configuration-library","file":"references/elliott-wave.md","pattern":"Configuration library","snippet":"| `unconfirmed`    | 结构待确认      | 結構待確認      | Structure Unconfirmed |","category":"env_access","line_end":78,"severity":"low","line_start":78},{"id":"env_access:references/elliott-wave.md:166:configuration-library","file":"references/elliott-wave.md","pattern":"Configuration library","snippet":"- Para 3 (if unconfirmed): Explain what would resolve the ambiguity.","category":"env_access","line_end":166,"severity":"low","line_start":166},{"id":"env_access:references/elliott-wave.md:245:configuration-library","file":"references/elliott-wave.md","pattern":"Configuration library","snippet":"- **ASCII wave diagram**: include when `agreed: true`; omit when `unconfirmed`.","category":"env_access","line_end":245,"severity":"low","line_start":245},{"id":"blocker:references/elliott-wave.md:23:system-reconnaissance","file":"references/elliott-wave.md","pattern":"System reconnaissance","snippet":"Not all ticker-like strings are valid on Longbridge — **index codes (e.g. SPX, HSI) are","category":"blocker","line_end":23,"severity":"low","line_start":23},{"id":"blocker:references/elliott-wave.md:24:system-reconnaissance","file":"references/elliott-wave.md","pattern":"System reconnaissance","snippet":"not tradable securities and will return `invalid symbol`.** When you need broad-market","category":"blocker","line_end":24,"severity":"low","line_start":24},{"id":"blocker:references/elliott-wave.md:104:system-reconnaissance","file":"references/elliott-wave.md","pattern":"System reconnaissance","snippet":"already. **Index codes are not valid symbols on Longbridge** — use tracking ETFs instead","category":"blocker","line_end":104,"severity":"low","line_start":104},{"id":"blocker:references/elliott-wave.md:163:system-reconnaissance","file":"references/elliott-wave.md","pattern":"System reconnaissance","snippet":"matches the identified stage. Avoid jargon — translate wave numbers to meaning.","category":"blocker","line_end":163,"severity":"low","line_start":163},{"id":"blocker:references/technical.md:63:system-reconnaissance","file":"references/technical.md","pattern":"System reconnaissance","snippet":"mid = df[\"c\"].rolling(20).mean(); std = df[\"c\"].rolling(20).std()","category":"blocker","line_end":63,"severity":"low","line_start":63},{"id":"blocker:references/technical.md:64:system-reconnaissance","file":"references/technical.md","pattern":"System reconnaissance","snippet":"upper_bb = mid + 2*std; lower_bb = mid - 2*std","category":"blocker","line_end":64,"severity":"low","line_start":64},{"id":"filesystem:references/turtle-signal.md:27:standard-device-file-access","file":"references/turtle-signal.md","pattern":"Standard device file access","snippet":"**⚠️ CRITICAL: Always use `2>/dev/null` not `2>&1`**","category":"filesystem","line_end":27,"severity":"low","line_start":27},{"id":"filesystem:references/turtle-signal.md:31:standard-device-file-access","file":"references/turtle-signal.md","pattern":"Standard device file access","snippet":"longbridge kline SYMBOL --period day --count 60 --format json 2>/dev/null | python3 -c \"...\"","category":"filesystem","line_end":31,"severity":"low","line_start":31},{"id":"blocker:references/turtle-signal.md:8:system-reconnaissance","file":"references/turtle-signal.md","pattern":"System reconnaissance","snippet":"# ✅ CORRECT — handle empty/invalid output before parsing","category":"blocker","line_end":8,"severity":"low","line_start":8},{"id":"blocker:references/turtle-signal.md:597:system-reconnaissance","file":"references/turtle-signal.md","pattern":"System reconnaissance","snippet":"- 模拟账户与真实账户的切换在 Longbridge 平台侧完成(通过不同 client_id 登录),CLI 层面使用当前登录的账户","category":"blocker","line_end":597,"severity":"low","line_start":597},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **ChatGPT usage**: If you are using this skill inside ChatGPT, type `@longbridge` to connect — Lon","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":38,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":40,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `longbridge kline --help` for period and date-range options.","category":"external_commands","line_end":42,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **If `longbridge` CLI is installed** (via `longbridge-market-data` or standalone): run the command","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **If neither is available**: tell the user to install `longbridge-terminal` first, then re-run.","category":"external_commands","line_end":81,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Auto-detect fractal (分型), bi (笔), zhongshu (中枢), buy/sell signals (1/2/3 buy). Requires `pip install","category":"external_commands","line_end":84,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"BOS (Break of Structure), ChoCH, FVG (Fair Value Gap), Order Block detection. Requires `pip install ","category":"external_commands","line_end":91,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"All frameworks are analytical — no CLI login required. Data fetching via `longbridge kline` is publi","category":"external_commands","line_end":97,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `command not found: longbridge` | Install longbridge-terminal first; use to fetch kline data |","category":"external_commands","line_end":98,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `ModuleNotFoundError: czsc` | Run `pip install czsc` before using Chan Theory |","category":"external_commands","line_end":98,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `ModuleNotFoundError: smartmoneyconcepts` | Run `pip install smartmoneyconcepts` before using SMC ","category":"external_commands","line_end":99,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Insufficient history | Request more periods with `--count` or wider date range |","category":"external_commands","line_end":110,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Raw K-line / quote data | `longbridge-market-data` |","category":"external_commands","line_end":111,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Options Greeks / IV | `longbridge-derivatives` |","category":"external_commands","line_end":112,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Quantitative strategies | `longbridge-quant` |","category":"external_commands","line_end":116,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":123,"severity":"medium","line_start":116},{"id":"obfuscation:references/turtle-signal.md:1:heuristic-high-file-entropy-6-26-bits-possible-b","file":"references/turtle-signal.md","pattern":"[HEURISTIC] High file entropy (6.26 bits) - possible binary/encrypted content","snippet":"File: references/turtle-signal.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"filesystem:references/elliott-wave.md:31:temp-directory-access","reason":"The skill mandates a predictable shared temporary path. Another local process could replace or read this file before analysis.","verdict":"confirmed","severity":"medium","confidence":0.95},{"id":"filesystem:references/elliott-wave.md:55:temp-directory-access","reason":"The analysis script reads a fixed file under /tmp. Predictable names permit input tampering and symlink attacks.","verdict":"confirmed","severity":"medium","confidence":0.94},{"id":"filesystem:references/elliott-wave.md:280:temp-directory-access","reason":"This command reads market data from the same predictable shared path. The file lacks uniqueness, ownership checks, and integrity validation.","verdict":"confirmed","severity":"medium","confidence":0.94},{"id":"env_access:references/elliott-wave.md:66:configuration-library","reason":"The line discusses an unconfirmed analysis state. It does not access environment variables or a configuration library.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/elliott-wave.md:78:configuration-library","reason":"This is a translation table entry for Structure Unconfirmed. No configuration or environment access occurs.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/elliott-wave.md:166:configuration-library","reason":"The line explains how to describe analytical ambiguity. It contains no environment lookup or configuration operation.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/elliott-wave.md:245:configuration-library","reason":"The line controls whether an ASCII diagram appears. It does not read configuration data or environment variables.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/elliott-wave.md:23:system-reconnaissance","reason":"The text explains valid financial symbols and index limitations. It performs no host or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/elliott-wave.md:24:system-reconnaissance","reason":"The invalid-symbol message describes expected Longbridge behavior. It does not enumerate system details.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/elliott-wave.md:104:system-reconnaissance","reason":"The line recommends tracking ETFs because index codes are unsupported. This is market-data guidance, not system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/elliott-wave.md:163:system-reconnaissance","reason":"This output-writing guidance asks for plain language. It contains no discovery command or system inspection.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/technical.md:63:system-reconnaissance","reason":"The code calculates a rolling mean and standard deviation for Bollinger Bands. It does not inspect the system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/technical.md:64:system-reconnaissance","reason":"The code derives upper and lower Bollinger Bands from local numeric data. No reconnaissance occurs.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/turtle-signal.md:27:standard-device-file-access","reason":"Redirecting stderr to /dev/null is a conventional output sink. It neither reads sensitive device data nor modifies a device.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/turtle-signal.md:31:standard-device-file-access","reason":"The command only discards stderr through /dev/null before parsing stdout. Symbol interpolation risk is assessed separately.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/turtle-signal.md:8:system-reconnaissance","reason":"This comment labels defensive JSON parsing as correct. It does not inspect system properties.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/turtle-signal.md:597:system-reconnaissance","reason":"The line explains that the CLI uses the currently authenticated account. It does not discover credentials or system configuration.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks are Markdown around a ChatGPT plugin mention. They do not execute Ruby or shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"This line opens a fenced Bash example. Markdown fencing is not Ruby backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"This line closes the fenced command example. It contains no executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The fixed help command is documented inside Markdown. It accepts no user-controlled argument and has no Ruby backtick semantics.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The line conditionally references a read-only market-data CLI. The separate semantic finding covers unsafe symbol substitution.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The package name is inline Markdown within installation guidance. This line contains no executable command.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The skill directs users to install czsc with pip. Package installation can execute build hooks and introduces supply-chain risk.","verdict":"confirmed","severity":"medium","confidence":0.93},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The skill directs installation of smartmoneyconcepts. Unpinned Python packages can execute installation code and change the environment.","verdict":"confirmed","severity":"medium","confidence":0.93},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The line describes public market-data access using inline Markdown. It neither executes a command nor exposes authentication data.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"This troubleshooting row recommends manual installation but provides no command. The backticks only format an error message.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"This line explicitly instructs pip to install an unpinned third-party package. Installation may execute package-controlled code.","verdict":"confirmed","severity":"medium","confidence":0.95},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"This line explicitly instructs pip to install smartmoneyconcepts without a version or hash. That creates supply-chain exposure.","verdict":"confirmed","severity":"medium","confidence":0.95},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"The line describes a count option in troubleshooting text. Markdown backticks do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"This is a related skill name formatted with Markdown. No command execution is requested.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"This is a related derivatives skill name in a table. It is not shell or Ruby syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"This is a related quantitative skill name in a table. It does not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"This line opens a plain text file-tree fence. It is Markdown formatting, not executable code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/turtle-signal.md:1:heuristic-high-file-entropy-6-26-bits-possible-b","reason":"The file is coherent UTF-8 Markdown with extensive Chinese text, tables, and examples. No encoded or binary payload is present.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Unvalidated Symbol Interpolation in Shell Commands","severity":"high","locations":[{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"references/turtle-signal.md","line_end":31,"line_start":31}],"confidence":0.82,"description":"Shell examples place user-supplied symbols directly into commands without validation or quoting. Metacharacters could alter commands when substituted verbatim.","confidence_reasoning":"The command templates visibly interpolate symbol placeholders without quoting or an allowlist. Exploitation depends on verbatim shell construction from untrusted input."},{"title":"Missing Relative Script Creates Path-Hijack Risk","severity":"high","locations":[{"file":"references/elliott-wave.md","line_end":55,"line_start":52},{"file":"references/elliott-wave.md","line_end":280,"line_start":275}],"confidence":0.96,"description":"The skill directs execution of scripts/signal_engine.py, but the package contains no script. A same-named working-directory file could execute without provenance.","confidence_reasoning":"The documented command executes a relative Python path, while the complete package tree has no scripts directory. This directly enables unintended local code execution."}],"subject_marketplace_commit_sha":"656be3040aef5c047555a908cd5c695d22a4a548","subject_content_hash":"fa6167e690b4a72110fee47a118dbd02f2e392c9c395ed8f6410060ce0ccfe4a","subject_tree_hash":"ec712b4221007a699f2ff9820ecb1fbd14402a8232fa4372ba77d88caef81a39","subject_plugin_path":"skills/longbridge/longbridge-technical","audit_payload_hash":"12093a2ee4761e4a83a854ee9ccc5d08","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"656be3040aef5c047555a908cd5c695d22a4a548","contentHash":"fa6167e690b4a72110fee47a118dbd02f2e392c9c395ed8f6410060ce0ccfe4a","treeHash":"ec712b4221007a699f2ff9820ecb1fbd14402a8232fa4372ba77d88caef81a39","pluginPath":"skills/longbridge/longbridge-technical","auditPayloadHash":"12093a2ee4761e4a83a854ee9ccc5d08"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/longbridge-longbridge-technical/audits/6/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":2,"capabilityReviewCount":7,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}