{"data":{"skill":{"slug":"majichuan-sheet-to-report","name":"sheet-to-report","icon":"📦","repo":"https://github.com/majichuan/sheet-to-report/tree/0765d50e265538f4e457cfa114d2418c5d160774/","status":"approved","author":"majichuan","authorVersion":"0.2.2","skillstoreRevision":1},"audit":{"id":"0dae2359-76a0-4365-ae4a-8c0c709f4b35","skill_id":"93d06628-9847-4470-9120-8e4ec95d0f7c","version":1,"content_hash":"v3:688a18e807d4a4aeba23c932e29b45ad183df408:26d60c39d8b38afb074a90af0bec05eb5b7615cf8f456f0f33fc70f0e0184e42:df98c430159e88442e2d30ffba06638d8ace35538b5eee8112a460b9d0e79a79:736b696c6c732f6d616a69636875616e2f73686565742d746f2d7265706f7274:4c63ab827fcb626c7b5cfe181c950015","risk_level":"safe","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 400 presented static findings were reviewed and judged false positives: they describe normal local report generation, validation, rendering, documentation, or repository hygiene. No prompt injection, credential exfiltration, or malicious intent was evidenced in the reviewed locations; 318 repeated or lower-priority matches remain outside the presented catalog, and no net-new semantic finding was identified. Static review was capped at 400/718 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.","remediation":[{"issue":"Static review capped","severity":"medium","suggestion":"Manually review the omitted 318 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication."},{"issue":"Runtime tool paths are configurable through environment variables.","severity":"medium","suggestion":"Document trusted interpreter requirements and validate configured executable paths before invoking local helpers."},{"issue":"Report outputs may contain values copied from user-provided spreadsheets.","severity":"medium","suggestion":"Keep the existing sensitive-field warning prominent and recommend anonymization, access control, and output review before sharing."},{"issue":"Generated HTML and PPTX artifacts include large embedded content.","severity":"low","suggestion":"Continue using escaped output and bounded staging directories, and add regression tests for path validation and HTML escaping."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":".github/workflows/public-checks.yml","line_end":51,"line_start":51},{"file":".github/workflows/public-checks.yml","line_end":27,"line_start":27},{"file":"scripts/analysis_engine.py","line_end":592,"line_start":592},{"file":"scripts/chapter_chart_geometry.mjs","line_end":14,"line_start":14},{"file":"scripts/chapter_chart_geometry.mjs","line_end":120,"line_start":120},{"file":"scripts/chapter_deck.mjs","line_end":5,"line_start":5},{"file":"scripts/chapter_deck.mjs","line_end":14,"line_start":14},{"file":"scripts/chapter_deck.mjs","line_end":199,"line_start":199},{"file":"scripts/chapter_deck.mjs","line_end":49,"line_start":49},{"file":"scripts/chapter_deck.mjs","line_end":104,"line_start":104},{"file":"scripts/chapter_deck.mjs","line_end":173,"line_start":173},{"file":"scripts/chapter_deck.mjs","line_end":184,"line_start":184},{"file":"scripts/chapter_deck.mjs","line_end":185,"line_start":185},{"file":"scripts/chapter_deck.mjs","line_end":186,"line_start":186},{"file":"scripts/chapter_deck.mjs","line_end":188,"line_start":188},{"file":"scripts/chapter_deck.mjs","line_end":189,"line_start":189},{"file":"scripts/chapter_deck.mjs","line_end":191,"line_start":191},{"file":"scripts/chapter_deck.mjs","line_end":192,"line_start":192},{"file":"scripts/chapter_deck.mjs","line_end":193,"line_start":193},{"file":"scripts/chapter_deck.mjs","line_end":196,"line_start":196},{"file":"scripts/chapter_slideviber_design.mjs","line_end":19,"line_start":19},{"file":"scripts/chapter_slideviber_design.mjs","line_end":40,"line_start":40},{"file":"scripts/chapter_slideviber_design.mjs","line_end":56,"line_start":56},{"file":"scripts/content_qa.py","line_end":53,"line_start":53},{"file":"scripts/content_resolver.py","line_end":17,"line_start":17},{"file":"scripts/environment_check.py","line_end":47,"line_start":47},{"file":"scripts/html_analysis.py","line_end":60,"line_start":60},{"file":"scripts/ppt_theme_samples.mjs","line_end":6,"line_start":6},{"file":"scripts/ppt_theme_samples.mjs","line_end":15,"line_start":15},{"file":"scripts/ppt_theme_samples.mjs","line_end":51,"line_start":51},{"file":"scripts/ppt_theme_samples.mjs","line_end":54,"line_start":54},{"file":"scripts/ppt_theme_samples.mjs","line_end":48,"line_start":48},{"file":"scripts/ppt_theme_samples.mjs","line_end":60,"line_start":60},{"file":"scripts/ppt_theme_samples.mjs","line_end":79,"line_start":79},{"file":"scripts/report_model_projection.py","line_end":47,"line_start":47},{"file":"scripts/report_model_projection.py","line_end":189,"line_start":189},{"file":"scripts/slideviber_consistency.py","line_end":428,"line_start":428},{"file":"scripts/slideviber_consistency.py","line_end":429,"line_start":429},{"file":"scripts/slideviber_handoff.py","line_end":39,"line_start":39},{"file":"scripts/slideviber_handoff.py","line_end":44,"line_start":44},{"file":"scripts/slideviber_handoff.py","line_end":57,"line_start":57},{"file":"scripts/slideviber_handoff.py","line_end":65,"line_start":65},{"file":"scripts/slideviber_handoff.py","line_end":82,"line_start":82},{"file":"scripts/slideviber_handoff.py","line_end":93,"line_start":93},{"file":"scripts/slideviber_handoff.py","line_end":94,"line_start":94},{"file":"scripts/slideviber_handoff.py","line_end":95,"line_start":95},{"file":"scripts/slideviber_handoff.py","line_end":98,"line_start":98},{"file":"scripts/slideviber_handoff.py","line_end":113,"line_start":113},{"file":"scripts/visual_verification.py","line_end":102,"line_start":102},{"file":"scripts/visual_verification.py","line_end":128,"line_start":128}]},{"factor":"network","evidence":[{"file":"docs/index.html","line_end":23,"line_start":23},{"file":"docs/index.html","line_end":38,"line_start":38},{"file":"docs/index.html","line_end":40,"line_start":40},{"file":"INSTALL.en.md","line_end":22,"line_start":22},{"file":"README.md","line_end":52,"line_start":52},{"file":"README.zh-CN.md","line_end":50,"line_start":50},{"file":"scripts/chapter_chart_qa.py","line_end":4,"line_start":4},{"file":"scripts/chapter_native_scene_qa.py","line_end":11,"line_start":11},{"file":"scripts/chapter_native_scene_qa.py","line_end":12,"line_start":12},{"file":"scripts/chapter_pptx_prepare.py","line_end":9,"line_start":9},{"file":"scripts/chapter_presentation_qa.py","line_end":14,"line_start":14},{"file":"scripts/chapter_presentation_qa.py","line_end":15,"line_start":15},{"file":"scripts/chapter_presentation_qa.py","line_end":16,"line_start":16},{"file":"scripts/chapter_presentation_qa.py","line_end":17,"line_start":17},{"file":"scripts/chapter_vector_qa.py","line_end":14,"line_start":14},{"file":"scripts/chapter_vector_qa.py","line_end":15,"line_start":15},{"file":"scripts/generate_sample.py","line_end":278,"line_start":278},{"file":"scripts/generate_sample.py","line_end":634,"line_start":634},{"file":"scripts/html_analysis.py","line_end":150,"line_start":150},{"file":"scripts/sheet_to_report.py","line_end":1420,"line_start":1420},{"file":"scripts/sheet_to_report.py","line_end":1744,"line_start":1744},{"file":"scripts/sheet_to_report.py","line_end":2650,"line_start":2650},{"file":"scripts/sheet_to_report.py","line_end":3193,"line_start":3193},{"file":"scripts/slideviber_consistency.py","line_end":23,"line_start":23},{"file":"scripts/slideviber_handoff.py","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":19,"line_start":19}]},{"factor":"scripts","evidence":[{"file":"scripts/build_pptx.py","line_end":29,"line_start":22},{"file":"scripts/chart_contract.py","line_end":20,"line_start":20},{"file":"scripts/chart_contract.py","line_end":48,"line_start":48},{"file":"scripts/chart_contract.py","line_end":51,"line_start":51},{"file":"scripts/chart_contract.py","line_end":55,"line_start":55},{"file":"scripts/chart_contract.py","line_end":70,"line_start":70},{"file":"scripts/chart_contract.py","line_end":71,"line_start":71},{"file":"scripts/chart_contract.py","line_end":73,"line_start":73},{"file":"scripts/chart_contract.py","line_end":75,"line_start":75},{"file":"scripts/chart_contract.py","line_end":76,"line_start":76},{"file":"scripts/chart_contract.py","line_end":77,"line_start":77},{"file":"scripts/chart_contract.py","line_end":78,"line_start":78},{"file":"scripts/chart_contract.py","line_end":80,"line_start":80},{"file":"scripts/chart_contract.py","line_end":81,"line_start":81},{"file":"scripts/chart_contract.py","line_end":82,"line_start":82},{"file":"scripts/chart_contract.py","line_end":83,"line_start":83},{"file":"scripts/chart_contract.py","line_end":85,"line_start":85},{"file":"scripts/chart_contract.py","line_end":87,"line_start":87},{"file":"scripts/chart_contract.py","line_end":88,"line_start":88},{"file":"scripts/chart_contract.py","line_end":89,"line_start":89},{"file":"scripts/chart_contract.py","line_end":90,"line_start":90},{"file":"scripts/chart_contract.py","line_end":91,"line_start":91},{"file":"scripts/chart_contract.py","line_end":92,"line_start":92},{"file":"scripts/chart_contract.py","line_end":96,"line_start":96},{"file":"scripts/chart_contract.py","line_end":98,"line_start":98},{"file":"scripts/chart_contract.py","line_end":100,"line_start":100},{"file":"scripts/chart_contract.py","line_end":102,"line_start":102},{"file":"scripts/chart_contract.py","line_end":104,"line_start":104},{"file":"scripts/chart_contract.py","line_end":105,"line_start":105},{"file":"scripts/chart_contract.py","line_end":109,"line_start":109},{"file":"scripts/chart_contract.py","line_end":111,"line_start":111},{"file":"scripts/chart_contract.py","line_end":114,"line_start":114},{"file":"scripts/chart_contract.py","line_end":116,"line_start":116},{"file":"scripts/chart_contract.py","line_end":119,"line_start":119},{"file":"scripts/chart_contract.py","line_end":121,"line_start":121},{"file":"scripts/chart_contract.py","line_end":123,"line_start":123},{"file":"scripts/chart_contract.py","line_end":125,"line_start":125},{"file":"scripts/chart_contract.py","line_end":127,"line_start":127},{"file":"scripts/chart_contract.py","line_end":129,"line_start":129},{"file":"scripts/chart_contract.py","line_end":134,"line_start":134},{"file":"scripts/chart_contract.py","line_end":136,"line_start":136},{"file":"scripts/chart_contract.py","line_end":138,"line_start":138},{"file":"scripts/chart_contract.py","line_end":139,"line_start":139},{"file":"scripts/chart_contract.py","line_end":142,"line_start":142},{"file":"scripts/chart_contract.py","line_end":143,"line_start":143},{"file":"scripts/chart_contract.py","line_end":144,"line_start":144},{"file":"scripts/chart_contract.py","line_end":147,"line_start":147},{"file":"scripts/chart_contract.py","line_end":148,"line_start":148},{"file":"scripts/chart_contract.py","line_end":149,"line_start":149},{"file":"scripts/chart_contract.py","line_end":151,"line_start":151}]},{"factor":"filesystem","evidence":[{"file":"scripts/chapter_deck.mjs","line_end":15,"line_start":15},{"file":"scripts/chapter_deck.mjs","line_end":166,"line_start":166},{"file":"scripts/chapter_deck.mjs","line_end":167,"line_start":167},{"file":"scripts/chapter_deck.mjs","line_end":176,"line_start":176},{"file":"scripts/chapter_deck.mjs","line_end":196,"line_start":196},{"file":"scripts/chapter_deck.mjs","line_end":24,"line_start":24},{"file":"scripts/chapter_deck.mjs","line_end":26,"line_start":26},{"file":"scripts/chapter_deck.mjs","line_end":31,"line_start":31},{"file":"scripts/chapter_deck.mjs","line_end":63,"line_start":63},{"file":"scripts/chapter_native_scene_qa.py","line_end":6,"line_start":6},{"file":"scripts/chapter_pptx_prepare.py","line_end":6,"line_start":6},{"file":"scripts/chapter_presentation_qa.py","line_end":152,"line_start":152},{"file":"scripts/chapter_presentation_qa.py","line_end":9,"line_start":9},{"file":"scripts/chapter_slideviber_layout.mjs","line_end":7,"line_start":7},{"file":"scripts/chapter_slideviber_layout.mjs","line_end":13,"line_start":13},{"file":"scripts/chapter_slideviber_layout.mjs","line_end":25,"line_start":25},{"file":"scripts/chapter_slideviber_layout.mjs","line_end":34,"line_start":34},{"file":"scripts/chapter_slideviber_layout.mjs","line_end":154,"line_start":154},{"file":"scripts/generate_sample.py","line_end":10,"line_start":10},{"file":"scripts/html_chapter_renderer.py","line_end":127,"line_start":127},{"file":"scripts/html_renderer.py","line_end":521,"line_start":521},{"file":"scripts/html_renderer.py","line_end":526,"line_start":526},{"file":"scripts/html_renderer.py","line_end":530,"line_start":530},{"file":"scripts/html_renderer.py","line_end":537,"line_start":537},{"file":"scripts/html_renderer.py","line_end":545,"line_start":545},{"file":"scripts/ppt_theme_samples.mjs","line_end":14,"line_start":14},{"file":"scripts/ppt_theme_samples.mjs","line_end":21,"line_start":21},{"file":"scripts/ppt_theme_samples.mjs","line_end":45,"line_start":45},{"file":"scripts/ppt_theme_samples.mjs","line_end":46,"line_start":46},{"file":"scripts/ppt_theme_samples.mjs","line_end":58,"line_start":58},{"file":"scripts/ppt_theme_samples.mjs","line_end":79,"line_start":79},{"file":"scripts/sheet_to_report.py","line_end":12,"line_start":12},{"file":"scripts/sheet_to_report.py","line_end":2946,"line_start":2946},{"file":"scripts/sheet_to_report.py","line_end":2992,"line_start":2992},{"file":"scripts/sheet_to_report.py","line_end":2954,"line_start":2954},{"file":"scripts/sheet_to_report.py","line_end":2979,"line_start":2979},{"file":"scripts/sheet_to_report.py","line_end":3129,"line_start":3129},{"file":"scripts/slideviber_consistency.py","line_end":7,"line_start":7},{"file":"scripts/slideviber_consistency.py","line_end":540,"line_start":540},{"file":"scripts/slideviber_consistency.py","line_end":9,"line_start":9},{"file":"scripts/slideviber_consistency.py","line_end":547,"line_start":547},{"file":"scripts/visual_verification.py","line_end":18,"line_start":18},{"file":"scripts/visual_verification.py","line_end":180,"line_start":180}]},{"factor":"env_access","evidence":[{"file":"scripts/chapter_deck.mjs","line_end":12,"line_start":12},{"file":"scripts/chapter_deck.mjs","line_end":13,"line_start":13},{"file":"scripts/chapter_deck.mjs","line_end":12,"line_start":12},{"file":"scripts/chapter_deck.mjs","line_end":13,"line_start":13},{"file":"scripts/environment_check.py","line_end":43,"line_start":43},{"file":"scripts/environment_check.py","line_end":53,"line_start":53},{"file":"scripts/html_analysis.py","line_end":56,"line_start":56},{"file":"scripts/ppt_theme_samples.mjs","line_end":12,"line_start":12},{"file":"scripts/ppt_theme_samples.mjs","line_end":13,"line_start":13},{"file":"scripts/ppt_theme_samples.mjs","line_end":12,"line_start":12},{"file":"scripts/ppt_theme_samples.mjs","line_end":13,"line_start":13}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":103,"total_lines":28004,"audit_model":"codex","audited_at":"2026-09-11T12:39:28.114+00:00","created_at":"2026-09-11T13:45:09.610238+00:00","static_findings":[{"id":"sensitive:scripts/transactional_story.py:108:certificate-key-files","file":"scripts/transactional_story.py","pattern":"Certificate/key files","snippet":"# identifier remains in evidence.rows[].key for audit, never headline copy.","category":"sensitive","line_end":108,"severity":"high","line_start":108},{"id":"sensitive:.github/workflows/public-checks.yml:56:environment-file-access","file":".github/workflows/public-checks.yml","pattern":"Environment file access","snippet":"if path.name == '.env' or path.suffix.lower() in {'.pyc', '.pyo'} or '__pycache__' in path.parts:","category":"sensitive","line_end":56,"severity":"high","line_start":56},{"id":"sensitive:.gitignore:20:environment-file-access","file":".gitignore","pattern":"Environment file access","snippet":".env","category":"sensitive","line_end":20,"severity":"high","line_start":20},{"id":"sensitive:.gitignore:21:environment-file-access","file":".gitignore","pattern":"Environment file access","snippet":".env.*","category":"sensitive","line_end":21,"severity":"high","line_start":21},{"id":"sensitive:.gitignore:22:environment-file-access","file":".gitignore","pattern":"Environment file access","snippet":"!.env.example","category":"sensitive","line_end":22,"severity":"high","line_start":22},{"id":"sensitive:scripts/chapter_deck.mjs:12:environment-file-access","file":"scripts/chapter_deck.mjs","pattern":"Environment file access","snippet":"const PY=process.env.RUNTIME_PYTHON||(process.platform==='win32'?'python':'python3');","category":"sensitive","line_end":12,"severity":"high","line_start":12},{"id":"sensitive:scripts/chapter_deck.mjs:13:environment-file-access","file":"scripts/chapter_deck.mjs","pattern":"Environment file access","snippet":"process.env.PYTHONUTF8='1';","category":"sensitive","line_end":13,"severity":"high","line_start":13},{"id":"sensitive:scripts/ppt_theme_samples.mjs:12:environment-file-access","file":"scripts/ppt_theme_samples.mjs","pattern":"Environment file access","snippet":"const PY=process.env.RUNTIME_PYTHON||(process.platform==='win32'?'python':'python3');","category":"sensitive","line_end":12,"severity":"high","line_start":12},{"id":"sensitive:scripts/ppt_theme_samples.mjs:13:environment-file-access","file":"scripts/ppt_theme_samples.mjs","pattern":"Environment file access","snippet":"process.env.PYTHONUTF8='1';","category":"sensitive","line_end":13,"severity":"high","line_start":13},{"id":"obfuscation:docs/report.html:3:heuristic-extremely-long-line-5138-chars-likely-","file":"docs/report.html","pattern":"[HEURISTIC] Extremely long line (5138 chars) - likely obfuscated","snippet":":root{--ink:#263341;--muted:#596777;--paper:#faf9f6;--line:#dde2e8;--nav:64px;--blue:#24528a;--green","category":"obfuscation","line_end":3,"severity":"high","line_start":3},{"id":"obfuscation:scripts/html_chapter_renderer.py:131:heuristic-extremely-long-line-5138-chars-likely-","file":"scripts/html_chapter_renderer.py","pattern":"[HEURISTIC] Extremely long line (5138 chars) - likely obfuscated","snippet":":root{--ink:#263341;--muted:#596777;--paper:#faf9f6;--line:#dde2e8;--nav:64px;--blue:#24528a;--green","category":"obfuscation","line_end":131,"severity":"high","line_start":131},{"id":"obfuscation:docs/report.html:24:heuristic-extremely-long-line-78488-chars-likely","file":"docs/report.html","pattern":"[HEURISTIC] Extremely long line (78488 chars) - likely obfuscated","snippet":"</style></head><body><nav aria-label=\"报告导航\"><a href=\"#summary\">核心结论</a><a href=\"#overview\">基本盘</a><a","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:scripts/slideviber_handoff.py:1:heuristic-high-file-entropy-6-21-bits-possible-b","file":"scripts/slideviber_handoff.py","pattern":"[HEURISTIC] High file entropy (6.21 bits) - possible binary/encrypted content","snippet":"File: scripts/slideviber_handoff.py","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/chart-spec.md:1:heuristic-high-file-entropy-6-94-bits-possible-b","file":"references/chart-spec.md","pattern":"[HEURISTIC] High file entropy (6.94 bits) - possible binary/encrypted content","snippet":"File: references/chart-spec.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:DEMO.zh-CN.md:1:heuristic-high-file-entropy-7-20-bits-possible-b","file":"DEMO.zh-CN.md","pattern":"[HEURISTIC] High file entropy (7.20 bits) - possible binary/encrypted content","snippet":"File: DEMO.zh-CN.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:QUICKSTART.zh-CN.md:1:heuristic-high-file-entropy-7-23-bits-possible-b","file":"QUICKSTART.zh-CN.md","pattern":"[HEURISTIC] High file entropy (7.23 bits) - possible binary/encrypted content","snippet":"File: QUICKSTART.zh-CN.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/report-model.md:1:heuristic-high-file-entropy-7-24-bits-possible-b","file":"references/report-model.md","pattern":"[HEURISTIC] High file entropy (7.24 bits) - possible binary/encrypted content","snippet":"File: references/report-model.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/quick-help.md:1:heuristic-high-file-entropy-7-33-bits-possible-b","file":"references/quick-help.md","pattern":"[HEURISTIC] High file entropy (7.33 bits) - possible binary/encrypted content","snippet":"File: references/quick-help.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:FAQ.md:1:heuristic-high-file-entropy-7-39-bits-possible-b","file":"FAQ.md","pattern":"[HEURISTIC] High file entropy (7.39 bits) - possible binary/encrypted content","snippet":"File: FAQ.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:README.zh-CN.md:1:heuristic-high-file-entropy-7-43-bits-possible-b","file":"README.zh-CN.md","pattern":"[HEURISTIC] High file entropy (7.43 bits) - possible binary/encrypted content","snippet":"File: README.zh-CN.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/ppt-theme-selection.md:1:heuristic-high-file-entropy-7-62-bits-possible-b","file":"references/ppt-theme-selection.md","pattern":"[HEURISTIC] High file entropy (7.62 bits) - possible binary/encrypted content","snippet":"File: references/ppt-theme-selection.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:INSTALL.md:1:heuristic-high-file-entropy-7-75-bits-possible-b","file":"INSTALL.md","pattern":"[HEURISTIC] High file entropy (7.75 bits) - possible binary/encrypted content","snippet":"File: INSTALL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/html-analysis.md:1:heuristic-high-file-entropy-7-88-bits-possible-b","file":"references/html-analysis.md","pattern":"[HEURISTIC] High file entropy (7.88 bits) - possible binary/encrypted content","snippet":"File: references/html-analysis.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-88-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (7.88 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/chapter-presentation.md:1:heuristic-high-file-entropy-7-99-bits-possible-b","file":"references/chapter-presentation.md","pattern":"[HEURISTIC] High file entropy (7.99 bits) - possible binary/encrypted content","snippet":"File: references/chapter-presentation.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/html_transaction_facts.py:1:heuristic-multiple-bracket-chains-10-jsfuck-obfu","file":"scripts/html_transaction_facts.py","pattern":"[HEURISTIC] Multiple bracket chains (10) - JSFuck/obfuscation pattern","snippet":")]}}, ]])], ]])))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/question_evidence.py:1:heuristic-multiple-bracket-chains-10-jsfuck-obfu","file":"scripts/question_evidence.py","pattern":"[HEURISTIC] Multiple bracket chains (10) - JSFuck/obfuscation pattern","snippet":"[])), ]))], [])})","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/html_qa.py:1:heuristic-multiple-bracket-chains-12-jsfuck-obfu","file":"scripts/html_qa.py","pattern":"[HEURISTIC] Multiple bracket chains (12) - JSFuck/obfuscation pattern","snippet":"[])), []}), []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/presentation_contracts.py:1:heuristic-multiple-bracket-chains-13-jsfuck-obfu","file":"scripts/presentation_contracts.py","pattern":"[HEURISTIC] Multiple bracket chains (13) - JSFuck/obfuscation pattern","snippet":"[])), [])}, []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/analysis_questions.py:1:heuristic-multiple-bracket-chains-15-jsfuck-obfu","file":"scripts/analysis_questions.py","pattern":"[HEURISTIC] Multiple bracket chains (15) - JSFuck/obfuscation pattern","snippet":"[])], ())], ())]","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/analysis_depth.py:1:heuristic-multiple-bracket-chains-18-jsfuck-obfu","file":"scripts/analysis_depth.py","pattern":"[HEURISTIC] Multiple bracket chains (18) - JSFuck/obfuscation pattern","snippet":"[])), [])), ()))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/slideviber_consistency.py:1:heuristic-multiple-bracket-chains-18-jsfuck-obfu","file":"scripts/slideviber_consistency.py","pattern":"[HEURISTIC] Multiple bracket chains (18) - JSFuck/obfuscation pattern","snippet":"[])), [])), []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/analysis_followup.py:1:heuristic-multiple-bracket-chains-20-jsfuck-obfu","file":"scripts/analysis_followup.py","pattern":"[HEURISTIC] Multiple bracket chains (20) - JSFuck/obfuscation pattern","snippet":"]))}, [])), []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/html_evidence.py:1:heuristic-multiple-bracket-chains-20-jsfuck-obfu","file":"scripts/html_evidence.py","pattern":"[HEURISTIC] Multiple bracket chains (20) - JSFuck/obfuscation pattern","snippet":"[])}, {})), [])}","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/analysis_engine.py:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","file":"scripts/analysis_engine.py","pattern":"[HEURISTIC] Multiple bracket chains (24) - JSFuck/obfuscation pattern","snippet":"()}}, [])}, []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/build_pptx.py:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","file":"scripts/build_pptx.py","pattern":"[HEURISTIC] Multiple bracket chains (24) - JSFuck/obfuscation pattern","snippet":"[])], [])], [])[","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/model_validation.py:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","file":"scripts/model_validation.py","pattern":"[HEURISTIC] Multiple bracket chains (24) - JSFuck/obfuscation pattern","snippet":"[])}, [])}, ()))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/content_resolver.py:1:heuristic-multiple-bracket-chains-29-jsfuck-obfu","file":"scripts/content_resolver.py","pattern":"[HEURISTIC] Multiple bracket chains (29) - JSFuck/obfuscation pattern","snippet":"[])), [])}, ())}","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/narrative_planner.py:1:heuristic-multiple-bracket-chains-32-jsfuck-obfu","file":"scripts/narrative_planner.py","pattern":"[HEURISTIC] Multiple bracket chains (32) - JSFuck/obfuscation pattern","snippet":"{})), [])), {}))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/sheet_to_report.py:1:heuristic-multiple-bracket-chains-33-jsfuck-obfu","file":"scripts/sheet_to_report.py","pattern":"[HEURISTIC] Multiple bracket chains (33) - JSFuck/obfuscation pattern","snippet":"[])), [])), {}))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/content_qa.py:1:heuristic-multiple-bracket-chains-38-jsfuck-obfu","file":"scripts/content_qa.py","pattern":"[HEURISTIC] Multiple bracket chains (38) - JSFuck/obfuscation pattern","snippet":"[])}, [])}, {}))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/html_renderer.py:1:heuristic-multiple-bracket-chains-43-jsfuck-obfu","file":"scripts/html_renderer.py","pattern":"[HEURISTIC] Multiple bracket chains (43) - JSFuck/obfuscation pattern","snippet":"[])], [])], ))))}","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/chart_svg_renderer.py:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","file":"scripts/chart_svg_renderer.py","pattern":"[HEURISTIC] Multiple bracket chains (6) - JSFuck/obfuscation pattern","snippet":"[])}, ))}{, []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/html_analysis.py:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","file":"scripts/html_analysis.py","pattern":"[HEURISTIC] Multiple bracket chains (6) - JSFuck/obfuscation pattern","snippet":"[((), [])), ])})","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/chapter_deck.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"scripts/chapter_deck.mjs","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":"[])], {})}), {})})","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/chart_evidence.py:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"scripts/chart_evidence.py","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":"{})[, {})[, {})[","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/ppt_qa.py:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"scripts/ppt_qa.py","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":"[]))], [])[, []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/report_model_projection.py:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"scripts/report_model_projection.py","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":"[])), [])), []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/transactional_story.py:1:heuristic-multiple-bracket-chains-9-jsfuck-obfus","file":"scripts/transactional_story.py","pattern":"[HEURISTIC] Multiple bracket chains (9) - JSFuck/obfuscation pattern","snippet":"[])), ])}{, ])]))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-53-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.53 bits) - likely encoded/encrypted payload","snippet":">退款率是金额比例，不是退款订单率。缺少订单关联、退款发生时点及原因字段，不能把同月金额比直接解释为同批订单退款概率。</p></section><sectio...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/index.html:29:heuristic-very-high-entropy-string-5-54-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":">SlideViber 美化版<small>Optional refinement</small></h3><p>基于已确认的内容重新设计构图和视觉层级，同时保...","category":"obfuscation","line_end":29,"severity":"high","line_start":29},{"id":"obfuscation:scripts/html_transaction_facts.py:111:heuristic-very-high-entropy-string-5-54-bits-lik","file":"scripts/html_transaction_facts.py","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":"未命中费用文字线索的条目视图；不是已确认商品清洗结果。占比仍以全体净销售为分母；费用候选另列，总额未剔除。","category":"obfuscation","line_end":111,"severity":"high","line_start":111},{"id":"obfuscation:scripts/html_renderer.py:717:heuristic-very-high-entropy-string-5-55-bits-lik","file":"scripts/html_renderer.py","pattern":"[HEURISTIC] Very high entropy string (5.55 bits) - likely encoded/encrypted payload","snippet":"]):,} 行。比较口径使用{comparison_copy}，百分比指标以百分点展示变化，其他指标以相对变化率展示。重复行 {int(profile.get(","category":"obfuscation","line_end":717,"severity":"high","line_start":717},{"id":"obfuscation:scripts/analysis_engine.py:2073:heuristic-very-high-entropy-string-5-57-bits-lik","file":"scripts/analysis_engine.py","pattern":"[HEURISTIC] Very high entropy string (5.57 bits) - likely encoded/encrypted payload","snippet":"分别复核并治理，每个切面均以对应证据确认后再收缩；{roas_name}与转化率连续改善后再分阶段恢复预算。","category":"obfuscation","line_end":2073,"severity":"high","line_start":2073},{"id":"obfuscation:scripts/analysis_engine.py:1678:heuristic-very-high-entropy-string-5-61-bits-lik","file":"scripts/analysis_engine.py","pattern":"[HEURISTIC] Very high entropy string (5.61 bits) - likely encoded/encrypted payload","snippet":"待验证假设：在可比对象内小范围调整资源配置，能使{metric_name}{favorable}试验前且不损伤质量与效率。","category":"obfuscation","line_end":1678,"severity":"high","line_start":1678},{"id":"obfuscation:references/report-model.md:171:heuristic-very-high-entropy-string-5-62-bits-lik","file":"references/report-model.md","pattern":"[HEURISTIC] Very high entropy string (5.62 bits) - likely encoded/encrypted payload","snippet":" 根据实际证据形状复算：排名不自动成为驱动，计划用途／证据 ID／工具名／自报深度不构成证明；结构证据和同问题的实际经营判断须同时存在才可达到 4。","category":"obfuscation","line_end":171,"severity":"high","line_start":171},{"id":"obfuscation:docs/index.html:27:heuristic-very-high-entropy-string-5-66-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.66 bits) - likely encoded/encrypted payload","snippet":">HTML 分析简报<small>Offline report</small></h3><p>通过固定阅读主线、图表依据和口径说明，适合个人深读、业务复盘与会前...","category":"obfuscation","line_end":27,"severity":"high","line_start":27},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-66-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.66 bits) - likely encoded/encrypted payload","snippet":">付费广告营销成本从456,704.31元升至732,833.12元，投入产出降至2.87x。内容种草投入产出20.4x，但也低于前月20.94x，不宜无条件扩...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-67-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.67 bits) - likely encoded/encrypted payload","snippet":">投入产出以收入除以已记录营销成本，不含毛利、履约及全部间接成本；也不代表广告带来的增量回报。</p></section><section id=","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:references/chapter-presentation.md:9:heuristic-very-high-entropy-string-5-70-bits-lik","file":"references/chapter-presentation.md","pattern":"[HEURISTIC] Very high entropy string (5.70 bits) - likely encoded/encrypted payload","snippet":"可指定Python，否则Windows使用python、其他系统使用python3；不读取RUNTIME_NODE_MODULES或PRESENTATIONS_...","category":"obfuscation","line_end":9,"severity":"high","line_start":9},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-71-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.71 bits) - likely encoded/encrypted payload","snippet":">各指标按已确认聚合合同独立计算；按已确认类别转为互斥系列，各期保留全部类别；缺少某类交易的可加总值为零，缺少整期不补零</p><div class=","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:scripts/slideviber_handoff.py:113:heuristic-very-high-entropy-string-5-72-bits-lik","file":"scripts/slideviber_handoff.py","pattern":"[HEURISTIC] Very high entropy string (5.72 bits) - likely encoded/encrypted payload","snippet":"，正文仅保留短标签和业务判断；日期、数字与单位、指标名称和英文缩写保持不可拆语义单元；evidence ID 不放在观众可见页面；核验后另存 ","category":"obfuscation","line_end":113,"severity":"high","line_start":113},{"id":"obfuscation:docs/index.html:37:heuristic-very-high-entropy-string-5-73-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.73 bits) - likely encoded/encrypted payload","snippet":">数据、背景和结论均为自主合成内容，不代表任何真实企业表现。Skill不会绑定本案例，也不会把示例结论套到用户数据上。</p><div class=","category":"obfuscation","line_end":37,"severity":"high","line_start":37},{"id":"obfuscation:scripts/report_model_projection.py:171:heuristic-very-high-entropy-string-5-73-bits-lik","file":"scripts/report_model_projection.py","pattern":"[HEURISTIC] Very high entropy string (5.73 bits) - likely encoded/encrypted payload","snippet":"下一完整周期在可比内容组合内，{channel} channel 的 conversion_rate 不低于基期 {rate_value:.2f}%，转化量增加...","category":"obfuscation","line_end":171,"severity":"high","line_start":171},{"id":"obfuscation:scripts/sheet_to_report.py:369:heuristic-very-high-entropy-string-5-74-bits-lik","file":"scripts/sheet_to_report.py","pattern":"[HEURISTIC] Very high entropy string (5.74 bits) - likely encoded/encrypted payload","snippet":"下一完整周期在可比内容组合内，{best_channel} channel 的 conversion_rate 不低于基期 {rate:.2f}%，转化量增加且...","category":"obfuscation","line_end":369,"severity":"high","line_start":369},{"id":"obfuscation:scripts/html_analysis.py:385:heuristic-very-high-entropy-string-5-75-bits-lik","file":"scripts/html_analysis.py","pattern":"[HEURISTIC] Very high entropy string (5.75 bits) - likely encoded/encrypted payload","snippet":"共同且两期净数量为正的条目：数量贡献=(本期数量−前期数量)×前期单位净金额；单位净金额贡献=本期数量×两期单位净金额差。新增、退出及非正净数量单列；单位净金额...","category":"obfuscation","line_end":385,"severity":"high","line_start":385},{"id":"obfuscation:docs/index.html:38:heuristic-very-high-entropy-string-5-76-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.76 bits) - likely encoded/encrypted payload","snippet":">在线报告适合直接阅读；两套PPT可以下载后用 PowerPoint 或 WPS 打开，检查完整23页内容及可编辑结构。</p><div class=","category":"obfuscation","line_end":38,"severity":"high","line_start":38},{"id":"obfuscation:scripts/html_transaction_facts.py:171:heuristic-very-high-entropy-string-5-78-bits-lik","file":"scripts/html_transaction_facts.py","pattern":"[HEURISTIC] Very high entropy string (5.78 bits) - likely encoded/encrypted payload","snippet":"各质量条件可能重叠，行数和金额不能直接相加；缺失客户不等同收入损失；字母前缀只是可观察线索，不宣称已确认取消；异常价格尚无业务阈值。","category":"obfuscation","line_end":171,"severity":"high","line_start":171},{"id":"obfuscation:scripts/transactional_story.py:346:heuristic-very-high-entropy-string-5-78-bits-lik","file":"scripts/transactional_story.py","pattern":"[HEURISTIC] Very high entropy string (5.78 bits) - likely encoded/encrypted payload","snippet":"{label}头部贡献需要与订单覆盖及单均金额一起管理；以已算出的历史占比范围作为下一完整月的变化触发线，超出后先定位对象变化。","category":"obfuscation","line_end":346,"severity":"high","line_start":346},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-80-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.80 bits) - likely encoded/encrypted payload","snippet":">同一已确认总体的两期对象并集，包含新增/退出；不存在的加总/计数为零，比率无定义时不伪造。变动为数学贡献，不等同因果。</p><div class=","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:references/chapter-presentation.md:29:heuristic-very-high-entropy-string-5-81-bits-lik","file":"references/chapter-presentation.md","pattern":"[HEURISTIC] Very high entropy string (5.81 bits) - likely encoded/encrypted payload","snippet":"，按当前数据逐页选择下述设计意图；空的重点映射表示未发现应单独强调的类别，仍启用通用层级与容量适配。历史无visual或","category":"obfuscation","line_end":29,"severity":"high","line_start":29},{"id":"obfuscation:docs/index.html:31:heuristic-very-high-entropy-string-5-82-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.82 bits) - likely encoded/encrypted payload","snippet":">下面四组页面来自同一个23页案例。左侧标准版优先保证编辑与复用，右侧美化版加强构图、层级和现场阅读节奏。</p><nav class=","category":"obfuscation","line_end":31,"severity":"high","line_start":31},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-84-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.84 bits) - likely encoded/encrypted payload","snippet":">可优先验证高价值客维护与转介绍的增量效果；唤醒活动需单独核对触达成本和有效回流，避免仅用收入规模评价。</p><p class=","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-85-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.85 bits) - likely encoded/encrypted payload","snippet":">服饰收入仍增长，但退款比例也在上升，扩大获客可能同时放大售后压力。需要先对齐退款归属，再核验尺码、质量、物流等可能原因。</p><p class=","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/index.html:26:heuristic-very-high-entropy-string-5-94-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.94 bits) - likely encoded/encrypted payload","snippet":">先把判断、证据与行动关系分析清楚，再根据阅读和汇报场景改变呈现方式。视觉变化不能改数字，也不能漏掉会影响决策的信息。</p><div class=","category":"obfuscation","line_end":26,"severity":"high","line_start":26},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-94-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.94 bits) - likely encoded/encrypted payload","snippet":">对比去年同月有助于减少月份差异，但未控制素材、定向、活动及归因规则；渠道间成本覆盖不同，不能按平均回报机械搬预算。</p></section><section...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-96-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.96 bits) - likely encoded/encrypted payload","snippet":">没有客户唯一标识与层级历史，无法计算留存或生命周期价值；高价值标签可能本就依赖消费表现，组间差异不是运营因果证据。</p></section><section...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/index.html:25:heuristic-very-high-entropy-string-5-98-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.98 bits) - likely encoded/encrypted payload","snippet":">从一张 Excel 到完整经营简报</h1><p><strong>同一份分析模型</strong>驱动三种产物：可追溯的 HTML、可编辑的标准 PPT，以及...","category":"obfuscation","line_end":25,"severity":"high","line_start":25},{"id":"obfuscation:references/report-model.md:205:heuristic-very-high-entropy-string-6-04-bits-lik","file":"references/report-model.md","pattern":"[HEURISTIC] Very high entropy string (6.04 bits) - likely encoded/encrypted payload","snippet":"。主分析窗口统一日期、去重、完整周期及数值策略。交易排名进一步要求订单、金额及对应对象有效；客户覆盖不冒用销售总盘。质量影响分别绑定基准／受影响行与金额范围，绝...","category":"obfuscation","line_end":205,"severity":"high","line_start":205},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-13-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (6.13 bits) - likely encoded/encrypted payload","snippet":">03</span><div><h3>对客户维护和唤醒分别验证增量</h3><p><b>行动对象：</b>高价值客的维护活动与沉睡唤醒人群的召回活动</p><p...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-16-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (6.16 bits) - likely encoded/encrypted payload","snippet":">同一已确认总体的两期对象并集，包含新增/退出；不存在的加总/计数为零，比率无定义时不伪造。变动为数学贡献，不等同因果。；起点加全部已计算分量等于终点；累计坐标...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-17-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (6.17 bits) - likely encoded/encrypted payload","snippet":">各指标按已确认聚合合同独立计算；按每个已聚合对象的指标值等宽分箱；箱数为Sturges规则向上取整并最多十二箱；左闭右开，最后箱包含右端点；缺失不当零；常数样...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:references/chapter-presentation.md:15:heuristic-very-high-entropy-string-6-19-bits-lik","file":"references/chapter-presentation.md","pattern":"[HEURISTIC] Very high entropy string (6.19 bits) - likely encoded/encrypted payload","snippet":" 为每个已选 chart ID 提供判断标题片段数组。逐图核对标题是否由图内指标、范围和比较条件直接支撑，数字只能引用该图的 evidence cell。不能把...","category":"obfuscation","line_end":15,"severity":"high","line_start":15},{"id":"obfuscation:SKILL.md:116:heuristic-very-high-entropy-string-6-23-bits-lik","file":"SKILL.md","pattern":"[HEURISTIC] Very high entropy string (6.23 bits) - likely encoded/encrypted payload","snippet":" 记录选择理由、限制、尺度和重点；新运行不能退回旧细横条合同。柱图、分布、构成、关系和贡献图各有数据约束，不按行业名或固定图型配额选择。图中分箱、比例和累计坐标...","category":"obfuscation","line_end":116,"severity":"high","line_start":116},{"id":"obfuscation:references/html-analysis.md:13:heuristic-very-high-entropy-string-6-29-bits-lik","file":"references/html-analysis.md","pattern":"[HEURISTIC] Very high entropy string (6.29 bits) - likely encoded/encrypted payload","snippet":"，同一对象同序显示两指标，各用独立标尺和单位。contribution 使用全部证据行显示首要拉动对象、其余对象合计与全体净变动，limit 不裁掉尾部抵减；仅...","category":"obfuscation","line_end":13,"severity":"high","line_start":13},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-34-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (6.34 bits) - likely encoded/encrypted payload","snippet":">02</span><div><h3>优先核验服饰退款原因与归属时点</h3><p><b>行动对象：</b>服饰品类的订单、退款记录及售后问题</p><p>服饰...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-42-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (6.42 bits) - likely encoded/encrypted payload","snippet":">01</span><div><h3>先核验付费效率，再进行有限预算对照</h3><p><b>行动对象：</b>付费广告的投放配置与内容种草渠道的增量验证</p...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:references/chapter-presentation.md:21:heuristic-very-high-entropy-string-6-87-bits-lik","file":"references/chapter-presentation.md","pattern":"[HEURISTIC] Very high entropy string (6.87 bits) - likely encoded/encrypted payload","snippet":" 再核对源模型/主题/投影与场景，输出draft.pptx、draft.qa.json和来源回执；包含中文字体脚本及换行声明，不再需要宿主私有最终化工具。核对来...","category":"obfuscation","line_end":21,"severity":"high","line_start":21},{"id":"obfuscation:scripts/slideviber_handoff.py:113:heuristic-very-high-entropy-string-6-95-bits-lik","file":"scripts/slideviber_handoff.py","pattern":"[HEURISTIC] Very high entropy string (6.95 bits) - likely encoded/encrypted payload","snippet":" 为唯一内容真相源，按以上逐页 ID 和锁定证据重绘 16:9 演示稿；先依照上述主题选择来源处理：已确认方向直接沿用，明确授权代选时默认清晰商务，否则先给候选...","category":"obfuscation","line_end":113,"severity":"high","line_start":113},{"id":"obfuscation:scripts/chapter_deck.mjs:63:hex-encoded-characters","file":"scripts/chapter_deck.mjs","pattern":"Hex-encoded characters","snippet":"const label=chartNumber(value),actualWidth=[...label].reduce((s,c)=>s+(/[^\\x00-\\xff]/.test(c)?20:11)","category":"obfuscation","line_end":63,"severity":"high","line_start":63},{"id":"obfuscation:scripts/chapter_slideviber_layout.mjs:13:hex-encoded-characters","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Hex-encoded characters","snippet":"const width=[...token].reduce((sum,ch)=>sum+(/[^\\x00-\\xff]/.test(ch)?1:.55),0);","category":"obfuscation","line_end":13,"severity":"high","line_start":13},{"id":"obfuscation:scripts/content_qa.py:56:hex-encoded-characters","file":"scripts/content_qa.py","pattern":"Hex-encoded characters","snippet":"if re.search(r\"[^\\x00-\\x7f]\", field):","category":"obfuscation","line_end":56,"severity":"high","line_start":56},{"id":"external_commands:scripts/chapter_deck.mjs:5:node-js-child-process-module","file":"scripts/chapter_deck.mjs","pattern":"Node.js child_process module","snippet":"import {execFileSync} from 'node:child_process';","category":"external_commands","line_end":5,"severity":"high","line_start":5},{"id":"external_commands:scripts/ppt_theme_samples.mjs:6:node-js-child-process-module","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js child_process module","snippet":"import {execFileSync} from 'node:child_process';","category":"external_commands","line_end":6,"severity":"high","line_start":6},{"id":"filesystem:scripts/chapter_deck.mjs:24:path-traversal-sequence","file":"scripts/chapter_deck.mjs","pattern":"Path traversal sequence","snippet":"const rgb=c.chart[index%c.chart.length].match(/../g).map(n=>parseInt(n,16));","category":"filesystem","line_end":24,"severity":"high","line_start":24},{"id":"filesystem:scripts/chapter_deck.mjs:26:path-traversal-sequence","file":"scripts/chapter_deck.mjs","pattern":"Path traversal sequence","snippet":"const bg=luminance(c.background.match(/../g).map(n=>parseInt(n,16)));","category":"filesystem","line_end":26,"severity":"high","line_start":26},{"id":"filesystem:scripts/chapter_presentation_qa.py:152:path-traversal-sequence","file":"scripts/chapter_presentation_qa.py","pattern":"Path traversal sequence","snippet":"if part.startswith(\"../\") or part not in names:","category":"filesystem","line_end":152,"severity":"high","line_start":152},{"id":"external_commands:.github/workflows/public-checks.yml:51:python-subprocess-check-output","file":".github/workflows/public-checks.yml","pattern":"Python subprocess.check_output","snippet":"tracked = [Path(item) for item in subprocess.check_output(","category":"external_commands","line_end":51,"severity":"high","line_start":51},{"id":"external_commands:scripts/html_analysis.py:60:python-subprocess-check-output","file":"scripts/html_analysis.py","pattern":"Python subprocess.check_output","snippet":"return subprocess.check_output(","category":"external_commands","line_end":60,"severity":"high","line_start":60},{"id":"external_commands:scripts/environment_check.py:47:python-subprocess-run","file":"scripts/environment_check.py","pattern":"Python subprocess.run","snippet":"result=subprocess.run([str(executable),'--version'],capture_output=True,text=True,timeout=10,check=T","category":"external_commands","line_end":47,"severity":"high","line_start":47},{"id":"external_commands:scripts/visual_verification.py:102:python-subprocess-run","file":"scripts/visual_verification.py","pattern":"Python subprocess.run","snippet":"completed = subprocess.run(","category":"external_commands","line_end":102,"severity":"high","line_start":102},{"id":"external_commands:scripts/visual_verification.py:128:python-subprocess-run","file":"scripts/visual_verification.py","pattern":"Python subprocess.run","snippet":"converted = subprocess.run(","category":"external_commands","line_end":128,"severity":"high","line_start":128},{"id":"external_commands:scripts/chapter_deck.mjs:14:synchronous-file-execution","file":"scripts/chapter_deck.mjs","pattern":"Synchronous file execution","snippet":"execFileSync(PY,[path.join(root,'chapter_presentation.py'),'--model',modelFile,'--selection',selecti","category":"external_commands","line_end":14,"severity":"high","line_start":14},{"id":"external_commands:scripts/chapter_deck.mjs:199:synchronous-file-execution","file":"scripts/chapter_deck.mjs","pattern":"Synchronous file execution","snippet":"execFileSync(PY,[path.join(root,'chapter_pptx_export.py'),'--model',modelFile,'--selection',selectio","category":"external_commands","line_end":199,"severity":"high","line_start":199},{"id":"external_commands:scripts/ppt_theme_samples.mjs:15:synchronous-file-execution","file":"scripts/ppt_theme_samples.mjs","pattern":"Synchronous file execution","snippet":"const validated=JSON.parse(execFileSync(PY,['-c',","category":"external_commands","line_end":15,"severity":"high","line_start":15},{"id":"external_commands:scripts/ppt_theme_samples.mjs:51:synchronous-file-execution","file":"scripts/ppt_theme_samples.mjs","pattern":"Synchronous file execution","snippet":"execFileSync(PY,[path.join(root,'ppt_theme_sample_export.py'),'--source',inputFile,'--selection',sel","category":"external_commands","line_end":51,"severity":"high","line_start":51},{"id":"external_commands:scripts/ppt_theme_samples.mjs:54:synchronous-file-execution","file":"scripts/ppt_theme_samples.mjs","pattern":"Synchronous file execution","snippet":"const sv=JSON.parse(execFileSync(PY,['-c','import sys,json;sys.path.insert(0,sys.argv[1]);from ppt_t","category":"external_commands","line_end":54,"severity":"high","line_start":54},{"id":"blocker:scripts/html_renderer.py:269:template-injection-targeting-system-prompt","file":"scripts/html_renderer.py","pattern":"Template injection targeting system prompt","snippet":"*{{box-sizing:border-box}}body{{margin:0;background:var(--bg);color:var(--ink);font-family:\"Microsof","category":"blocker","line_end":269,"severity":"medium","line_start":269},{"id":"blocker:scripts/html_renderer.py:662:template-injection-targeting-system-prompt","file":"scripts/html_renderer.py","pattern":"Template injection targeting system prompt","snippet":"*{{box-sizing:border-box}} body{{margin:0;background:var(--bg);color:var(--ink);font-family:\"Microso","category":"blocker","line_end":662,"severity":"medium","line_start":662},{"id":"sensitive:.gitignore:30:sqlite-database-file","file":".gitignore","pattern":"SQLite database file","snippet":"Thumbs.db","category":"sensitive","line_end":30,"severity":"medium","line_start":30},{"id":"obfuscation:scripts/html_qa.py:219:deprecated-unescape-function","file":"scripts/html_qa.py","pattern":"Deprecated unescape function","snippet":"readable = html.unescape(re.sub(r'<[^>]+>', ' ', action_block))","category":"obfuscation","line_end":219,"severity":"medium","line_start":219},{"id":"obfuscation:scripts/html_qa.py:235:deprecated-unescape-function","file":"scripts/html_qa.py","pattern":"Deprecated unescape function","snippet":"visible = html.unescape(re.sub(r\"<[^>]+>\", \" \", visible))","category":"obfuscation","line_end":235,"severity":"medium","line_start":235},{"id":"scripts:scripts/build_pptx.py:22:dynamic-import-expression","file":"scripts/build_pptx.py","pattern":"Dynamic import() expression","snippet":"from presentation_contracts import (","category":"scripts","line_end":29,"severity":"medium","line_start":22},{"id":"scripts:scripts/content_qa.py:7:dynamic-import-expression","file":"scripts/content_qa.py","pattern":"Dynamic import() expression","snippet":"from content_selection import (","category":"scripts","line_end":13,"severity":"medium","line_start":7},{"id":"scripts:scripts/html_renderer.py:9:dynamic-import-expression","file":"scripts/html_renderer.py","pattern":"Dynamic import() expression","snippet":"from content_resolver import (","category":"scripts","line_end":14,"severity":"medium","line_start":9},{"id":"scripts:scripts/model_validation.py:8:dynamic-import-expression","file":"scripts/model_validation.py","pattern":"Dynamic import() expression","snippet":"from presentation_contracts import (","category":"scripts","line_end":12,"severity":"medium","line_start":8},{"id":"scripts:scripts/model_validation.py:17:dynamic-import-expression","file":"scripts/model_validation.py","pattern":"Dynamic import() expression","snippet":"from content_resolver import (","category":"scripts","line_end":21,"severity":"medium","line_start":17},{"id":"scripts:scripts/narrative_planner.py:7:dynamic-import-expression","file":"scripts/narrative_planner.py","pattern":"Dynamic import() expression","snippet":"from story_topology import (","category":"scripts","line_end":11,"severity":"medium","line_start":7},{"id":"scripts:scripts/ppt_qa.py:13:dynamic-import-expression","file":"scripts/ppt_qa.py","pattern":"Dynamic import() expression","snippet":"from presentation_contracts import (","category":"scripts","line_end":19,"severity":"medium","line_start":13},{"id":"scripts:scripts/sheet_to_report.py:32:dynamic-import-expression","file":"scripts/sheet_to_report.py","pattern":"Dynamic import() expression","snippet":"from evidence_catalog import (","category":"scripts","line_end":35,"severity":"medium","line_start":32},{"id":"scripts:scripts/sheet_to_report.py:40:dynamic-import-expression","file":"scripts/sheet_to_report.py","pattern":"Dynamic import() expression","snippet":"from input_preflight import (","category":"scripts","line_end":45,"severity":"medium","line_start":40},{"id":"scripts:scripts/chart_contract.py:20:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"def _require(condition, message):","category":"scripts","line_end":20,"severity":"medium","line_start":20},{"id":"scripts:scripts/chart_contract.py:48:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(value, str), \"时间标签必须是 ISO 字符串\")","category":"scripts","line_end":48,"severity":"medium","line_start":48},{"id":"scripts:scripts/chart_contract.py:51:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(len(value) == 7, \"月份必须使用 YYYY-MM\")","category":"scripts","line_end":51,"severity":"medium","line_start":51},{"id":"scripts:scripts/chart_contract.py:55:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(result.isoformat() == value, \"日期必须使用 YYYY-MM-DD\")","category":"scripts","line_end":55,"severity":"medium","line_start":55},{"id":"scripts:scripts/chart_contract.py:70:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(chart, dict) and required <= set(chart) and not set(chart) - required - optional","category":"scripts","line_end":70,"severity":"medium","line_start":70},{"id":"scripts:scripts/chart_contract.py:71:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(chart[\"version\"] == VERSION, \"不支持的图表合同版本\")","category":"scripts","line_end":71,"severity":"medium","line_start":71},{"id":"scripts:scripts/chart_contract.py:73:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(chart[key], str) and bool(chart[key].strip()), \"图表标识、任务和理由必须非空\")","category":"scripts","line_end":73,"severity":"medium","line_start":73},{"id":"scripts:scripts/chart_contract.py:75:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(kind in KINDS and kind in TASK_KINDS.get(chart[\"task\"], set()), \"任务与图型不匹配\")","category":"scripts","line_end":75,"severity":"medium","line_start":75},{"id":"scripts:scripts/chart_contract.py:76:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(chart[\"title\"], list) and bool(chart[\"title\"]), \"标题必须使用证据文本片段\")","category":"scripts","line_end":76,"severity":"medium","line_start":76},{"id":"scripts:scripts/chart_contract.py:77:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(chart[\"constraints\"], list) and all(isinstance(s, str) and s.strip() for s in ch","category":"scripts","line_end":77,"severity":"medium","line_start":77},{"id":"scripts:scripts/chart_contract.py:78:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(type(chart[\"limit\"]) is int and 1 <= chart[\"limit\"] <= 500, \"limit 必须为 1 至 500 整数\")","category":"scripts","line_end":78,"severity":"medium","line_start":78},{"id":"scripts:scripts/chart_contract.py:80:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(scale in {\"category\", \"time\", \"linear\"} and order in {\"source\", \"descending\", \"absolute\"}, ","category":"scripts","line_end":80,"severity":"medium","line_start":80},{"id":"scripts:scripts/chart_contract.py:81:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(chart.get(\"emphasis\", \"supporting\") in {\"primary\", \"supporting\"}, \"图表层级不合法\")","category":"scripts","line_end":81,"severity":"medium","line_start":81},{"id":"scripts:scripts/chart_contract.py:82:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require((kind == \"paired\") == (\"y2\" in chart), \"仅 paired 必须提供 y2\")","category":"scripts","line_end":82,"severity":"medium","line_start":82},{"id":"scripts:scripts/chart_contract.py:83:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require((kind in {\"grouped\", \"stacked\"}) == (\"series\" in chart), \"仅 grouped/stacked 必须提供 series\")","category":"scripts","line_end":83,"severity":"medium","line_start":83},{"id":"scripts:scripts/chart_contract.py:85:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(chart[\"series\"], list) and 2 <= len(chart[\"series\"]) <= 6 and chart[\"series\"][0]","category":"scripts","line_end":85,"severity":"medium","line_start":85},{"id":"scripts:scripts/chart_contract.py:87:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(scale != \"linear\" or kind in {\"line\", \"scatter\"}, \"数值横轴仅用于线图和散点\")","category":"scripts","line_end":87,"severity":"medium","line_start":87},{"id":"scripts:scripts/chart_contract.py:88:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(kind != \"scatter\" or scale == \"linear\", \"散点必须使用数值横轴\")","category":"scripts","line_end":88,"severity":"medium","line_start":88},{"id":"scripts:scripts/chart_contract.py:89:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(scale != \"time\" or kind in {\"line\", \"column\", \"grouped\", \"paired\"}, \"此图型不支持时间横轴\")","category":"scripts","line_end":89,"severity":"medium","line_start":89},{"id":"scripts:scripts/chart_contract.py:90:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(scale == \"category\" or order == \"source\", \"时间与数值横轴不能按数值排名重排\")","category":"scripts","line_end":90,"severity":"medium","line_start":90},{"id":"scripts:scripts/chart_contract.py:91:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(kind not in {\"waterfall\", \"histogram\"} or order == \"source\", \"贡献步骤和箱边界不可重排\")","category":"scripts","line_end":91,"severity":"medium","line_start":91},{"id":"scripts:scripts/chart_contract.py:92:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(record, dict) and isinstance(record.get(\"columns\"), dict) and isinstance(record.","category":"scripts","line_end":92,"severity":"medium","line_start":92},{"id":"scripts:scripts/chart_contract.py:96:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(isinstance(k, str) and k in columns for k in keys) and len(set(keys)) == len(keys), \"列不","category":"scripts","line_end":96,"severity":"medium","line_start":96},{"id":"scripts:scripts/chart_contract.py:98:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(columns[key].get(\"label\"), str) and isinstance(columns[key].get(\"unit\"), str), \"","category":"scripts","line_end":98,"severity":"medium","line_start":98},{"id":"scripts:scripts/chart_contract.py:100:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(len({columns[k][\"unit\"] for k in series}) == 1, \"同轴系列单位必须一致\")","category":"scripts","line_end":100,"severity":"medium","line_start":100},{"id":"scripts:scripts/chart_contract.py:102:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(isinstance(columns[k].get(\"denominator\"), str) and columns[k][\"denominator\"] for k in s","category":"scripts","line_end":102,"severity":"medium","line_start":102},{"id":"scripts:scripts/chart_contract.py:104:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(columns[k].get(\"additive\") is True for k in series), \"贡献只能使用可加总指标\")","category":"scripts","line_end":104,"severity":"medium","line_start":104},{"id":"scripts:scripts/chart_contract.py:105:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(len(rows) <= chart[\"limit\"], \"贡献视图不得截掉尾部\")","category":"scripts","line_end":105,"severity":"medium","line_start":105},{"id":"scripts:scripts/chart_contract.py:109:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(row, dict), \"证据行必须是对象\")","category":"scripts","line_end":109,"severity":"medium","line_start":109},{"id":"scripts:scripts/chart_contract.py:111:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(type(value) in (str, int, float) and bool(str(value).strip()) and (type(value) is str or _n","category":"scripts","line_end":111,"severity":"medium","line_start":111},{"id":"scripts:scripts/chart_contract.py:114:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(_number(row.get(key)), \"全部证据数值必须有限,不得忽略尾部缺失\")","category":"scripts","line_end":114,"severity":"medium","line_start":114},{"id":"scripts:scripts/chart_contract.py:116:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(_number(row.get(x)), \"数值横轴必须使用有限数值\")","category":"scripts","line_end":116,"severity":"medium","line_start":116},{"id":"scripts:scripts/chart_contract.py:119:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(len(set(labels)) == len(labels), \"对象标签重复\")","category":"scripts","line_end":119,"severity":"medium","line_start":119},{"id":"scripts:scripts/chart_contract.py:121:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(a < b for a, b in zip(numeric_x, numeric_x[1:])), \"数值横轴必须严格递增\")","category":"scripts","line_end":121,"severity":"medium","line_start":121},{"id":"scripts:scripts/chart_contract.py:123:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(highlight, list) and all(isinstance(v, str) and v in labels for v in highlight) ","category":"scripts","line_end":123,"severity":"medium","line_start":123},{"id":"scripts:scripts/chart_contract.py:125:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(len(rows) <= chart[\"limit\"], \"此图型必须完整展示,不能截尾\")","category":"scripts","line_end":125,"severity":"medium","line_start":125},{"id":"scripts:scripts/chart_contract.py:127:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(min(len(rows), chart[\"limit\"]) <= readable_limit, \"类别过多,需显式选择可读图型或计算聚合证据\")","category":"scripts","line_end":127,"severity":"medium","line_start":127},{"id":"scripts:scripts/chart_contract.py:129:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(semantics, dict), \"图形语义必须由计算端提供\")","category":"scripts","line_end":129,"severity":"medium","line_start":129},{"id":"scripts:scripts/chart_contract.py:134:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(frequency in {\"day\", \"week\", \"month\"} and isinstance(expected, list) and bool(expected), \"时","category":"scripts","line_end":134,"severity":"medium","line_start":134},{"id":"scripts:scripts/chart_contract.py:136:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(_next_date(a, frequency) == b for a, b in zip(domain, domain[1:])), \"预期时间域必须连续且有序\")","category":"scripts","line_end":136,"severity":"medium","line_start":136},{"id":"scripts:scripts/chart_contract.py:138:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(v in domain for v in observed) and all(a < b for a, b in zip(observed, observed[1:])), ","category":"scripts","line_end":138,"severity":"medium","line_start":138},{"id":"scripts:scripts/chart_contract.py:139:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(len(expected) <= chart[\"limit\"], \"时间域不可截尾\")","category":"scripts","line_end":139,"severity":"medium","line_start":139},{"id":"scripts:scripts/chart_contract.py:142:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(partition.get(\"mutually_exclusive\") is True and partition.get(\"complete\") is True, \"环形图需要完整","category":"scripts","line_end":142,"severity":"medium","line_start":142},{"id":"scripts:scripts/chart_contract.py:143:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(columns[y][\"unit\"] == \"%\" and isinstance(columns[y].get(\"denominator\"), str) and bool(colum","category":"scripts","line_end":143,"severity":"medium","line_start":143},{"id":"scripts:scripts/chart_contract.py:144:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(2 <= len(rows) <= 6 and all(r[y] >= 0 for r in rows) and _close(fsum(r[y] for r in rows), 1","category":"scripts","line_end":144,"severity":"medium","line_start":144},{"id":"scripts:scripts/chart_contract.py:147:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(partition.get(\"mutually_exclusive\") is True and partition.get(\"complete\") is True, \"堆叠图需要同一","category":"scripts","line_end":147,"severity":"medium","line_start":147},{"id":"scripts:scripts/chart_contract.py:148:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(columns[k].get(\"additive\") is True for k in series), \"堆叠系列必须可加总\")","category":"scripts","line_end":148,"severity":"medium","line_start":148},{"id":"scripts:scripts/chart_contract.py:149:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(r[k] >= 0 for r in rows for k in series), \"构成堆叠不能含负值\")","category":"scripts","line_end":149,"severity":"medium","line_start":149},{"id":"filesystem:scripts/chapter_deck.mjs:31:hidden-file-access","file":"scripts/chapter_deck.mjs","pattern":"Hidden file access","snippet":"const color=role=>'#'+(/^design-\\d+$/.test(role)?readableAccent(Number(role.slice(7))):(c[role]??c.i","category":"filesystem","line_end":31,"severity":"medium","line_start":31},{"id":"filesystem:scripts/chapter_deck.mjs:63:hidden-file-access","file":"scripts/chapter_deck.mjs","pattern":"Hidden file access","snippet":"const label=chartNumber(value),actualWidth=[...label].reduce((s,c)=>s+(/[^\\x00-\\xff]/.test(c)?20:11)","category":"filesystem","line_end":63,"severity":"medium","line_start":63},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:7:hidden-file-access","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Hidden file access","snippet":"if(/^[,。、;:!?)】》”’]$/.test(token)&&tokens.length&&tokens.at(-1)!=='\\n')tokens[tokens.length-1]+=toke","category":"filesystem","line_end":7,"severity":"medium","line_start":7},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:13:hidden-file-access","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Hidden file access","snippet":"const width=[...token].reduce((sum,ch)=>sum+(/[^\\x00-\\xff]/.test(ch)?1:.55),0);","category":"filesystem","line_end":13,"severity":"medium","line_start":13},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:25:hidden-file-access","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Hidden file access","snippet":"if(!tokens.length || tokens.some(t=>!/^page-\\d{3}$/.test(t)) || new Set(tokens).size!==tokens.length","category":"filesystem","line_end":25,"severity":"medium","line_start":25},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:34:hidden-file-access","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Hidden file access","snippet":"if (tokens.length !== 2 || tokens.some(t => !/^[1-9]\\d*$/.test(t)))","category":"filesystem","line_end":34,"severity":"medium","line_start":34},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:154:hidden-file-access","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Hidden file access","snippet":"if(last>0 && /^[\\u3400-\\u9fff]$/.test(titleRows[last]) && /[\\u3400-\\u9fff]{2}$/.test(titleRows[last-","category":"filesystem","line_end":154,"severity":"medium","line_start":154},{"id":"filesystem:scripts/chapter_deck.mjs:15:node-js-fs-operations","file":"scripts/chapter_deck.mjs","pattern":"Node.js fs operations","snippet":"const d=JSON.parse(await fs.readFile(projectionFile,'utf8')),c=d.selection.config.palette,F=d.select","category":"filesystem","line_end":15,"severity":"medium","line_start":15},{"id":"filesystem:scripts/chapter_deck.mjs:166:node-js-fs-operations","file":"scripts/chapter_deck.mjs","pattern":"Node.js fs operations","snippet":"await fs.mkdir(outDir,{recursive:false});","category":"filesystem","line_end":166,"severity":"medium","line_start":166},{"id":"filesystem:scripts/chapter_deck.mjs:167:node-js-fs-operations","file":"scripts/chapter_deck.mjs","pattern":"Node.js fs operations","snippet":"await fs.writeFile(path.join(outDir,'scene.json'),JSON.stringify({source:d.sha256,width:1280,height:","category":"filesystem","line_end":167,"severity":"medium","line_start":167},{"id":"filesystem:scripts/chapter_deck.mjs:176:node-js-fs-operations","file":"scripts/chapter_deck.mjs","pattern":"Node.js fs operations","snippet":"await fs.writeFile(path.join(outDir,'theme.json'),JSON.stringify(theme,null,2));await fs.mkdir(path.","category":"filesystem","line_end":176,"severity":"medium","line_start":176},{"id":"filesystem:scripts/chapter_deck.mjs:196:node-js-fs-operations","file":"scripts/chapter_deck.mjs","pattern":"Node.js fs operations","snippet":"await fs.writeFile(path.join(outDir,'slides',`slide_${String(i+1).padStart(2,'0')}.svg`),parts.join(","category":"filesystem","line_end":196,"severity":"medium","line_start":196},{"id":"filesystem:scripts/html_chapter_renderer.py:127:node-js-fs-operations","file":"scripts/html_chapter_renderer.py","pattern":"Node.js fs operations","snippet":"proofs.append(f'<details><summary>{esc(record[\"label\"])}</summary><p class=\"limit\">{esc(record[\"scop","category":"filesystem","line_end":127,"severity":"medium","line_start":127},{"id":"filesystem:scripts/html_renderer.py:521:node-js-fs-operations","file":"scripts/html_renderer.py","pattern":"Node.js fs operations","snippet":"proofs.append(","category":"filesystem","line_end":521,"severity":"medium","line_start":521},{"id":"filesystem:scripts/html_renderer.py:526:node-js-fs-operations","file":"scripts/html_renderer.py","pattern":"Node.js fs operations","snippet":"proofs.append(_svg_chart(chart, render_scope(chart)))","category":"filesystem","line_end":526,"severity":"medium","line_start":526},{"id":"filesystem:scripts/html_renderer.py:530:node-js-fs-operations","file":"scripts/html_renderer.py","pattern":"Node.js fs operations","snippet":"proofs.append(f'<p class=\"chapter-proof-link\">共同证据:<a href=\"#{proof_anchors[evidence_id]}\">查看前文数值证明表","category":"filesystem","line_end":530,"severity":"medium","line_start":530},{"id":"filesystem:scripts/html_renderer.py:537:node-js-fs-operations","file":"scripts/html_renderer.py","pattern":"Node.js fs operations","snippet":"proofs.append(f'<div class=\"proof-block\"><div class=\"evidence-table-wrap\" tabindex=\"0\" role=\"region\"","category":"filesystem","line_end":537,"severity":"medium","line_start":537},{"id":"filesystem:scripts/html_renderer.py:545:node-js-fs-operations","file":"scripts/html_renderer.py","pattern":"Node.js fs operations","snippet":"proofs.append(f'<div class=\"evidence-table-wrap\" tabindex=\"0\" role=\"region\" aria-label=\"集中度逐月证明\">'","category":"filesystem","line_end":545,"severity":"medium","line_start":545},{"id":"filesystem:scripts/ppt_theme_samples.mjs:14:node-js-fs-operations","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js fs operations","snippet":"const s=JSON.parse(await fs.readFile(selectionFile,'utf8')),d=JSON.parse(await fs.readFile(inputFile","category":"filesystem","line_end":14,"severity":"medium","line_start":14},{"id":"filesystem:scripts/ppt_theme_samples.mjs:21:node-js-fs-operations","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js fs operations","snippet":"await fs.mkdir(outDir,{recursive:false});","category":"filesystem","line_end":21,"severity":"medium","line_start":21},{"id":"filesystem:scripts/ppt_theme_samples.mjs:45:node-js-fs-operations","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js fs operations","snippet":"const manifest={schema:'ppt-theme-sample-export/1',selection:s,source_file_sha256:sha(await fs.readF","category":"filesystem","line_end":45,"severity":"medium","line_start":45},{"id":"filesystem:scripts/ppt_theme_samples.mjs:46:node-js-fs-operations","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js fs operations","snippet":"await fs.writeFile(path.join(outDir,'manifest.json'),JSON.stringify(manifest,null,2));","category":"filesystem","line_end":46,"severity":"medium","line_start":46},{"id":"filesystem:scripts/ppt_theme_samples.mjs:58:node-js-fs-operations","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js fs operations","snippet":"await fs.writeFile(path.join(outDir,'theme.json'),JSON.stringify(sv,null,2));await fs.mkdir(path.joi","category":"filesystem","line_end":58,"severity":"medium","line_start":58},{"id":"filesystem:scripts/ppt_theme_samples.mjs:79:node-js-fs-operations","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js fs operations","snippet":"}await fs.writeFile(path.join(outDir,'slides',`slide_${n+1}.svg`),parts.join('\\n'));","category":"filesystem","line_end":79,"severity":"medium","line_start":79},{"id":"filesystem:scripts/chapter_native_scene_qa.py:6:python-archive-libraries","file":"scripts/chapter_native_scene_qa.py","pattern":"Python archive libraries","snippet":"from zipfile import ZipFile","category":"filesystem","line_end":6,"severity":"medium","line_start":6},{"id":"filesystem:scripts/chapter_pptx_prepare.py:6:python-archive-libraries","file":"scripts/chapter_pptx_prepare.py","pattern":"Python archive libraries","snippet":"from zipfile import ZipFile","category":"filesystem","line_end":6,"severity":"medium","line_start":6},{"id":"filesystem:scripts/chapter_presentation_qa.py:9:python-archive-libraries","file":"scripts/chapter_presentation_qa.py","pattern":"Python archive libraries","snippet":"from zipfile import ZipFile","category":"filesystem","line_end":9,"severity":"medium","line_start":9},{"id":"filesystem:scripts/generate_sample.py:10:python-archive-libraries","file":"scripts/generate_sample.py","pattern":"Python archive libraries","snippet":"from zipfile import ZIP_DEFLATED, ZipFile, ZipInfo","category":"filesystem","line_end":10,"severity":"medium","line_start":10},{"id":"filesystem:scripts/slideviber_consistency.py:9:python-archive-libraries","file":"scripts/slideviber_consistency.py","pattern":"Python archive libraries","snippet":"import zipfile","category":"filesystem","line_end":9,"severity":"medium","line_start":9},{"id":"filesystem:scripts/slideviber_consistency.py:547:python-archive-libraries","file":"scripts/slideviber_consistency.py","pattern":"Python archive libraries","snippet":"with zipfile.ZipFile(source_path, \"r\") as source, zipfile.ZipFile(","category":"filesystem","line_end":547,"severity":"medium","line_start":547},{"id":"filesystem:scripts/sheet_to_report.py:2954:python-shutil-operations","file":"scripts/sheet_to_report.py","pattern":"Python shutil operations","snippet":"shutil.copy2(output_dir / name, backup_dir / name)","category":"filesystem","line_end":2954,"severity":"medium","line_start":2954},{"id":"filesystem:scripts/sheet_to_report.py:2979:python-shutil-operations","file":"scripts/sheet_to_report.py","pattern":"Python shutil operations","snippet":"shutil.rmtree(backup_dir, ignore_errors=True)","category":"filesystem","line_end":2979,"severity":"medium","line_start":2979},{"id":"filesystem:scripts/sheet_to_report.py:3129:python-shutil-operations","file":"scripts/sheet_to_report.py","pattern":"Python shutil operations","snippet":"shutil.rmtree(staging_dir, ignore_errors=True)","category":"filesystem","line_end":3129,"severity":"medium","line_start":3129},{"id":"filesystem:scripts/visual_verification.py:18:python-shutil-operations","file":"scripts/visual_verification.py","pattern":"Python shutil operations","snippet":"shutil.rmtree(path, ignore_errors=True)","category":"filesystem","line_end":18,"severity":"medium","line_start":18},{"id":"filesystem:scripts/visual_verification.py:180:python-shutil-operations","file":"scripts/visual_verification.py","pattern":"Python shutil operations","snippet":"shutil.rmtree(run_directory, ignore_errors=True)","category":"filesystem","line_end":180,"severity":"medium","line_start":180},{"id":"external_commands:scripts/analysis_engine.py:592:ruby-shell-backtick-execution","file":"scripts/analysis_engine.py","pattern":"Ruby/shell backtick execution","snippet":"\"\"\"Keep pandas grouping keys typed: ``1`` and ``\\\"1\\\"`` are distinct.\"\"\"","category":"external_commands","line_end":592,"severity":"medium","line_start":592},{"id":"external_commands:scripts/chapter_chart_geometry.mjs:14:ruby-shell-backtick-execution","file":"scripts/chapter_chart_geometry.mjs","pattern":"Ruby/shell backtick execution","snippet":"const t=wrap(`${i+1} ${label}\\n${fmt(v.x_values[i])}, ${fmt(v.series[0].values[i])}`,Math.floor(w/19","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:scripts/chapter_chart_geometry.mjs:120:ruby-shell-backtick-execution","file":"scripts/chapter_chart_geometry.mjs","pattern":"Ruby/shell backtick execution","snippet":"const shown=histogram?`[${fmt(v.bin_lower[i])}, ${fmt(v.bin_upper[i])}${i===v.labels.length-1?']':')","category":"external_commands","line_end":120,"severity":"medium","line_start":120},{"id":"external_commands:scripts/chapter_deck.mjs:49:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"objects.push({kind:'path',d:`M ${p} A ${r} ${r} 0 ${b-a>Math.PI?1:0} 1 ${q} L ${u} A ${inner} ${inne","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:scripts/chapter_deck.mjs:104:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"text(`${String(d.slides.indexOf(page)+1).padStart(2,'0')} / ${d.slides.length}`,1100,688,130,26,18,'","category":"external_commands","line_end":104,"severity":"medium","line_start":104},{"id":"external_commands:scripts/chapter_deck.mjs:173:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"const reverse=new Map(Object.entries(theme.colors).map(([key,value])=>[value.toLowerCase(),`var(--${","category":"external_commands","line_end":173,"severity":"medium","line_start":173},{"id":"external_commands:scripts/chapter_deck.mjs:184:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.kind==='polygon')return `<polygon points=\"${o.points.map(p=>p.join(',')).join(' ')}\" fill=\"${co","category":"external_commands","line_end":184,"severity":"medium","line_start":184},{"id":"external_commands:scripts/chapter_deck.mjs:185:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.kind==='text')return `<foreignObject x=\"${o.x}\" y=\"${o.y}\" width=\"${o.w}\" height=\"${o.h}\"><div ","category":"external_commands","line_end":185,"severity":"medium","line_start":185},{"id":"external_commands:scripts/chapter_deck.mjs:186:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.kind==='rect')return `<rect x=\"${o.x}\" y=\"${o.y}\" width=\"${o.w}\" height=\"${o.h}\" fill=\"${col(o.","category":"external_commands","line_end":186,"severity":"medium","line_start":186},{"id":"external_commands:scripts/chapter_deck.mjs:188:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.x1===o.x2||o.y1===o.y2)return `<rect x=\"${Math.min(o.x1,o.x2)}\" y=\"${Math.min(o.y1,o.y2)}\" widt","category":"external_commands","line_end":188,"severity":"medium","line_start":188},{"id":"external_commands:scripts/chapter_deck.mjs:189:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"return `<line x1=\"${o.x1}\" y1=\"${o.y1}\" x2=\"${o.x2}\" y2=\"${o.y2}\" stroke=\"${col(o.fill)}\" stroke-wid","category":"external_commands","line_end":189,"severity":"medium","line_start":189},{"id":"external_commands:scripts/chapter_deck.mjs:191:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.kind==='circle')return `<circle cx=\"${o.cx}\" cy=\"${o.cy}\" r=\"${o.r}\" fill=\"${col(o.fill)}\"/>`;","category":"external_commands","line_end":191,"severity":"medium","line_start":191},{"id":"external_commands:scripts/chapter_deck.mjs:192:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.kind==='polyline')return `<polyline points=\"${o.points.map(p=>p.join(',')).join(' ')}\" fill=\"no","category":"external_commands","line_end":192,"severity":"medium","line_start":192},{"id":"external_commands:scripts/chapter_deck.mjs:193:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.kind==='path')return `<path transform=\"scale(1.5)\" d=\"${o.d}\" fill=\"${col(o.fill)}\"/>`;","category":"external_commands","line_end":193,"severity":"medium","line_start":193},{"id":"external_commands:scripts/chapter_deck.mjs:196:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"await fs.writeFile(path.join(outDir,'slides',`slide_${String(i+1).padStart(2,'0')}.svg`),parts.join(","category":"external_commands","line_end":196,"severity":"medium","line_start":196},{"id":"external_commands:scripts/chapter_slideviber_design.mjs:19:ruby-shell-backtick-execution","file":"scripts/chapter_slideviber_design.mjs","pattern":"Ruby/shell backtick execution","snippet":"const x=64+i*(w+28),role=`design-${i}`;","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:scripts/chapter_slideviber_design.mjs:40:ruby-shell-backtick-execution","file":"scripts/chapter_slideviber_design.mjs","pattern":"Ruby/shell backtick execution","snippet":"put(b.text,x,y+65,298,65,34,`design-${i%2}`,true,9);","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:scripts/chapter_slideviber_design.mjs:56:ruby-shell-backtick-execution","file":"scripts/chapter_slideviber_design.mjs","pattern":"Ruby/shell backtick execution","snippet":"const x=64+i*(w+30),role=`design-${i}`;","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"external_commands:scripts/content_qa.py:53:ruby-shell-backtick-execution","file":"scripts/content_qa.py","pattern":"Ruby/shell backtick execution","snippet":"# ``\\w`` treats Chinese characters as word characters.  A source","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:scripts/content_resolver.py:17:ruby-shell-backtick-execution","file":"scripts/content_resolver.py","pattern":"Ruby/shell backtick execution","snippet":"# This is the shared formal renderer schema. ``None`` is deliberate for a","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:scripts/ppt_theme_samples.mjs:48:ruby-shell-backtick-execution","file":"scripts/ppt_theme_samples.mjs","pattern":"Ruby/shell backtick execution","snippet":"function svgText(t,x,y,w,h,size,color,bold=false,align='left'){return `<foreignObject x=\"${x*1.5}\" y","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:scripts/ppt_theme_samples.mjs:60:ruby-shell-backtick-execution","file":"scripts/ppt_theme_samples.mjs","pattern":"Ruby/shell backtick execution","snippet":"const r=(x,y,w,h,col)=>parts.push(`<rect x=\"${x*1.5}\" y=\"${y*1.5}\" width=\"${w*1.5}\" height=\"${h*1.5}","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:scripts/ppt_theme_samples.mjs:79:ruby-shell-backtick-execution","file":"scripts/ppt_theme_samples.mjs","pattern":"Ruby/shell backtick execution","snippet":"}await fs.writeFile(path.join(outDir,'slides',`slide_${n+1}.svg`),parts.join('\\n'));","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:scripts/report_model_projection.py:47:ruby-shell-backtick-execution","file":"scripts/report_model_projection.py","pattern":"Ruby/shell backtick execution","snippet":"# ``warnings`` and narrative diagnostics are page-order-dependent output","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:scripts/report_model_projection.py:189:ruby-shell-backtick-execution","file":"scripts/report_model_projection.py","pattern":"Ruby/shell backtick execution","snippet":"\"\"\"Return the single canonical formal-content projection, or ``None`` for retail/general models.\"\"\"","category":"external_commands","line_end":189,"severity":"medium","line_start":189},{"id":"external_commands:scripts/slideviber_consistency.py:428:ruby-shell-backtick-execution","file":"scripts/slideviber_consistency.py","pattern":"Ruby/shell backtick execution","snippet":"``python-pptx`` does not expose a reliable ``FillFormat.transparency``;","category":"external_commands","line_end":428,"severity":"medium","line_start":428},{"id":"external_commands:scripts/slideviber_consistency.py:429:ruby-shell-backtick-execution","file":"scripts/slideviber_consistency.py","pattern":"Ruby/shell backtick execution","snippet":"alpha lives under the shape's direct ``spPr`` solid-fill color node in the","category":"external_commands","line_end":429,"severity":"medium","line_start":429},{"id":"external_commands:scripts/slideviber_handoff.py:39:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"f\"  - `{token}`\"","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:scripts/slideviber_handoff.py:44:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"f\"  - `{item['lock_id']}`|{item['lock_type']}|\"","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:scripts/slideviber_handoff.py:57:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"f\"  - `{item['chart_id']}`|指标 {item.get('metric_name', '')}|\"","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:scripts/slideviber_handoff.py:65:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"- 推荐版式:`{slide['layout_id']}`(轮廓 `{slide['silhouette']}`)","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:scripts/slideviber_handoff.py:82:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"标准汇报版 `report.pptx` 必须先独立达到职场汇报标准。若需要更强的演示感,可继续使用 SlideViber,核验预览后导出 `report-polished.pptx`;没有已确认风格且","category":"external_commands","line_end":82,"severity":"medium","line_start":82},{"id":"external_commands:scripts/slideviber_handoff.py:93:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"- 有色强调卡或分区色带中的独立标题、标签和核心数值必须以容器几何中心为基准水平居中;SVG 文本使用容器中心 x 坐标并设置 `text-anchor=\"middle\"`,多行组合按整体视觉中心布置","category":"external_commands","line_end":93,"severity":"medium","line_start":93},{"id":"external_commands:scripts/slideviber_handoff.py:94:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"- 日期、数字与单位、指标名称和英文缩写属于不可拆语义单元;在 SVG `foreignObject` 中使用 `white-space: nowrap` 的内联容器保护,或使用等效不换行标记,不得把","category":"external_commands","line_end":94,"severity":"medium","line_start":94},{"id":"external_commands:scripts/slideviber_handoff.py:95:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"- 同一页的完整同比/环比周期只在固定元信息区声明一次;标题使用 `display_claim`,正文只保留“同比/环比”短标签与业务判断。语义锁中的完整原句用于追溯,不得机械复制到每个段落。","category":"external_commands","line_end":95,"severity":"medium","line_start":95},{"id":"external_commands:scripts/slideviber_handoff.py:98:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"- 导出后执行:`python scripts/slideviber_consistency.py --model report_model.json --pptx report-polished.p","category":"external_commands","line_end":98,"severity":"medium","line_start":98},{"id":"external_commands:scripts/slideviber_handoff.py:113:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"请以 `report_model.json` 的 `slide_plan` 为唯一内容真相源,按以上逐页 ID 和锁定证据重绘 16:9 演示稿;先依照上述主题选择来源处理:已确认方向直接沿用,明确授","category":"external_commands","line_end":113,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"将单张结构清晰的 `.xlsx` 或 `.csv` 转成可追溯的 HTML 决策简报,并按需生成达到职场汇报标准的可编辑 PPTX。","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `business_review`:回答经营变化、结构驱动、风险与行动;正式 HTML 按有证据的业务问题组织章节,不预设页数。","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `exploration`:在已确认语义范围内探索可验证线索;证据不足的内容降级为带限制的假设。","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `engineering_regression`:只输出计算合同、数据质量与回归核验 dossier,不生成经营洞察或行动建议。","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 汇报目标、受众和 `analysis_intent`","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"先查看字段名和少量预览。可运行 `python scripts/sheet_to_report.py --inspect path/to/data.xlsx` 获取机器可读的候选字段与待确认问题。若发","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`分析意图 → 语义能力与质量决定 → 分析简报 → 候选问题图 → 确定性计算与受控补查 → 决策章节 → 行动合同 → 内容 QA → HTML/PPT`","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `analysis_profile=auto` 是默认入口。`general`、`retail_growth` 与 `transactional_commerce` 为 verified;`con","category":"external_commands","line_end":76,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 新比率请求明确单行分母为零的处理。全量投入除以全量产出等总量比率使用 `zero_denominator_policy=include_in_totals`,保留零产出行的投入;仅汇总分母为零时不","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 高优先问题按“事实—驱动—细分—经营含义”记录 `required_depth / achieved_depth`。深度不足且仍有合法表内路径时必须继续受控补查;没有真实信息增量时降级,不能用非空","category":"external_commands","line_end":81,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `report_model.json` 是一次生成的内容真相源,洞察、行动、图表均引用可解析的 evidence ID。新版 `html-chapters/1` 通过独立 `chapter-pre","category":"external_commands","line_end":83,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":91,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":93,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"PPT阶段另运行 `python scripts/environment_check.py --target standard`;美化版改为 `--target slideviber --slidev","category":"external_commands","line_end":93,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. 预检提示缺少依赖时,再运行 `python -m pip install -r requirements.txt`;不要把依赖或生成文件打包进 Skill。普通安装不要求Git;版本追溯保留文件","category":"external_commands","line_end":98,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":100,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":102,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **正式 HTML 默认由宿主 AI 驱动**。先读 [宿主 HTML 分析合同](references/html-analysis.md),显式使用本 Skill 绝对目录。初扫 → 阅读证据","category":"external_commands","line_end":104,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":106,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":108,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **以下为旧模型兼容入口,不接续上面的新版 HTML 流程。** 经确认的旧分析流程可分两阶段运行。`--analyse-only` 只生成确定性 `analysis_evidence.json","category":"external_commands","line_end":108,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":113,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":115,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"默认 story plan 只能重排已有内容。若表内已有结构证据却缺经营判断,先由当前 AI 阅读冻结证据,按 [证据后判断提案](references/report-model.md#证据后判断提案","category":"external_commands","line_end":116,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. 新版 HTML 在组织提案前读取 [共享图表规格](references/chart-spec.md)。按判断任务与数据条件选图,用 `chart-spec/1` 记录选择理由、限制、尺度和重点","category":"external_commands","line_end":116,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"7. 若用户选择 PPTX,新版 HTML 先读取 [章节到演示投影](references/chapter-presentation.md),使用独立 `chapter-presentation/1","category":"external_commands","line_end":117,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"8. 生成任何PPT前读取 [主题选择](references/ppt-theme-selection.md)。用户明确说“你决定、直接生成”且无已确认偏好时,使用默认清晰商务;已明确指定或已确认沿用","category":"external_commands","line_end":118,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"9. 美化稿在同一显示尺寸下对照标准稿,检查视觉焦点、图文对应、图表可读性及整稿节奏;只换颜色、分辨率或导出器不算美化完成。精修版导出后运行对应合同的一致性检查;缺少日期、关键数值、判断标题或 evi","category":"external_commands","line_end":119,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":123,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":127,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"本节页数、旧字段与 featured 限制描述旧模型兼容行为。新版 `html-chapters/1` 以宿主 HTML 合同为准,背景可进正文、无需制造行动;主图设计与正文事实选择相互独立。","category":"external_commands","line_end":129,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 6–10 页只适用于证据充足的 `business_review`;页面由已选择的分析镜头和直接证据决定,不凑固定页数。证据不足返回 `needs_input / insufficient_evi","category":"external_commands","line_end":129,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `engineering_regression` 使用明确的 QA dossier,允许少于 6 页;不得出现经营复盘、管理摘要、经营杠杆或行动路线等业务包装。","category":"external_commands","line_end":131,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `analysis_brief` 固化受众、目标、节奏与最小必要确认;`candidate_question_graph` 保留问题来源、初扫信号、选择/拒绝理由和字段支持。","category":"external_commands","line_end":131,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `analysis_lenses` 记录问题、优先级、所需对象、指标、深度缺口、补查轨迹和停止原因。未选择、不可用或深度不足的问题不得伪装成核心回答。","category":"external_commands","line_end":133,"severity":"medium","line_start":132},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `analysis_chapters` 以问题为单位组合事实、驱动、细分、经营含义、图表和行动;管理摘要只引用已入选章节。","category":"external_commands","line_end":134,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- evidence 必须记录公式、过滤范围、样本数、受影响行数/金额、业务对象和限制;事实、诊断、推断、假设分别声明 `claim_type`、`evidence_strength` 和限制。","category":"external_commands","line_end":134,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `content_validation` 阻断原始字段泄漏、数字复述、无证据因果、重复结论、套话、空槽、悬空 evidence 和未解析占位符。","category":"external_commands","line_end":142,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 主标题是报告身份与分析主题,不得使用 Skill 产品名。`report_subtitle` 只承载周期或范围,`judgement_headline` 承载最重要判断。","category":"external_commands","line_end":142,"severity":"medium","line_start":142},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `period_overview` 展示分析期累计或整体口径;`latest_snapshot` 展示最新完整周期及实际对比周期。禁止把最新一个周期冒充整个分析期。","category":"external_commands","line_end":143,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 章节标题使用业务判断,正文明确对应问题、经营含义、证明图表、行动和边界。原始 `chapter_id / question_id / evidence_id` 只留在模型与 QA,不进入观众可见正","category":"external_commands","line_end":146,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `featured` 继续作为旧接口兼容和章节内部候选记录;最终正文选择以 `value_selection.selection_unit=analysis_chapter` 与 `analysi","category":"external_commands","line_end":146,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 设计表达根据本页已有内容关系选择构图,不能用大小、顺序或颜色制造未经支持的优先级与因果;图表重点须绑定图中类别及本页判断,强调区不能只重复原读数。美化可将正文无损分段或呈现有原文依据的步骤,必须逐","category":"external_commands","line_end":160,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `visual_spec.eyebrow` 使用中文功能眉题;`tone`、`density`、`focus_evidence_ids`、`display_claim`、可选比较口径和图表焦点控制","category":"external_commands","line_end":160,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 所有中文运行使用 `lang=zh-CN`,段落启用东亚换行与悬挂标点;PPT QA 必须检查孤立标点、字号、边界、重叠、对比度、布局角色、视觉焦点、密度和重复口径。","category":"external_commands","line_end":170,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":172,"severity":"medium","line_start":170},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":174,"severity":"medium","line_start":172},{"id":"external_commands:.github/workflows/public-checks.yml:27:shell-command-substitution","file":".github/workflows/public-checks.yml","pattern":"Shell command substitution","snippet":"sample=\"$(find generated-sample -maxdepth 1 -type f -name '*.xlsx' -print -quit)\"","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"blocker:scripts/environment_check.py:51:network-reconnaissance","file":"scripts/environment_check.py","pattern":"Network reconnaissance","snippet":"if not good:issues.append('Node.js 18+ unavailable; install Node or pass --node PATH')","category":"blocker","line_end":51,"severity":"low","line_start":51},{"id":"blocker:scripts/environment_check.py:57:network-reconnaissance","file":"scripts/environment_check.py","pattern":"Network reconnaissance","snippet":"if not good:issues.append('SlideViber not located; install separately and pass --slideviber-dir PATH","category":"blocker","line_end":57,"severity":"low","line_start":57},{"id":"blocker:docs/index.html:11:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":"*{box-sizing:border-box}html{scroll-behavior:smooth}body{margin:0;background:var(--paper);color:var(","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"blocker:docs/index.html:12:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":".site-nav{position:sticky;top:0;z-index:20;background:rgba(247,249,252,.96);border-bottom:1px solid ","category":"blocker","line_end":12,"severity":"low","line_start":12},{"id":"blocker:docs/index.html:13:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":"main{overflow:hidden}.hero{width:min(calc(100% - 40px),var(--max));min-height:650px;margin:0 auto;di","category":"blocker","line_end":13,"severity":"low","line_start":13},{"id":"blocker:docs/index.html:14:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":".section{width:min(calc(100% - 40px),var(--max));margin:0 auto;padding:96px 0}.section-title{margin:","category":"blocker","line_end":14,"severity":"low","line_start":14},{"id":"blocker:docs/index.html:15:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":".compare-wrap{background:var(--white)}.pair-nav{display:flex;flex-wrap:wrap;gap:10px;margin:30px 0 0","category":"blocker","line_end":15,"severity":"low","line_start":15},{"id":"blocker:docs/index.html:16:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":".case-band{background:#102b4e;color:#fff}.case-band .section-lead{color:#bfd0e6}.facts{display:grid;","category":"blocker","line_end":16,"severity":"low","line_start":16},{"id":"blocker:docs/index.html:17:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":"@media(max-width:900px){.hero{min-height:0;grid-template-columns:1fr;gap:46px;padding-top:60px}.hero","category":"blocker","line_end":17,"severity":"low","line_start":17},{"id":"blocker:docs/index.html:18:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":"@media(max-width:660px){.nav-inner{width:min(calc(100% - 28px),var(--max))}.nav-links a:not(:last-ch","category":"blocker","line_end":18,"severity":"low","line_start":18},{"id":"blocker:docs/report.html:3:system-reconnaissance","file":"docs/report.html","pattern":"System reconnaissance","snippet":":root{--ink:#263341;--muted:#596777;--paper:#faf9f6;--line:#dde2e8;--nav:64px;--blue:#24528a;--green","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:README.md:27:system-reconnaissance","file":"README.md","pattern":"System reconnaissance","snippet":"| ![Standard deck: a full-width editable chart shows that paid advertising return fell from the prio","category":"blocker","line_end":27,"severity":"low","line_start":27},{"id":"blocker:references/report-model.md:92:system-reconnaissance","file":"references/report-model.md","pattern":"System reconnaissance","snippet":"- 默认 story plan 只保存已有 `slide_id / layout_id / evidence_ids / chart_ids / content_refs` 的选择与顺序;不能修改页面","category":"blocker","line_end":92,"severity":"low","line_start":92},{"id":"blocker:references/report-model.md:109:system-reconnaissance","file":"references/report-model.md","pattern":"System reconnaissance","snippet":"- `proposal_id / question_id`:唯一提案 ID、受支持且已选择的真实问题 ID。","category":"blocker","line_end":109,"severity":"low","line_start":109},{"id":"blocker:references/report-model.md:187:system-reconnaissance","file":"references/report-model.md","pattern":"System reconnaissance","snippet":"- `analysis_chapters[]` 是正式正文选择单位。每章至少包含 `chapter_id / question_id / decision_question / judgement /","category":"blocker","line_end":187,"severity":"low","line_start":187},{"id":"blocker:references/report-model.md:207:system-reconnaissance","file":"references/report-model.md","pattern":"System reconnaissance","snippet":"- 洞察、章节、图表和行动通过证据引用绑定 `scope_id / scope_disclosure`。章节合并校验 `fact_evidence_ids / driver_evidence_ids ","category":"blocker","line_end":207,"severity":"low","line_start":207},{"id":"blocker:references/report-model.md:225:system-reconnaissance","file":"references/report-model.md","pattern":"System reconnaissance","snippet":"`formal` 必须严格为布尔 true;action_id 唯一且非空,步骤/护栏为非空字符串列表,限制为字符串列表,成功信号为非空字符串,不能把当前观测直接重复为试验成功条件。标准化只补真正缺省","category":"blocker","line_end":225,"severity":"low","line_start":225},{"id":"blocker:scripts/analysis_depth.py:118:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"\"window\": next((scope_id for scope_id in seen if catalog[scope_id].get(\"rules\", {}).get(\"stage\") == ","category":"blocker","line_end":118,"severity":"low","line_start":118},{"id":"blocker:scripts/analysis_depth.py:193:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"for cid in owners:","category":"blocker","line_end":193,"severity":"low","line_start":193},{"id":"blocker:scripts/analysis_depth.py:195:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"if chapter.get(\"selection_status\") != \"selected\" or aid not in chapter.get(\"action_ids\", []):","category":"blocker","line_end":195,"severity":"low","line_start":195},{"id":"blocker:scripts/analysis_depth.py:199:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"iid in chapter.get(\"insight_ids\", [])","category":"blocker","line_end":199,"severity":"low","line_start":199},{"id":"blocker:scripts/analysis_depth.py:201:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"for iid in source_ids","category":"blocker","line_end":201,"severity":"low","line_start":201},{"id":"blocker:scripts/analysis_depth.py:205:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"# one valid source cannot lend this action to another question.","category":"blocker","line_end":205,"severity":"low","line_start":205},{"id":"blocker:scripts/analysis_depth.py:206:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"for iid in action.get(\"source_insight_ids\", []):","category":"blocker","line_end":206,"severity":"low","line_start":206},{"id":"blocker:scripts/analysis_depth.py:207:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"if not any(iid in chapters[cid].get(\"insight_ids\", [])","category":"blocker","line_end":207,"severity":"low","line_start":207},{"id":"blocker:scripts/analysis_depth.py:208:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"and insights.get(iid, {}).get(\"question_id\") == chapters[cid].get(\"question_id\") for cid in owners):","category":"blocker","line_end":208,"severity":"low","line_start":208},{"id":"blocker:scripts/analysis_depth.py:213:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"aid not in actions or cid not in actions[aid].get(\"source_chapter_ids\", []) for aid in refs","category":"blocker","line_end":213,"severity":"low","line_start":213},{"id":"blocker:scripts/analysis_depth.py:220:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"insights=[representative], actions=[actions[aid] for aid in refs], scope_catalog=model.get(\"scope_ca","category":"blocker","line_end":220,"severity":"low","line_start":220},{"id":"blocker:scripts/analysis_depth.py:230:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"valid = [r for r in history if _positive(r.get('total')) and _number(r.get('top_5_share'))","category":"blocker","line_end":230,"severity":"low","line_start":230},{"id":"blocker:scripts/analysis_depth.py:323:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"scope_id = evidence.get(\"scope_id\")","category":"blocker","line_end":323,"severity":"low","line_start":323},{"id":"blocker:scripts/analysis_depth.py:324:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"if scope_id not in catalog or not catalog[scope_id].get(\"population_sha256\"):","category":"blocker","line_end":324,"severity":"low","line_start":324},{"id":"blocker:scripts/analysis_engine.py:117:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"raise ValueError(\"invalid zero_denominator_policy\")","category":"blocker","line_end":117,"severity":"low","line_start":117},{"id":"blocker:scripts/analysis_engine.py:457:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"valid = numerator.notna() & denominator.notna()","category":"blocker","line_end":457,"severity":"low","line_start":457},{"id":"blocker:scripts/analysis_engine.py:459:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"return valid","category":"blocker","line_end":460,"severity":"low","line_start":459},{"id":"blocker:scripts/analysis_engine.py:460:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"return valid & denominator.ne(0)","category":"blocker","line_end":460,"severity":"low","line_start":460},{"id":"blocker:scripts/analysis_engine.py:508:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"valid = _source_valid_mask(frame, contract)","category":"blocker","line_end":508,"severity":"low","line_start":508},{"id":"blocker:scripts/analysis_engine.py:539:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"valid = _source_valid_mask(frame, contract)","category":"blocker","line_end":539,"severity":"low","line_start":539},{"id":"blocker:scripts/analysis_engine.py:579:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"valid = _source_valid_mask(frame, contract)","category":"blocker","line_end":579,"severity":"low","line_start":579},{"id":"blocker:scripts/analysis_engine.py:729:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"valid = source.loc[_source_valid_mask(source, contract)]","category":"blocker","line_end":729,"severity":"low","line_start":729},{"id":"blocker:scripts/analysis_engine.py:736:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"scope_id = register(rows, \"baseline\" if tool == \"quality_impact\" else \"result\")","category":"blocker","line_end":736,"severity":"low","line_start":736},{"id":"blocker:scripts/analysis_engine.py:983:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = f\"dimension:{dimension}:{metric_name}\"","category":"blocker","line_end":983,"severity":"low","line_start":983},{"id":"blocker:scripts/analysis_engine.py:1051:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"rank_by_id = {","category":"blocker","line_end":1051,"severity":"low","line_start":1051},{"id":"blocker:scripts/analysis_engine.py:1057:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"candidate_by_id = {","category":"blocker","line_end":1057,"severity":"low","line_start":1057},{"id":"blocker:scripts/analysis_engine.py:1193:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"window_scope_id = scope_registry.register(work, rules={","category":"blocker","line_end":1193,"severity":"low","line_start":1193},{"id":"blocker:scripts/analysis_engine.py:1253:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = f\"metric:{name}:trend\"","category":"blocker","line_end":1253,"severity":"low","line_start":1253},{"id":"blocker:scripts/analysis_engine.py:1366:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = f\"dimension:{dimension}:{name}\"","category":"blocker","line_end":1366,"severity":"low","line_start":1366},{"id":"blocker:scripts/analysis_engine.py:1389:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = f\"dimension:{dimension}:{name}\"","category":"blocker","line_end":1389,"severity":"low","line_start":1389},{"id":"blocker:scripts/analysis_engine.py:1459:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = f\"dimension-yoy:{dimension}:{name}:{value}\"","category":"blocker","line_end":1459,"severity":"low","line_start":1459},{"id":"blocker:scripts/analysis_engine.py:1460:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id += value_identity[\"evidence_suffix\"]","category":"blocker","line_end":1460,"severity":"low","line_start":1460},{"id":"blocker:scripts/analysis_engine.py:1574:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"valid = source_rows.loc[_source_valid_mask(source_rows, contract)]","category":"blocker","line_end":1574,"severity":"low","line_start":1574},{"id":"blocker:scripts/analysis_engine.py:1601:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"insight_id = f\"diagnostic-{len(diagnostic_insights) + 1:02d}\"","category":"blocker","line_end":1601,"severity":"low","line_start":1601},{"id":"blocker:scripts/analysis_engine.py:1633:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"for eid in evidence_ids if eid in evidence_index","category":"blocker","line_end":1633,"severity":"low","line_start":1633},{"id":"blocker:scripts/analysis_engine.py:1792:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = (","category":"blocker","line_end":1792,"severity":"low","line_start":1792},{"id":"blocker:scripts/analysis_engine.py:2364:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = f\"seasonality:{revenue_name}:year-end\"","category":"blocker","line_end":2364,"severity":"low","line_start":2364},{"id":"blocker:scripts/analysis_engine.py:2425:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id","category":"blocker","line_end":2426,"severity":"low","line_start":2425},{"id":"blocker:scripts/analysis_engine.py:2427:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"for evidence_id in chart.get(\"evidence_ids\", [])","category":"blocker","line_end":2427,"severity":"low","line_start":2427},{"id":"blocker:scripts/analysis_engine.py:2509:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"dimension_evidence_id = f\"dimension:{dimension}:{name}\"","category":"blocker","line_end":2509,"severity":"low","line_start":2509},{"id":"blocker:scripts/analysis_engine.py:2767:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"insight_by_id = {item[\"insight_id\"]: item for item in diagnostic_insights}","category":"blocker","line_end":2767,"severity":"low","line_start":2767},{"id":"blocker:scripts/analysis_engine.py:2770:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"for insight_id in narrative_insights[:3]","category":"blocker","line_end":2770,"severity":"low","line_start":2770},{"id":"blocker:scripts/analysis_engine.py:2774:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"for insight_id in narrative_insights[:3]","category":"blocker","line_end":2774,"severity":"low","line_start":2774},{"id":"blocker:scripts/analysis_followup.py:359:system-reconnaissance","file":"scripts/analysis_followup.py","pattern":"System reconnaissance","snippet":"evidence_id = \"followup:\" + path_hash[:16]","category":"blocker","line_end":359,"severity":"low","line_start":359},{"id":"blocker:scripts/analysis_followup.py:372:system-reconnaissance","file":"scripts/analysis_followup.py","pattern":"System reconnaissance","snippet":"and evidence_id not in existing_evidence","category":"blocker","line_end":372,"severity":"low","line_start":372},{"id":"blocker:scripts/analysis_followup.py:380:system-reconnaissance","file":"scripts/analysis_followup.py","pattern":"System reconnaissance","snippet":"for known_id in matched_ids[:1]:","category":"blocker","line_end":380,"severity":"low","line_start":380},{"id":"blocker:scripts/analysis_followup.py:381:system-reconnaissance","file":"scripts/analysis_followup.py","pattern":"System reconnaissance","snippet":"if known_id not in existing_evidence:","category":"blocker","line_end":381,"severity":"low","line_start":381},{"id":"blocker:SKILL.md:145:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- 章节标题使用业务判断,正文明确对应问题、经营含义、证明图表、行动和边界。原始 `chapter_id / question_id / evidence_id` 只留在模型与 QA,不进入观众可见正","category":"blocker","line_end":145,"severity":"low","line_start":145},{"id":"obfuscation:scripts/chapter_deck.mjs:29:array-join-empty-string","file":"scripts/chapter_deck.mjs","pattern":"Array join empty string","snippet":"return result.map(v=>v.toString(16).padStart(2,'0')).join('').toUpperCase();","category":"obfuscation","line_end":29,"severity":"low","line_start":29},{"id":"obfuscation:scripts/chapter_slideviber_layout.mjs:154:unicode-escape-sequence","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Unicode escape sequence","snippet":"if(last>0 && /^[\\u3400-\\u9fff]$/.test(titleRows[last]) && /[\\u3400-\\u9fff]{2}$/.test(titleRows[last-","category":"obfuscation","line_end":154,"severity":"low","line_start":154},{"id":"obfuscation:scripts/ppt_qa.py:23:unicode-escape-sequence","file":"scripts/ppt_qa.py","pattern":"Unicode escape sequence","snippet":"CJK_PATTERN = re.compile(r\"[\\u3400-\\u9fff]\")","category":"obfuscation","line_end":23,"severity":"low","line_start":23},{"id":"obfuscation:scripts/slideviber_consistency.py:21:unicode-escape-sequence","file":"scripts/slideviber_consistency.py","pattern":"Unicode escape sequence","snippet":"CJK_PATTERN = re.compile(r\"[\\u3400-\\u9fff]\")","category":"obfuscation","line_end":21,"severity":"low","line_start":21},{"id":"env_access:scripts/chapter_deck.mjs:12:environment-variable-access-dot-notation","file":"scripts/chapter_deck.mjs","pattern":"Environment variable access (dot notation)","snippet":"const PY=process.env.RUNTIME_PYTHON||(process.platform==='win32'?'python':'python3');","category":"env_access","line_end":12,"severity":"low","line_start":12},{"id":"env_access:scripts/chapter_deck.mjs:13:environment-variable-access-dot-notation","file":"scripts/chapter_deck.mjs","pattern":"Environment variable access (dot notation)","snippet":"process.env.PYTHONUTF8='1';","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"env_access:scripts/ppt_theme_samples.mjs:12:environment-variable-access-dot-notation","file":"scripts/ppt_theme_samples.mjs","pattern":"Environment variable access (dot notation)","snippet":"const PY=process.env.RUNTIME_PYTHON||(process.platform==='win32'?'python':'python3');","category":"env_access","line_end":12,"severity":"low","line_start":12},{"id":"env_access:scripts/ppt_theme_samples.mjs:13:environment-variable-access-dot-notation","file":"scripts/ppt_theme_samples.mjs","pattern":"Environment variable access (dot notation)","snippet":"process.env.PYTHONUTF8='1';","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"env_access:scripts/chapter_deck.mjs:12:environment-variable-object","file":"scripts/chapter_deck.mjs","pattern":"Environment variable object","snippet":"const PY=process.env.RUNTIME_PYTHON||(process.platform==='win32'?'python':'python3');","category":"env_access","line_end":12,"severity":"low","line_start":12},{"id":"env_access:scripts/chapter_deck.mjs:13:environment-variable-object","file":"scripts/chapter_deck.mjs","pattern":"Environment variable object","snippet":"process.env.PYTHONUTF8='1';","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"env_access:scripts/ppt_theme_samples.mjs:12:environment-variable-object","file":"scripts/ppt_theme_samples.mjs","pattern":"Environment variable object","snippet":"const PY=process.env.RUNTIME_PYTHON||(process.platform==='win32'?'python':'python3');","category":"env_access","line_end":12,"severity":"low","line_start":12},{"id":"env_access:scripts/ppt_theme_samples.mjs:13:environment-variable-object","file":"scripts/ppt_theme_samples.mjs","pattern":"Environment variable object","snippet":"process.env.PYTHONUTF8='1';","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"network:docs/index.html:23:hardcoded-url","file":"docs/index.html","pattern":"Hardcoded URL","snippet":"<nav class=\"site-nav\" aria-label=\"案例导航\"><div class=\"nav-inner\"><a class=\"brand\" href=\"#top\" aria-lab","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:docs/index.html:38:hardcoded-url","file":"docs/index.html","pattern":"Hardcoded URL","snippet":"<section class=\"section\" aria-labelledby=\"download-title\"><h2 class=\"section-title\" id=\"download-tit","category":"network","line_end":38,"severity":"low","line_start":38},{"id":"network:docs/index.html:40:hardcoded-url","file":"docs/index.html","pattern":"Hardcoded URL","snippet":"<footer><span>sheet-to-report · v0.2 · Chinese-first</span><span><a href=\"https://github.com/majichu","category":"network","line_end":40,"severity":"low","line_start":40},{"id":"network:INSTALL.en.md:22:hardcoded-url","file":"INSTALL.en.md","pattern":"Hardcoded URL","snippet":"npx skills add https://github.com/majichuan/sheet-to-report","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:README.md:52:hardcoded-url","file":"README.md","pattern":"Hardcoded URL","snippet":"npx skills add https://github.com/majichuan/sheet-to-report --skill sheet-to-report","category":"network","line_end":52,"severity":"low","line_start":52},{"id":"network:README.zh-CN.md:50:hardcoded-url","file":"README.zh-CN.md","pattern":"Hardcoded URL","snippet":"npx skills add https://github.com/majichuan/sheet-to-report --skill sheet-to-report","category":"network","line_end":50,"severity":"low","line_start":50},{"id":"network:scripts/chapter_chart_qa.py:4:hardcoded-url","file":"scripts/chapter_chart_qa.py","pattern":"Hardcoded URL","snippet":"NS={'a':'http://schemas.openxmlformats.org/drawingml/2006/main','c':'http://schemas.openxmlformats.o","category":"network","line_end":4,"severity":"low","line_start":4},{"id":"network:scripts/chapter_native_scene_qa.py:11:hardcoded-url","file":"scripts/chapter_native_scene_qa.py","pattern":"Hardcoded URL","snippet":"NS={'c':'http://schemas.openxmlformats.org/drawingml/2006/chart',","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:scripts/chapter_native_scene_qa.py:12:hardcoded-url","file":"scripts/chapter_native_scene_qa.py","pattern":"Hardcoded URL","snippet":"'r':'http://schemas.openxmlformats.org/officeDocument/2006/relationships'}","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"network:scripts/chapter_pptx_prepare.py:9:hardcoded-url","file":"scripts/chapter_pptx_prepare.py","pattern":"Hardcoded URL","snippet":"A = 'http://schemas.openxmlformats.org/drawingml/2006/main'","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:scripts/chapter_presentation_qa.py:14:hardcoded-url","file":"scripts/chapter_presentation_qa.py","pattern":"Hardcoded URL","snippet":"NS = {\"a\": \"http://schemas.openxmlformats.org/drawingml/2006/main\",","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:scripts/chapter_presentation_qa.py:15:hardcoded-url","file":"scripts/chapter_presentation_qa.py","pattern":"Hardcoded URL","snippet":"\"p\": \"http://schemas.openxmlformats.org/presentationml/2006/main\",","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:scripts/chapter_presentation_qa.py:16:hardcoded-url","file":"scripts/chapter_presentation_qa.py","pattern":"Hardcoded URL","snippet":"\"c\": \"http://schemas.openxmlformats.org/drawingml/2006/chart\",","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:scripts/chapter_presentation_qa.py:17:hardcoded-url","file":"scripts/chapter_presentation_qa.py","pattern":"Hardcoded URL","snippet":"\"r\": \"http://schemas.openxmlformats.org/officeDocument/2006/relationships\"}","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:scripts/chapter_vector_qa.py:14:hardcoded-url","file":"scripts/chapter_vector_qa.py","pattern":"Hardcoded URL","snippet":"NS = {'a': 'http://schemas.openxmlformats.org/drawingml/2006/main',","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:scripts/chapter_vector_qa.py:15:hardcoded-url","file":"scripts/chapter_vector_qa.py","pattern":"Hardcoded URL","snippet":"'p': 'http://schemas.openxmlformats.org/presentationml/2006/main'}","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:scripts/slideviber_consistency.py:23:hardcoded-url","file":"scripts/slideviber_consistency.py","pattern":"Hardcoded URL","snippet":"A_NS = \"http://schemas.openxmlformats.org/drawingml/2006/main\"","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:scripts/slideviber_handoff.py:89:hardcoded-url","file":"scripts/slideviber_handoff.py","pattern":"Hardcoded URL","snippet":"- 官方项目:https://github.com/tf71991/slideviber-skill","category":"network","line_end":89,"severity":"low","line_start":89},{"id":"network:SKILL.md:19:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **实际效果:** [在线查看完整合成案例](https://majichuan.github.io/sheet-to-report/),包括 HTML、标准 PPT 与 SlideViber 美","category":"network","line_end":19,"severity":"low","line_start":19},{"id":"network:scripts/generate_sample.py:278:http-client-library","file":"scripts/generate_sample.py","pattern":"HTTP client library","snippet":"def _retail_main_request(source_path: str = \"retail-omnichannel-main.csv\") -> dict:","category":"network","line_end":278,"severity":"low","line_start":278},{"id":"network:scripts/generate_sample.py:634:http-client-library","file":"scripts/generate_sample.py","pattern":"HTTP client library","snippet":"request = _retail_main_request(experience_source)","category":"network","line_end":634,"severity":"low","line_start":634},{"id":"network:scripts/html_analysis.py:150:http-client-library","file":"scripts/html_analysis.py","pattern":"HTTP client library","snippet":"validate_request(request)","category":"network","line_end":150,"severity":"low","line_start":150},{"id":"network:scripts/sheet_to_report.py:1420:http-client-library","file":"scripts/sheet_to_report.py","pattern":"HTTP client library","snippet":"def validate_request(request: ReportRequest) -> None:","category":"network","line_end":1420,"severity":"low","line_start":1420},{"id":"network:scripts/sheet_to_report.py:1744:http-client-library","file":"scripts/sheet_to_report.py","pattern":"HTTP client library","snippet":"validate_request(request)","category":"network","line_end":1744,"severity":"low","line_start":1744},{"id":"network:scripts/sheet_to_report.py:2650:http-client-library","file":"scripts/sheet_to_report.py","pattern":"HTTP client library","snippet":"validate_request(request)","category":"network","line_end":2650,"severity":"low","line_start":2650},{"id":"network:scripts/sheet_to_report.py:3193:http-client-library","file":"scripts/sheet_to_report.py","pattern":"HTTP client library","snippet":"validate_request(request)","category":"network","line_end":3193,"severity":"low","line_start":3193},{"id":"env_access:scripts/environment_check.py:43:python-environment-access","file":"scripts/environment_check.py","pattern":"Python environment access","snippet":"executable=node or os.environ.get('RUNTIME_NODE') or shutil.which('node')","category":"env_access","line_end":43,"severity":"low","line_start":43},{"id":"env_access:scripts/environment_check.py:53:python-environment-access","file":"scripts/environment_check.py","pattern":"Python environment access","snippet":"folder=slideviber_dir or os.environ.get('SLIDEVIBER_DIR')","category":"env_access","line_end":53,"severity":"low","line_start":53},{"id":"env_access:scripts/html_analysis.py:56:python-environment-access","file":"scripts/html_analysis.py","pattern":"Python environment access","snippet":"env = {k: v for k, v in os.environ.items() if not k.upper().startswith(\"GIT_\")}","category":"env_access","line_end":56,"severity":"low","line_start":56},{"id":"filesystem:scripts/sheet_to_report.py:12:temp-file-creation","file":"scripts/sheet_to_report.py","pattern":"Temp file creation","snippet":"import tempfile","category":"filesystem","line_end":12,"severity":"low","line_start":12},{"id":"filesystem:scripts/sheet_to_report.py:2946:temp-file-creation","file":"scripts/sheet_to_report.py","pattern":"Temp file creation","snippet":"tempfile.mkdtemp(prefix=f\".{output_dir.name}.backup-\", dir=output_dir.parent)","category":"filesystem","line_end":2946,"severity":"low","line_start":2946},{"id":"filesystem:scripts/sheet_to_report.py:2992:temp-file-creation","file":"scripts/sheet_to_report.py","pattern":"Temp file creation","snippet":"tempfile.mkdtemp(prefix=f\".{output_dir.name}.staging-\", dir=output_dir.parent)","category":"filesystem","line_end":2992,"severity":"low","line_start":2992},{"id":"filesystem:scripts/slideviber_consistency.py:7:temp-file-creation","file":"scripts/slideviber_consistency.py","pattern":"Temp file creation","snippet":"import tempfile","category":"filesystem","line_end":7,"severity":"low","line_start":7},{"id":"filesystem:scripts/slideviber_consistency.py:540:temp-file-creation","file":"scripts/slideviber_consistency.py","pattern":"Temp file creation","snippet":"with tempfile.NamedTemporaryFile(","category":"filesystem","line_end":540,"severity":"low","line_start":540}],"finding_verdicts":[{"id":"sensitive:scripts/transactional_story.py:108:certificate-key-files","reason":"The match is a comment describing an evidence key, not a certificate or private-key read. No credential material is accessed or transmitted at this location.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:.github/workflows/public-checks.yml:56:environment-file-access","reason":"The workflow checks repository paths for .env, bytecode, and cache entries before publication. It does not read environment values or transmit sensitive data.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:.gitignore:20:environment-file-access","reason":"This is a repository ignore rule for environment or SQLite files, which prevents accidental inclusion rather than reading or exfiltrating sensitive data.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:.gitignore:21:environment-file-access","reason":"This is a repository ignore rule for environment or SQLite files, which prevents accidental inclusion rather than reading or exfiltrating sensitive data.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:.gitignore:22:environment-file-access","reason":"This is a repository ignore rule for environment or SQLite files, which prevents accidental inclusion rather than reading or exfiltrating sensitive data.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:scripts/chapter_deck.mjs:12:environment-file-access","reason":"The match is runtime interpreter selection or UTF-8 configuration through process.env. It does not read a secret value or send environment contents anywhere.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:scripts/chapter_deck.mjs:13:environment-file-access","reason":"The match is runtime interpreter selection or UTF-8 configuration through process.env. It does not read a secret value or send environment contents anywhere.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:scripts/ppt_theme_samples.mjs:12:environment-file-access","reason":"The match is runtime interpreter selection or UTF-8 configuration through process.env. It does not read a secret value or send environment contents anywhere.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:scripts/ppt_theme_samples.mjs:13:environment-file-access","reason":"The match is runtime interpreter selection or UTF-8 configuration through process.env. It does not read a secret value or send environment contents anywhere.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:3:heuristic-extremely-long-line-5138-chars-likely-","reason":"The long line is generated CSS or HTML output, not hidden executable logic. Its content is readable presentation markup and does not indicate an encoded payload.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/html_chapter_renderer.py:131:heuristic-extremely-long-line-5138-chars-likely-","reason":"The long line is generated CSS or HTML output, not hidden executable logic. Its content is readable presentation markup and does not indicate an encoded payload.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-extremely-long-line-78488-chars-likely","reason":"The long line is generated CSS or HTML output, not hidden executable logic. Its content is readable presentation markup and does not indicate an encoded payload.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/slideviber_handoff.py:1:heuristic-high-file-entropy-6-21-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/chart-spec.md:1:heuristic-high-file-entropy-6-94-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:DEMO.zh-CN.md:1:heuristic-high-file-entropy-7-20-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:QUICKSTART.zh-CN.md:1:heuristic-high-file-entropy-7-23-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/report-model.md:1:heuristic-high-file-entropy-7-24-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/quick-help.md:1:heuristic-high-file-entropy-7-33-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:FAQ.md:1:heuristic-high-file-entropy-7-39-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:README.zh-CN.md:1:heuristic-high-file-entropy-7-43-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/ppt-theme-selection.md:1:heuristic-high-file-entropy-7-62-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:INSTALL.md:1:heuristic-high-file-entropy-7-75-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/html-analysis.md:1:heuristic-high-file-entropy-7-88-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-88-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/chapter-presentation.md:1:heuristic-high-file-entropy-7-99-bits-possible-b","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/html_transaction_facts.py:1:heuristic-multiple-bracket-chains-10-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/question_evidence.py:1:heuristic-multiple-bracket-chains-10-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/html_qa.py:1:heuristic-multiple-bracket-chains-12-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/presentation_contracts.py:1:heuristic-multiple-bracket-chains-13-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/analysis_questions.py:1:heuristic-multiple-bracket-chains-15-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/analysis_depth.py:1:heuristic-multiple-bracket-chains-18-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/slideviber_consistency.py:1:heuristic-multiple-bracket-chains-18-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/analysis_followup.py:1:heuristic-multiple-bracket-chains-20-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/html_evidence.py:1:heuristic-multiple-bracket-chains-20-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/analysis_engine.py:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/build_pptx.py:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/model_validation.py:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/content_resolver.py:1:heuristic-multiple-bracket-chains-29-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/narrative_planner.py:1:heuristic-multiple-bracket-chains-32-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/sheet_to_report.py:1:heuristic-multiple-bracket-chains-33-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/content_qa.py:1:heuristic-multiple-bracket-chains-38-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/html_renderer.py:1:heuristic-multiple-bracket-chains-43-jsfuck-obfu","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/chart_svg_renderer.py:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/html_analysis.py:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/chapter_deck.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/chart_evidence.py:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/ppt_qa.py:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/report_model_projection.py:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/transactional_story.py:1:heuristic-multiple-bracket-chains-9-jsfuck-obfus","reason":"The bracket sequences are ordinary Python or JavaScript collection syntax in readable source. No JSFuck payload or concealed control flow is present.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-53-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/index.html:29:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/html_transaction_facts.py:111:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/html_renderer.py:717:heuristic-very-high-entropy-string-5-55-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/analysis_engine.py:2073:heuristic-very-high-entropy-string-5-57-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/analysis_engine.py:1678:heuristic-very-high-entropy-string-5-61-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/report-model.md:171:heuristic-very-high-entropy-string-5-62-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/index.html:27:heuristic-very-high-entropy-string-5-66-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-66-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-67-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/chapter-presentation.md:9:heuristic-very-high-entropy-string-5-70-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-71-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/slideviber_handoff.py:113:heuristic-very-high-entropy-string-5-72-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/index.html:37:heuristic-very-high-entropy-string-5-73-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/report_model_projection.py:171:heuristic-very-high-entropy-string-5-73-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/sheet_to_report.py:369:heuristic-very-high-entropy-string-5-74-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/html_analysis.py:385:heuristic-very-high-entropy-string-5-75-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/index.html:38:heuristic-very-high-entropy-string-5-76-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/html_transaction_facts.py:171:heuristic-very-high-entropy-string-5-78-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/transactional_story.py:346:heuristic-very-high-entropy-string-5-78-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-80-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/chapter-presentation.md:29:heuristic-very-high-entropy-string-5-81-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/index.html:31:heuristic-very-high-entropy-string-5-82-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-84-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-85-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/index.html:26:heuristic-very-high-entropy-string-5-94-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-94-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-96-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/index.html:25:heuristic-very-high-entropy-string-5-98-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/report-model.md:205:heuristic-very-high-entropy-string-6-04-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-13-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-16-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-17-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/chapter-presentation.md:15:heuristic-very-high-entropy-string-6-19-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:SKILL.md:116:heuristic-very-high-entropy-string-6-23-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/html-analysis.md:13:heuristic-very-high-entropy-string-6-29-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-34-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-42-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:references/chapter-presentation.md:21:heuristic-very-high-entropy-string-6-87-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/slideviber_handoff.py:113:heuristic-very-high-entropy-string-6-95-bits-lik","reason":"The flagged text is readable documentation, HTML copy, or source-language prose with ordinary formatting. High character diversity alone is insufficient evidence of encryption or concealed execution.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/chapter_deck.mjs:63:hex-encoded-characters","reason":"The hexadecimal expressions are character-class and color-format handling for rendering and text-width checks. They do not decode or execute an opaque payload.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/chapter_slideviber_layout.mjs:13:hex-encoded-characters","reason":"The hexadecimal expressions are character-class and color-format handling for rendering and text-width checks. They do not decode or execute an opaque payload.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/content_qa.py:56:hex-encoded-characters","reason":"The hexadecimal expressions are character-class and color-format handling for rendering and text-width checks. They do not decode or execute an opaque payload.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/chapter_deck.mjs:5:node-js-child-process-module","reason":"The module is used by presentation scripts to invoke a local Python helper with an explicit executable and argument array. It does not use a shell or concatenate a command string.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/ppt_theme_samples.mjs:6:node-js-child-process-module","reason":"The module is used by presentation scripts to invoke a local Python helper with an explicit executable and argument array. It does not use a shell or concatenate a command string.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_deck.mjs:24:path-traversal-sequence","reason":"The first matches are regular expressions for hexadecimal pairs, and the later match is an explicit archive path-safety rejection. No unchecked traversal is introduced at these locations.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_deck.mjs:26:path-traversal-sequence","reason":"The first matches are regular expressions for hexadecimal pairs, and the later match is an explicit archive path-safety rejection. No unchecked traversal is introduced at these locations.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_presentation_qa.py:152:path-traversal-sequence","reason":"The first matches are regular expressions for hexadecimal pairs, and the later match is an explicit archive path-safety rejection. No unchecked traversal is introduced at these locations.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:.github/workflows/public-checks.yml:51:python-subprocess-check-output","reason":"The call runs fixed git subcommands in the skill repository for optional provenance. Arguments are separate values and the environment is filtered, so no shell injection vector is shown.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/html_analysis.py:60:python-subprocess-check-output","reason":"The call runs fixed git subcommands in the skill repository for optional provenance. Arguments are separate values and the environment is filtered, so no shell injection vector is shown.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/environment_check.py:47:python-subprocess-run","reason":"The calls perform bounded local tool checks with argument arrays and timeouts. They do not execute user-provided shell text.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/visual_verification.py:102:python-subprocess-run","reason":"The calls perform bounded local tool checks with argument arrays and timeouts. They do not execute user-provided shell text.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/visual_verification.py:128:python-subprocess-run","reason":"The calls perform bounded local tool checks with argument arrays and timeouts. They do not execute user-provided shell text.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:14:synchronous-file-execution","reason":"The synchronous calls invoke fixed local Python helpers with separated arguments for report generation. No shell expansion or arbitrary command string is used.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:199:synchronous-file-execution","reason":"The synchronous calls invoke fixed local Python helpers with separated arguments for report generation. No shell expansion or arbitrary command string is used.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/ppt_theme_samples.mjs:15:synchronous-file-execution","reason":"The synchronous calls invoke fixed local Python helpers with separated arguments for report generation. No shell expansion or arbitrary command string is used.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/ppt_theme_samples.mjs:51:synchronous-file-execution","reason":"The synchronous calls invoke fixed local Python helpers with separated arguments for report generation. No shell expansion or arbitrary command string is used.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/ppt_theme_samples.mjs:54:synchronous-file-execution","reason":"The synchronous calls invoke fixed local Python helpers with separated arguments for report generation. No shell expansion or arbitrary command string is used.","verdict":"false_positive","confidence":0.9},{"id":"blocker:scripts/html_renderer.py:269:template-injection-targeting-system-prompt","reason":"The flagged lines are escaped CSS inside an HTML template string. They contain no system prompt, instruction override, or executable template expression.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/html_renderer.py:662:template-injection-targeting-system-prompt","reason":"The flagged lines are escaped CSS inside an HTML template string. They contain no system prompt, instruction override, or executable template expression.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:.gitignore:30:sqlite-database-file","reason":"This is a repository ignore rule for environment or SQLite files, which prevents accidental inclusion rather than reading or exfiltrating sensitive data.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/html_qa.py:219:deprecated-unescape-function","reason":"The match is a text-decoding compatibility call used while processing report content. No executable script or attacker-controlled code is evaluated.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/html_qa.py:235:deprecated-unescape-function","reason":"The match is a text-decoding compatibility call used while processing report content. No executable script or attacker-controlled code is evaluated.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/build_pptx.py:22:dynamic-import-expression","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/content_qa.py:7:dynamic-import-expression","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/html_renderer.py:9:dynamic-import-expression","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/model_validation.py:8:dynamic-import-expression","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/model_validation.py:17:dynamic-import-expression","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/narrative_planner.py:7:dynamic-import-expression","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/ppt_qa.py:13:dynamic-import-expression","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/sheet_to_report.py:32:dynamic-import-expression","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/sheet_to_report.py:40:dynamic-import-expression","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:20:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:48:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:51:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:55:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:70:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:71:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:73:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:75:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:76:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:77:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:78:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:80:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:81:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:82:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:83:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:85:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:87:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:88:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:89:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:90:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:91:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:92:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:96:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:98:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:100:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:102:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:104:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:105:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:109:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:111:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:114:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:116:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:119:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:121:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:123:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:125:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:127:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:129:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:134:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:136:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:138:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:139:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:142:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:143:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:144:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:147:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:148:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/chart_contract.py:149:dynamic-require-with-variable","reason":"The match is an ordinary local module import or validation helper named `_require`. It is not dynamic code execution or arbitrary module loading.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/chapter_deck.mjs:31:hidden-file-access","reason":"The code checks or preserves dot-prefixed project files as part of local artifact and archive handling. This is not unauthorized access to hidden user files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_deck.mjs:63:hidden-file-access","reason":"The code checks or preserves dot-prefixed project files as part of local artifact and archive handling. This is not unauthorized access to hidden user files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:7:hidden-file-access","reason":"The code checks or preserves dot-prefixed project files as part of local artifact and archive handling. This is not unauthorized access to hidden user files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:13:hidden-file-access","reason":"The code checks or preserves dot-prefixed project files as part of local artifact and archive handling. This is not unauthorized access to hidden user files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:25:hidden-file-access","reason":"The code checks or preserves dot-prefixed project files as part of local artifact and archive handling. This is not unauthorized access to hidden user files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:34:hidden-file-access","reason":"The code checks or preserves dot-prefixed project files as part of local artifact and archive handling. This is not unauthorized access to hidden user files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:154:hidden-file-access","reason":"The code checks or preserves dot-prefixed project files as part of local artifact and archive handling. This is not unauthorized access to hidden user files.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_deck.mjs:15:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_deck.mjs:166:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_deck.mjs:167:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_deck.mjs:176:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_deck.mjs:196:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/html_chapter_renderer.py:127:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/html_renderer.py:521:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/html_renderer.py:526:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/html_renderer.py:530:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/html_renderer.py:537:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/html_renderer.py:545:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/ppt_theme_samples.mjs:14:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/ppt_theme_samples.mjs:21:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/ppt_theme_samples.mjs:45:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/ppt_theme_samples.mjs:46:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/ppt_theme_samples.mjs:58:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/ppt_theme_samples.mjs:79:node-js-fs-operations","reason":"These are ordinary local reads and writes required to build report and presentation artifacts. The locations are derived from the requested output workflow, not remote file disclosure.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_native_scene_qa.py:6:python-archive-libraries","reason":"The archive libraries are used to inspect or validate Office document packages. They do not themselves extract arbitrary files without the surrounding validation logic.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_pptx_prepare.py:6:python-archive-libraries","reason":"The archive libraries are used to inspect or validate Office document packages. They do not themselves extract arbitrary files without the surrounding validation logic.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/chapter_presentation_qa.py:9:python-archive-libraries","reason":"The archive libraries are used to inspect or validate Office document packages. They do not themselves extract arbitrary files without the surrounding validation logic.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/generate_sample.py:10:python-archive-libraries","reason":"The archive libraries are used to inspect or validate Office document packages. They do not themselves extract arbitrary files without the surrounding validation logic.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/slideviber_consistency.py:9:python-archive-libraries","reason":"The archive libraries are used to inspect or validate Office document packages. They do not themselves extract arbitrary files without the surrounding validation logic.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/slideviber_consistency.py:547:python-archive-libraries","reason":"The archive libraries are used to inspect or validate Office document packages. They do not themselves extract arbitrary files without the surrounding validation logic.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/sheet_to_report.py:2954:python-shutil-operations","reason":"The operations manage temporary or staging output directories for deterministic generation. They are local cleanup and copy steps, not destructive access to unrelated paths.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/sheet_to_report.py:2979:python-shutil-operations","reason":"The operations manage temporary or staging output directories for deterministic generation. They are local cleanup and copy steps, not destructive access to unrelated paths.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/sheet_to_report.py:3129:python-shutil-operations","reason":"The operations manage temporary or staging output directories for deterministic generation. They are local cleanup and copy steps, not destructive access to unrelated paths.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/visual_verification.py:18:python-shutil-operations","reason":"The operations manage temporary or staging output directories for deterministic generation. They are local cleanup and copy steps, not destructive access to unrelated paths.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/visual_verification.py:180:python-shutil-operations","reason":"The operations manage temporary or staging output directories for deterministic generation. They are local cleanup and copy steps, not destructive access to unrelated paths.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/analysis_engine.py:592:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_chart_geometry.mjs:14:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_chart_geometry.mjs:120:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:49:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:104:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:173:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:184:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:185:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:186:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:188:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:189:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:191:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:192:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:193:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_deck.mjs:196:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_slideviber_design.mjs:19:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_slideviber_design.mjs:40:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/chapter_slideviber_design.mjs:56:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/content_qa.py:53:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/content_resolver.py:17:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/ppt_theme_samples.mjs:48:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/ppt_theme_samples.mjs:60:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/ppt_theme_samples.mjs:79:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/report_model_projection.py:47:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/report_model_projection.py:189:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/slideviber_consistency.py:428:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/slideviber_consistency.py:429:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/slideviber_handoff.py:39:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/slideviber_handoff.py:44:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/slideviber_handoff.py:57:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/slideviber_handoff.py:65:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/slideviber_handoff.py:82:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/slideviber_handoff.py:93:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/slideviber_handoff.py:94:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/slideviber_handoff.py:95:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/slideviber_handoff.py:98:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:scripts/slideviber_handoff.py:113:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python docstrings, or JavaScript template literals used for display and formatting. They are not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:.github/workflows/public-checks.yml:27:shell-command-substitution","reason":"The workflow uses a fixed find expression to locate a generated sample artifact. The path and filename pattern are repository-local and are not supplied as shell code.","verdict":"false_positive","confidence":0.9},{"id":"blocker:scripts/environment_check.py:51:network-reconnaissance","reason":"The text reports whether optional local executables or tools are available. It does not probe hosts, ports, or network services.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/environment_check.py:57:network-reconnaissance","reason":"The text reports whether optional local executables or tools are available. It does not probe hosts, ports, or network services.","verdict":"false_positive","confidence":0.97},{"id":"blocker:docs/index.html:11:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:docs/index.html:12:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:docs/index.html:13:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:docs/index.html:14:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:docs/index.html:15:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:docs/index.html:16:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:docs/index.html:17:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:docs/index.html:18:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:docs/report.html:3:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:README.md:27:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/report-model.md:92:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/report-model.md:109:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/report-model.md:187:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/report-model.md:207:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/report-model.md:225:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:118:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:193:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:195:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:199:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:201:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:205:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:206:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:207:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:208:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:213:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:220:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:230:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:323:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_depth.py:324:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:117:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:457:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:459:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:460:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:508:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:539:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:579:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:729:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:736:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:983:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:1051:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:1057:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:1193:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:1253:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:1366:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:1389:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:1459:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:1460:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:1574:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:1601:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:1633:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:1792:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:2364:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:2425:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:2427:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:2509:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:2767:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:2770:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_engine.py:2774:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_followup.py:359:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_followup.py:372:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_followup.py:380:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/analysis_followup.py:381:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:145:system-reconnaissance","reason":"The match is CSS layout, report-model validation, or evidence identifier bookkeeping. It does not perform system reconnaissance or contain a prompt override.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/chapter_deck.mjs:29:array-join-empty-string","reason":"The match is a rendering or text-processing expression, not an obfuscated payload. No concealed execution behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/chapter_slideviber_layout.mjs:154:unicode-escape-sequence","reason":"The match is a rendering or text-processing expression, not an obfuscated payload. No concealed execution behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/ppt_qa.py:23:unicode-escape-sequence","reason":"The match is a rendering or text-processing expression, not an obfuscated payload. No concealed execution behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:scripts/slideviber_consistency.py:21:unicode-escape-sequence","reason":"The match is a rendering or text-processing expression, not an obfuscated payload. No concealed execution behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/chapter_deck.mjs:12:environment-variable-access-dot-notation","reason":"The environment reads select optional runtime settings for local tool discovery or Git isolation. No environment dump, secret transmission, or persistence behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/chapter_deck.mjs:13:environment-variable-access-dot-notation","reason":"The environment reads select optional runtime settings for local tool discovery or Git isolation. No environment dump, secret transmission, or persistence behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/ppt_theme_samples.mjs:12:environment-variable-access-dot-notation","reason":"The environment reads select optional runtime settings for local tool discovery or Git isolation. No environment dump, secret transmission, or persistence behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/ppt_theme_samples.mjs:13:environment-variable-access-dot-notation","reason":"The environment reads select optional runtime settings for local tool discovery or Git isolation. No environment dump, secret transmission, or persistence behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/chapter_deck.mjs:12:environment-variable-object","reason":"The environment reads select optional runtime settings for local tool discovery or Git isolation. No environment dump, secret transmission, or persistence behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/chapter_deck.mjs:13:environment-variable-object","reason":"The environment reads select optional runtime settings for local tool discovery or Git isolation. No environment dump, secret transmission, or persistence behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/ppt_theme_samples.mjs:12:environment-variable-object","reason":"The environment reads select optional runtime settings for local tool discovery or Git isolation. No environment dump, secret transmission, or persistence behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/ppt_theme_samples.mjs:13:environment-variable-object","reason":"The environment reads select optional runtime settings for local tool discovery or Git isolation. No environment dump, secret transmission, or persistence behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"network:docs/index.html:23:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:docs/index.html:38:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:docs/index.html:40:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:INSTALL.en.md:22:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:README.md:52:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:README.zh-CN.md:50:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/chapter_chart_qa.py:4:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/chapter_native_scene_qa.py:11:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/chapter_native_scene_qa.py:12:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/chapter_pptx_prepare.py:9:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/chapter_presentation_qa.py:14:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/chapter_presentation_qa.py:15:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/chapter_presentation_qa.py:16:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/chapter_presentation_qa.py:17:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/chapter_vector_qa.py:14:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/chapter_vector_qa.py:15:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/slideviber_consistency.py:23:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/slideviber_handoff.py:89:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:19:hardcoded-url","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/generate_sample.py:278:http-client-library","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/generate_sample.py:634:http-client-library","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/html_analysis.py:150:http-client-library","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/sheet_to_report.py:1420:http-client-library","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/sheet_to_report.py:1744:http-client-library","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/sheet_to_report.py:2650:http-client-library","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/sheet_to_report.py:3193:http-client-library","reason":"The match is a documentation link, an Office XML namespace, or local request validation. No outbound request carrying user data is shown at this location.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/environment_check.py:43:python-environment-access","reason":"The environment reads select optional runtime settings for local tool discovery or Git isolation. No environment dump, secret transmission, or persistence behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/environment_check.py:53:python-environment-access","reason":"The environment reads select optional runtime settings for local tool discovery or Git isolation. No environment dump, secret transmission, or persistence behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/html_analysis.py:56:python-environment-access","reason":"The environment reads select optional runtime settings for local tool discovery or Git isolation. No environment dump, secret transmission, or persistence behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:scripts/sheet_to_report.py:12:temp-file-creation","reason":"Temporary files are created for local report or presentation verification. This is expected artifact management and does not expose data by itself.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/sheet_to_report.py:2946:temp-file-creation","reason":"Temporary files are created for local report or presentation verification. This is expected artifact management and does not expose data by itself.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/sheet_to_report.py:2992:temp-file-creation","reason":"Temporary files are created for local report or presentation verification. This is expected artifact management and does not expose data by itself.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/slideviber_consistency.py:7:temp-file-creation","reason":"Temporary files are created for local report or presentation verification. This is expected artifact management and does not expose data by itself.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:scripts/slideviber_consistency.py:540:temp-file-creation","reason":"Temporary files are created for local report or presentation verification. This is expected artifact management and does not expose data by itself.","verdict":"false_positive","confidence":0.9}],"semantic_findings":[],"subject_marketplace_commit_sha":"688a18e807d4a4aeba23c932e29b45ad183df408","subject_content_hash":"26d60c39d8b38afb074a90af0bec05eb5b7615cf8f456f0f33fc70f0e0184e42","subject_tree_hash":"df98c430159e88442e2d30ffba06638d8ace35538b5eee8112a460b9d0e79a79","subject_plugin_path":"skills/majichuan/sheet-to-report","audit_payload_hash":"4c63ab827fcb626c7b5cfe181c950015","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"688a18e807d4a4aeba23c932e29b45ad183df408","contentHash":"26d60c39d8b38afb074a90af0bec05eb5b7615cf8f456f0f33fc70f0e0184e42","treeHash":"df98c430159e88442e2d30ffba06638d8ace35538b5eee8112a460b9d0e79a79","pluginPath":"skills/majichuan/sheet-to-report","auditPayloadHash":"4c63ab827fcb626c7b5cfe181c950015"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/majichuan-sheet-to-report/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}