{"data":{"skill":{"slug":"majichuan-sheet-to-report","name":"sheet-to-report","icon":"📦","repo":"https://github.com/majichuan/sheet-to-report/tree/901e918cb1ea818139d8d96d974062b4090b1e66/","status":"approved","author":"majichuan","authorVersion":"0.2.5","skillstoreRevision":2},"audit":{"id":"f1df19e3-d6fd-449d-9034-1e849878b6e1","skill_id":"93d06628-9847-4470-9120-8e4ec95d0f7c","version":2,"content_hash":"v3:9ea344fdd713f92cfc676d872c148f2ab075405e:6922e34078bed158015eaf98ca5cd24ec55a385a23ebfea5395a3630d4daaeeb:db3ac15ce97f48fca102b4ee2df2a1a30165dabfb06ad57462164deda25860ff:736b696c6c732f6d616a69636875616e2f73686565742d746f2d7265706f7274:24244f1066e5debd62c762f33ab20398","risk_level":"safe","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 400 presented static findings are false positives caused by documentation, CJK text, generated HTML, validation helpers, or bounded local report tooling. External commands use fixed argument arrays without shell interpolation, and no prompt injection, secret collection, data exfiltration, or covert network behavior was found. Static review was capped at 400/728 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.","remediation":[{"issue":"Static review capped","severity":"medium","suggestion":"Manually review the omitted 328 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":".claude-plugin/marketplace.json","line_end":5,"line_start":5},{"file":".claude-plugin/marketplace.json","line_end":20,"line_start":20},{"file":".claude-plugin/marketplace.json","line_end":22,"line_start":22},{"file":".claude-plugin/marketplace.json","line_end":23,"line_start":23},{"file":".claude-plugin/plugin.json","line_end":2,"line_start":2},{"file":".claude-plugin/plugin.json","line_end":9,"line_start":9},{"file":".claude-plugin/plugin.json","line_end":11,"line_start":11},{"file":".claude-plugin/plugin.json","line_end":12,"line_start":12},{"file":"docs/index.html","line_end":23,"line_start":23},{"file":"docs/index.html","line_end":38,"line_start":38},{"file":"docs/index.html","line_end":40,"line_start":40},{"file":"INSTALL.en.md","line_end":22,"line_start":22},{"file":"README.md","line_end":110,"line_start":110},{"file":"README.zh-CN.md","line_end":112,"line_start":112},{"file":"scripts/chapter_chart_qa.py","line_end":4,"line_start":4},{"file":"scripts/chapter_native_scene_qa.py","line_end":11,"line_start":11},{"file":"scripts/chapter_native_scene_qa.py","line_end":12,"line_start":12},{"file":"scripts/chapter_pptx_prepare.py","line_end":9,"line_start":9},{"file":"scripts/chapter_presentation_qa.py","line_end":14,"line_start":14},{"file":"scripts/chapter_presentation_qa.py","line_end":15,"line_start":15},{"file":"scripts/chapter_presentation_qa.py","line_end":16,"line_start":16},{"file":"scripts/chapter_presentation_qa.py","line_end":17,"line_start":17},{"file":"scripts/chapter_vector_qa.py","line_end":14,"line_start":14},{"file":"scripts/chapter_vector_qa.py","line_end":15,"line_start":15},{"file":"scripts/generate_sample.py","line_end":278,"line_start":278},{"file":"scripts/generate_sample.py","line_end":634,"line_start":634},{"file":"scripts/html_analysis.py","line_end":150,"line_start":150},{"file":"scripts/sheet_to_report.py","line_end":1420,"line_start":1420},{"file":"scripts/sheet_to_report.py","line_end":1744,"line_start":1744},{"file":"scripts/sheet_to_report.py","line_end":2650,"line_start":2650},{"file":"scripts/sheet_to_report.py","line_end":3193,"line_start":3193},{"file":"scripts/slideviber_consistency.py","line_end":23,"line_start":23},{"file":"scripts/slideviber_handoff.py","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SUPPORT.md","line_end":5,"line_start":5}]},{"factor":"external_commands","evidence":[{"file":".github/workflows/public-checks.yml","line_end":51,"line_start":51},{"file":".github/workflows/public-checks.yml","line_end":27,"line_start":27},{"file":"scripts/analysis_engine.py","line_end":592,"line_start":592},{"file":"scripts/chapter_chart_geometry.mjs","line_end":14,"line_start":14},{"file":"scripts/chapter_chart_geometry.mjs","line_end":120,"line_start":120},{"file":"scripts/chapter_deck.mjs","line_end":5,"line_start":5},{"file":"scripts/chapter_deck.mjs","line_end":14,"line_start":14},{"file":"scripts/chapter_deck.mjs","line_end":199,"line_start":199},{"file":"scripts/chapter_deck.mjs","line_end":49,"line_start":49},{"file":"scripts/chapter_deck.mjs","line_end":104,"line_start":104},{"file":"scripts/chapter_deck.mjs","line_end":173,"line_start":173},{"file":"scripts/chapter_deck.mjs","line_end":184,"line_start":184},{"file":"scripts/chapter_deck.mjs","line_end":185,"line_start":185},{"file":"scripts/chapter_deck.mjs","line_end":186,"line_start":186},{"file":"scripts/chapter_deck.mjs","line_end":188,"line_start":188},{"file":"scripts/chapter_deck.mjs","line_end":189,"line_start":189},{"file":"scripts/chapter_deck.mjs","line_end":191,"line_start":191},{"file":"scripts/chapter_deck.mjs","line_end":192,"line_start":192},{"file":"scripts/chapter_deck.mjs","line_end":193,"line_start":193},{"file":"scripts/chapter_deck.mjs","line_end":196,"line_start":196},{"file":"scripts/chapter_slideviber_design.mjs","line_end":19,"line_start":19},{"file":"scripts/chapter_slideviber_design.mjs","line_end":40,"line_start":40},{"file":"scripts/chapter_slideviber_design.mjs","line_end":56,"line_start":56},{"file":"scripts/content_qa.py","line_end":53,"line_start":53},{"file":"scripts/content_resolver.py","line_end":17,"line_start":17},{"file":"scripts/environment_check.py","line_end":47,"line_start":47},{"file":"scripts/html_analysis.py","line_end":60,"line_start":60},{"file":"scripts/ppt_theme_samples.mjs","line_end":6,"line_start":6},{"file":"scripts/ppt_theme_samples.mjs","line_end":15,"line_start":15},{"file":"scripts/ppt_theme_samples.mjs","line_end":51,"line_start":51},{"file":"scripts/ppt_theme_samples.mjs","line_end":54,"line_start":54},{"file":"scripts/ppt_theme_samples.mjs","line_end":48,"line_start":48},{"file":"scripts/ppt_theme_samples.mjs","line_end":60,"line_start":60},{"file":"scripts/ppt_theme_samples.mjs","line_end":79,"line_start":79},{"file":"scripts/report_model_projection.py","line_end":47,"line_start":47},{"file":"scripts/report_model_projection.py","line_end":189,"line_start":189},{"file":"scripts/slideviber_consistency.py","line_end":428,"line_start":428},{"file":"scripts/slideviber_consistency.py","line_end":429,"line_start":429},{"file":"scripts/slideviber_handoff.py","line_end":39,"line_start":39},{"file":"scripts/slideviber_handoff.py","line_end":44,"line_start":44},{"file":"scripts/slideviber_handoff.py","line_end":57,"line_start":57},{"file":"scripts/slideviber_handoff.py","line_end":65,"line_start":65},{"file":"scripts/slideviber_handoff.py","line_end":82,"line_start":82},{"file":"scripts/slideviber_handoff.py","line_end":93,"line_start":93},{"file":"scripts/slideviber_handoff.py","line_end":94,"line_start":94},{"file":"scripts/slideviber_handoff.py","line_end":95,"line_start":95},{"file":"scripts/slideviber_handoff.py","line_end":98,"line_start":98},{"file":"scripts/slideviber_handoff.py","line_end":113,"line_start":113},{"file":"scripts/visual_verification.py","line_end":102,"line_start":102},{"file":"scripts/visual_verification.py","line_end":128,"line_start":128}]},{"factor":"scripts","evidence":[{"file":"scripts/build_pptx.py","line_end":29,"line_start":22},{"file":"scripts/chart_contract.py","line_end":20,"line_start":20},{"file":"scripts/chart_contract.py","line_end":48,"line_start":48},{"file":"scripts/chart_contract.py","line_end":51,"line_start":51},{"file":"scripts/chart_contract.py","line_end":55,"line_start":55},{"file":"scripts/chart_contract.py","line_end":70,"line_start":70},{"file":"scripts/chart_contract.py","line_end":71,"line_start":71},{"file":"scripts/chart_contract.py","line_end":73,"line_start":73},{"file":"scripts/chart_contract.py","line_end":75,"line_start":75},{"file":"scripts/chart_contract.py","line_end":76,"line_start":76},{"file":"scripts/chart_contract.py","line_end":77,"line_start":77},{"file":"scripts/chart_contract.py","line_end":78,"line_start":78},{"file":"scripts/chart_contract.py","line_end":80,"line_start":80},{"file":"scripts/chart_contract.py","line_end":81,"line_start":81},{"file":"scripts/chart_contract.py","line_end":82,"line_start":82},{"file":"scripts/chart_contract.py","line_end":83,"line_start":83},{"file":"scripts/chart_contract.py","line_end":85,"line_start":85},{"file":"scripts/chart_contract.py","line_end":87,"line_start":87},{"file":"scripts/chart_contract.py","line_end":88,"line_start":88},{"file":"scripts/chart_contract.py","line_end":89,"line_start":89},{"file":"scripts/chart_contract.py","line_end":90,"line_start":90},{"file":"scripts/chart_contract.py","line_end":91,"line_start":91},{"file":"scripts/chart_contract.py","line_end":92,"line_start":92},{"file":"scripts/chart_contract.py","line_end":96,"line_start":96},{"file":"scripts/chart_contract.py","line_end":98,"line_start":98},{"file":"scripts/chart_contract.py","line_end":100,"line_start":100},{"file":"scripts/chart_contract.py","line_end":102,"line_start":102},{"file":"scripts/chart_contract.py","line_end":104,"line_start":104},{"file":"scripts/chart_contract.py","line_end":105,"line_start":105},{"file":"scripts/chart_contract.py","line_end":109,"line_start":109},{"file":"scripts/chart_contract.py","line_end":111,"line_start":111},{"file":"scripts/chart_contract.py","line_end":114,"line_start":114},{"file":"scripts/chart_contract.py","line_end":116,"line_start":116},{"file":"scripts/chart_contract.py","line_end":119,"line_start":119},{"file":"scripts/chart_contract.py","line_end":121,"line_start":121},{"file":"scripts/chart_contract.py","line_end":123,"line_start":123},{"file":"scripts/chart_contract.py","line_end":125,"line_start":125},{"file":"scripts/chart_contract.py","line_end":127,"line_start":127},{"file":"scripts/chart_contract.py","line_end":129,"line_start":129},{"file":"scripts/chart_contract.py","line_end":134,"line_start":134},{"file":"scripts/chart_contract.py","line_end":136,"line_start":136},{"file":"scripts/chart_contract.py","line_end":138,"line_start":138},{"file":"scripts/chart_contract.py","line_end":139,"line_start":139},{"file":"scripts/chart_contract.py","line_end":142,"line_start":142},{"file":"scripts/chart_contract.py","line_end":143,"line_start":143},{"file":"scripts/chart_contract.py","line_end":144,"line_start":144},{"file":"scripts/chart_contract.py","line_end":147,"line_start":147},{"file":"scripts/chart_contract.py","line_end":148,"line_start":148},{"file":"scripts/chart_contract.py","line_end":149,"line_start":149},{"file":"scripts/chart_contract.py","line_end":151,"line_start":151}]},{"factor":"filesystem","evidence":[{"file":"scripts/chapter_deck.mjs","line_end":15,"line_start":15},{"file":"scripts/chapter_deck.mjs","line_end":166,"line_start":166},{"file":"scripts/chapter_deck.mjs","line_end":167,"line_start":167},{"file":"scripts/chapter_deck.mjs","line_end":176,"line_start":176},{"file":"scripts/chapter_deck.mjs","line_end":196,"line_start":196},{"file":"scripts/chapter_deck.mjs","line_end":24,"line_start":24},{"file":"scripts/chapter_deck.mjs","line_end":26,"line_start":26},{"file":"scripts/chapter_deck.mjs","line_end":31,"line_start":31},{"file":"scripts/chapter_deck.mjs","line_end":63,"line_start":63},{"file":"scripts/chapter_native_scene_qa.py","line_end":6,"line_start":6},{"file":"scripts/chapter_pptx_prepare.py","line_end":6,"line_start":6},{"file":"scripts/chapter_presentation_qa.py","line_end":152,"line_start":152},{"file":"scripts/chapter_presentation_qa.py","line_end":9,"line_start":9},{"file":"scripts/chapter_slideviber_layout.mjs","line_end":7,"line_start":7},{"file":"scripts/chapter_slideviber_layout.mjs","line_end":13,"line_start":13},{"file":"scripts/chapter_slideviber_layout.mjs","line_end":25,"line_start":25},{"file":"scripts/chapter_slideviber_layout.mjs","line_end":34,"line_start":34},{"file":"scripts/chapter_slideviber_layout.mjs","line_end":154,"line_start":154},{"file":"scripts/generate_sample.py","line_end":10,"line_start":10},{"file":"scripts/html_chapter_renderer.py","line_end":127,"line_start":127},{"file":"scripts/html_renderer.py","line_end":521,"line_start":521},{"file":"scripts/html_renderer.py","line_end":526,"line_start":526},{"file":"scripts/html_renderer.py","line_end":530,"line_start":530},{"file":"scripts/html_renderer.py","line_end":537,"line_start":537},{"file":"scripts/html_renderer.py","line_end":545,"line_start":545},{"file":"scripts/ppt_theme_samples.mjs","line_end":14,"line_start":14},{"file":"scripts/ppt_theme_samples.mjs","line_end":21,"line_start":21},{"file":"scripts/ppt_theme_samples.mjs","line_end":45,"line_start":45},{"file":"scripts/ppt_theme_samples.mjs","line_end":46,"line_start":46},{"file":"scripts/ppt_theme_samples.mjs","line_end":58,"line_start":58},{"file":"scripts/ppt_theme_samples.mjs","line_end":79,"line_start":79},{"file":"scripts/sheet_to_report.py","line_end":12,"line_start":12},{"file":"scripts/sheet_to_report.py","line_end":2946,"line_start":2946},{"file":"scripts/sheet_to_report.py","line_end":2992,"line_start":2992},{"file":"scripts/sheet_to_report.py","line_end":2954,"line_start":2954},{"file":"scripts/sheet_to_report.py","line_end":2979,"line_start":2979},{"file":"scripts/sheet_to_report.py","line_end":3129,"line_start":3129},{"file":"scripts/slideviber_consistency.py","line_end":7,"line_start":7},{"file":"scripts/slideviber_consistency.py","line_end":540,"line_start":540},{"file":"scripts/slideviber_consistency.py","line_end":9,"line_start":9},{"file":"scripts/slideviber_consistency.py","line_end":547,"line_start":547},{"file":"scripts/visual_verification.py","line_end":18,"line_start":18},{"file":"scripts/visual_verification.py","line_end":180,"line_start":180}]},{"factor":"env_access","evidence":[{"file":"scripts/chapter_deck.mjs","line_end":12,"line_start":12},{"file":"scripts/chapter_deck.mjs","line_end":13,"line_start":13},{"file":"scripts/chapter_deck.mjs","line_end":12,"line_start":12},{"file":"scripts/chapter_deck.mjs","line_end":13,"line_start":13},{"file":"scripts/environment_check.py","line_end":43,"line_start":43},{"file":"scripts/environment_check.py","line_end":53,"line_start":53},{"file":"scripts/html_analysis.py","line_end":56,"line_start":56},{"file":"scripts/ppt_theme_samples.mjs","line_end":12,"line_start":12},{"file":"scripts/ppt_theme_samples.mjs","line_end":13,"line_start":13},{"file":"scripts/ppt_theme_samples.mjs","line_end":12,"line_start":12},{"file":"scripts/ppt_theme_samples.mjs","line_end":13,"line_start":13}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":108,"total_lines":28441,"audit_model":"codex","audited_at":"2026-09-16T07:50:56.731+00:00","created_at":"2026-09-16T08:07:11.509542+00:00","static_findings":[{"id":"sensitive:scripts/transactional_story.py:108:certificate-key-files","file":"scripts/transactional_story.py","pattern":"Certificate/key files","snippet":"# identifier remains in evidence.rows[].key for audit, never headline copy.","category":"sensitive","line_end":108,"severity":"high","line_start":108},{"id":"sensitive:.github/workflows/public-checks.yml:56:environment-file-access","file":".github/workflows/public-checks.yml","pattern":"Environment file access","snippet":"if path.name == '.env' or path.suffix.lower() in {'.pyc', '.pyo'} or '__pycache__' in path.parts:","category":"sensitive","line_end":56,"severity":"high","line_start":56},{"id":"sensitive:.gitignore:20:environment-file-access","file":".gitignore","pattern":"Environment file access","snippet":".env","category":"sensitive","line_end":20,"severity":"high","line_start":20},{"id":"sensitive:.gitignore:21:environment-file-access","file":".gitignore","pattern":"Environment file access","snippet":".env.*","category":"sensitive","line_end":21,"severity":"high","line_start":21},{"id":"sensitive:.gitignore:22:environment-file-access","file":".gitignore","pattern":"Environment file access","snippet":"!.env.example","category":"sensitive","line_end":22,"severity":"high","line_start":22},{"id":"sensitive:scripts/chapter_deck.mjs:12:environment-file-access","file":"scripts/chapter_deck.mjs","pattern":"Environment file access","snippet":"const PY=process.env.RUNTIME_PYTHON||(process.platform==='win32'?'python':'python3');","category":"sensitive","line_end":12,"severity":"high","line_start":12},{"id":"sensitive:scripts/chapter_deck.mjs:13:environment-file-access","file":"scripts/chapter_deck.mjs","pattern":"Environment file access","snippet":"process.env.PYTHONUTF8='1';","category":"sensitive","line_end":13,"severity":"high","line_start":13},{"id":"sensitive:scripts/ppt_theme_samples.mjs:12:environment-file-access","file":"scripts/ppt_theme_samples.mjs","pattern":"Environment file access","snippet":"const PY=process.env.RUNTIME_PYTHON||(process.platform==='win32'?'python':'python3');","category":"sensitive","line_end":12,"severity":"high","line_start":12},{"id":"sensitive:scripts/ppt_theme_samples.mjs:13:environment-file-access","file":"scripts/ppt_theme_samples.mjs","pattern":"Environment file access","snippet":"process.env.PYTHONUTF8='1';","category":"sensitive","line_end":13,"severity":"high","line_start":13},{"id":"obfuscation:docs/report.html:3:heuristic-extremely-long-line-5138-chars-likely-","file":"docs/report.html","pattern":"[HEURISTIC] Extremely long line (5138 chars) - likely obfuscated","snippet":":root{--ink:#263341;--muted:#596777;--paper:#faf9f6;--line:#dde2e8;--nav:64px;--blue:#24528a;--green","category":"obfuscation","line_end":3,"severity":"high","line_start":3},{"id":"obfuscation:scripts/html_chapter_renderer.py:131:heuristic-extremely-long-line-5138-chars-likely-","file":"scripts/html_chapter_renderer.py","pattern":"[HEURISTIC] Extremely long line (5138 chars) - likely obfuscated","snippet":":root{--ink:#263341;--muted:#596777;--paper:#faf9f6;--line:#dde2e8;--nav:64px;--blue:#24528a;--green","category":"obfuscation","line_end":131,"severity":"high","line_start":131},{"id":"obfuscation:docs/report.html:24:heuristic-extremely-long-line-78488-chars-likely","file":"docs/report.html","pattern":"[HEURISTIC] Extremely long line (78488 chars) - likely obfuscated","snippet":"</style></head><body><nav aria-label=\"报告导航\"><a href=\"#summary\">核心结论</a><a href=\"#overview\">基本盘</a><a","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:scripts/slideviber_handoff.py:1:heuristic-high-file-entropy-6-21-bits-possible-b","file":"scripts/slideviber_handoff.py","pattern":"[HEURISTIC] High file entropy (6.21 bits) - possible binary/encrypted content","snippet":"File: scripts/slideviber_handoff.py","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/chart-spec.md:1:heuristic-high-file-entropy-6-94-bits-possible-b","file":"references/chart-spec.md","pattern":"[HEURISTIC] High file entropy (6.94 bits) - possible binary/encrypted content","snippet":"File: references/chart-spec.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:DEMO.zh-CN.md:1:heuristic-high-file-entropy-7-20-bits-possible-b","file":"DEMO.zh-CN.md","pattern":"[HEURISTIC] High file entropy (7.20 bits) - possible binary/encrypted content","snippet":"File: DEMO.zh-CN.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/report-model.md:1:heuristic-high-file-entropy-7-24-bits-possible-b","file":"references/report-model.md","pattern":"[HEURISTIC] High file entropy (7.24 bits) - possible binary/encrypted content","snippet":"File: references/report-model.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:QUICKSTART.zh-CN.md:1:heuristic-high-file-entropy-7-50-bits-possible-b","file":"QUICKSTART.zh-CN.md","pattern":"[HEURISTIC] High file entropy (7.50 bits) - possible binary/encrypted content","snippet":"File: QUICKSTART.zh-CN.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/quick-help.md:1:heuristic-high-file-entropy-7-51-bits-possible-b","file":"references/quick-help.md","pattern":"[HEURISTIC] High file entropy (7.51 bits) - possible binary/encrypted content","snippet":"File: references/quick-help.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:FAQ.md:1:heuristic-high-file-entropy-7-64-bits-possible-b","file":"FAQ.md","pattern":"[HEURISTIC] High file entropy (7.64 bits) - possible binary/encrypted content","snippet":"File: FAQ.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:README.zh-CN.md:1:heuristic-high-file-entropy-7-74-bits-possible-b","file":"README.zh-CN.md","pattern":"[HEURISTIC] High file entropy (7.74 bits) - possible binary/encrypted content","snippet":"File: README.zh-CN.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/ppt-theme-selection.md:1:heuristic-high-file-entropy-7-74-bits-possible-b","file":"references/ppt-theme-selection.md","pattern":"[HEURISTIC] High file entropy (7.74 bits) - possible binary/encrypted content","snippet":"File: references/ppt-theme-selection.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:INSTALL.md:1:heuristic-high-file-entropy-7-83-bits-possible-b","file":"INSTALL.md","pattern":"[HEURISTIC] High file entropy (7.83 bits) - possible binary/encrypted content","snippet":"File: INSTALL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/html-analysis.md:1:heuristic-high-file-entropy-7-90-bits-possible-b","file":"references/html-analysis.md","pattern":"[HEURISTIC] High file entropy (7.90 bits) - possible binary/encrypted content","snippet":"File: references/html-analysis.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-8-01-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (8.01 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/chapter-presentation.md:1:heuristic-high-file-entropy-8-04-bits-possible-b","file":"references/chapter-presentation.md","pattern":"[HEURISTIC] High file entropy (8.04 bits) - possible binary/encrypted content","snippet":"File: references/chapter-presentation.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/html_transaction_facts.py:1:heuristic-multiple-bracket-chains-10-jsfuck-obfu","file":"scripts/html_transaction_facts.py","pattern":"[HEURISTIC] Multiple bracket chains (10) - JSFuck/obfuscation pattern","snippet":")]}}, ]])], ]])))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/question_evidence.py:1:heuristic-multiple-bracket-chains-10-jsfuck-obfu","file":"scripts/question_evidence.py","pattern":"[HEURISTIC] Multiple bracket chains (10) - JSFuck/obfuscation pattern","snippet":"[])), ]))], [])})","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/html_qa.py:1:heuristic-multiple-bracket-chains-12-jsfuck-obfu","file":"scripts/html_qa.py","pattern":"[HEURISTIC] Multiple bracket chains (12) - JSFuck/obfuscation pattern","snippet":"[])), []}), []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/presentation_contracts.py:1:heuristic-multiple-bracket-chains-13-jsfuck-obfu","file":"scripts/presentation_contracts.py","pattern":"[HEURISTIC] Multiple bracket chains (13) - JSFuck/obfuscation pattern","snippet":"[])), [])}, []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/analysis_questions.py:1:heuristic-multiple-bracket-chains-15-jsfuck-obfu","file":"scripts/analysis_questions.py","pattern":"[HEURISTIC] Multiple bracket chains (15) - JSFuck/obfuscation pattern","snippet":"[])], ())], ())]","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/analysis_depth.py:1:heuristic-multiple-bracket-chains-18-jsfuck-obfu","file":"scripts/analysis_depth.py","pattern":"[HEURISTIC] Multiple bracket chains (18) - JSFuck/obfuscation pattern","snippet":"[])), [])), ()))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/slideviber_consistency.py:1:heuristic-multiple-bracket-chains-18-jsfuck-obfu","file":"scripts/slideviber_consistency.py","pattern":"[HEURISTIC] Multiple bracket chains (18) - JSFuck/obfuscation pattern","snippet":"[])), [])), []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/analysis_followup.py:1:heuristic-multiple-bracket-chains-20-jsfuck-obfu","file":"scripts/analysis_followup.py","pattern":"[HEURISTIC] Multiple bracket chains (20) - JSFuck/obfuscation pattern","snippet":"]))}, [])), []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/html_evidence.py:1:heuristic-multiple-bracket-chains-20-jsfuck-obfu","file":"scripts/html_evidence.py","pattern":"[HEURISTIC] Multiple bracket chains (20) - JSFuck/obfuscation pattern","snippet":"[])}, {})), [])}","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/analysis_engine.py:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","file":"scripts/analysis_engine.py","pattern":"[HEURISTIC] Multiple bracket chains (24) - JSFuck/obfuscation pattern","snippet":"()}}, [])}, []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/build_pptx.py:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","file":"scripts/build_pptx.py","pattern":"[HEURISTIC] Multiple bracket chains (24) - JSFuck/obfuscation pattern","snippet":"[])], [])], [])[","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/model_validation.py:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","file":"scripts/model_validation.py","pattern":"[HEURISTIC] Multiple bracket chains (24) - JSFuck/obfuscation pattern","snippet":"[])}, [])}, ()))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/content_resolver.py:1:heuristic-multiple-bracket-chains-29-jsfuck-obfu","file":"scripts/content_resolver.py","pattern":"[HEURISTIC] Multiple bracket chains (29) - JSFuck/obfuscation pattern","snippet":"[])), [])}, ())}","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/narrative_planner.py:1:heuristic-multiple-bracket-chains-32-jsfuck-obfu","file":"scripts/narrative_planner.py","pattern":"[HEURISTIC] Multiple bracket chains (32) - JSFuck/obfuscation pattern","snippet":"{})), [])), {}))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/sheet_to_report.py:1:heuristic-multiple-bracket-chains-33-jsfuck-obfu","file":"scripts/sheet_to_report.py","pattern":"[HEURISTIC] Multiple bracket chains (33) - JSFuck/obfuscation pattern","snippet":"[])), [])), {}))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/content_qa.py:1:heuristic-multiple-bracket-chains-38-jsfuck-obfu","file":"scripts/content_qa.py","pattern":"[HEURISTIC] Multiple bracket chains (38) - JSFuck/obfuscation pattern","snippet":"[])}, [])}, {}))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/html_renderer.py:1:heuristic-multiple-bracket-chains-43-jsfuck-obfu","file":"scripts/html_renderer.py","pattern":"[HEURISTIC] Multiple bracket chains (43) - JSFuck/obfuscation pattern","snippet":"[])], [])], ))))}","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/chart_svg_renderer.py:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","file":"scripts/chart_svg_renderer.py","pattern":"[HEURISTIC] Multiple bracket chains (6) - JSFuck/obfuscation pattern","snippet":"[])}, ))}{, []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/html_analysis.py:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","file":"scripts/html_analysis.py","pattern":"[HEURISTIC] Multiple bracket chains (6) - JSFuck/obfuscation pattern","snippet":"[((), [])), ])})","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/chapter_deck.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"scripts/chapter_deck.mjs","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":"[])], {})}), {})})","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/chart_evidence.py:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"scripts/chart_evidence.py","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":"{})[, {})[, {})[","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/ppt_qa.py:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"scripts/ppt_qa.py","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":"[]))], [])[, []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/report_model_projection.py:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","file":"scripts/report_model_projection.py","pattern":"[HEURISTIC] Multiple bracket chains (7) - JSFuck/obfuscation pattern","snippet":"[])), [])), []))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:scripts/transactional_story.py:1:heuristic-multiple-bracket-chains-9-jsfuck-obfus","file":"scripts/transactional_story.py","pattern":"[HEURISTIC] Multiple bracket chains (9) - JSFuck/obfuscation pattern","snippet":"[])), ])}{, ])]))","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-53-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.53 bits) - likely encoded/encrypted payload","snippet":">退款率是金额比例，不是退款订单率。缺少订单关联、退款发生时点及原因字段，不能把同月金额比直接解释为同批订单退款概率。</p></section><sectio...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/index.html:29:heuristic-very-high-entropy-string-5-54-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":">SlideViber 美化版<small>Optional refinement</small></h3><p>基于已确认的内容重新设计构图和视觉层级，同时保...","category":"obfuscation","line_end":29,"severity":"high","line_start":29},{"id":"obfuscation:scripts/html_transaction_facts.py:111:heuristic-very-high-entropy-string-5-54-bits-lik","file":"scripts/html_transaction_facts.py","pattern":"[HEURISTIC] Very high entropy string (5.54 bits) - likely encoded/encrypted payload","snippet":"未命中费用文字线索的条目视图；不是已确认商品清洗结果。占比仍以全体净销售为分母；费用候选另列，总额未剔除。","category":"obfuscation","line_end":111,"severity":"high","line_start":111},{"id":"obfuscation:scripts/html_renderer.py:717:heuristic-very-high-entropy-string-5-55-bits-lik","file":"scripts/html_renderer.py","pattern":"[HEURISTIC] Very high entropy string (5.55 bits) - likely encoded/encrypted payload","snippet":"]):,} 行。比较口径使用{comparison_copy}，百分比指标以百分点展示变化，其他指标以相对变化率展示。重复行 {int(profile.get(","category":"obfuscation","line_end":717,"severity":"high","line_start":717},{"id":"obfuscation:scripts/analysis_engine.py:2073:heuristic-very-high-entropy-string-5-57-bits-lik","file":"scripts/analysis_engine.py","pattern":"[HEURISTIC] Very high entropy string (5.57 bits) - likely encoded/encrypted payload","snippet":"分别复核并治理，每个切面均以对应证据确认后再收缩；{roas_name}与转化率连续改善后再分阶段恢复预算。","category":"obfuscation","line_end":2073,"severity":"high","line_start":2073},{"id":"obfuscation:scripts/analysis_engine.py:1678:heuristic-very-high-entropy-string-5-61-bits-lik","file":"scripts/analysis_engine.py","pattern":"[HEURISTIC] Very high entropy string (5.61 bits) - likely encoded/encrypted payload","snippet":"待验证假设：在可比对象内小范围调整资源配置，能使{metric_name}{favorable}试验前且不损伤质量与效率。","category":"obfuscation","line_end":1678,"severity":"high","line_start":1678},{"id":"obfuscation:references/report-model.md:171:heuristic-very-high-entropy-string-5-62-bits-lik","file":"references/report-model.md","pattern":"[HEURISTIC] Very high entropy string (5.62 bits) - likely encoded/encrypted payload","snippet":" 根据实际证据形状复算：排名不自动成为驱动，计划用途／证据 ID／工具名／自报深度不构成证明；结构证据和同问题的实际经营判断须同时存在才可达到 4。","category":"obfuscation","line_end":171,"severity":"high","line_start":171},{"id":"obfuscation:docs/index.html:27:heuristic-very-high-entropy-string-5-66-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.66 bits) - likely encoded/encrypted payload","snippet":">HTML 分析简报<small>Offline report</small></h3><p>通过固定阅读主线、图表依据和口径说明，适合个人深读、业务复盘与会前...","category":"obfuscation","line_end":27,"severity":"high","line_start":27},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-66-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.66 bits) - likely encoded/encrypted payload","snippet":">付费广告营销成本从456,704.31元升至732,833.12元，投入产出降至2.87x。内容种草投入产出20.4x，但也低于前月20.94x，不宜无条件扩...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-67-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.67 bits) - likely encoded/encrypted payload","snippet":">投入产出以收入除以已记录营销成本，不含毛利、履约及全部间接成本；也不代表广告带来的增量回报。</p></section><section id=","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:references/chapter-presentation.md:9:heuristic-very-high-entropy-string-5-70-bits-lik","file":"references/chapter-presentation.md","pattern":"[HEURISTIC] Very high entropy string (5.70 bits) - likely encoded/encrypted payload","snippet":"可指定Python，否则Windows使用python、其他系统使用python3；不读取RUNTIME_NODE_MODULES或PRESENTATIONS_...","category":"obfuscation","line_end":9,"severity":"high","line_start":9},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-71-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.71 bits) - likely encoded/encrypted payload","snippet":">各指标按已确认聚合合同独立计算；按已确认类别转为互斥系列，各期保留全部类别；缺少某类交易的可加总值为零，缺少整期不补零</p><div class=","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:scripts/slideviber_handoff.py:113:heuristic-very-high-entropy-string-5-72-bits-lik","file":"scripts/slideviber_handoff.py","pattern":"[HEURISTIC] Very high entropy string (5.72 bits) - likely encoded/encrypted payload","snippet":"，正文仅保留短标签和业务判断；日期、数字与单位、指标名称和英文缩写保持不可拆语义单元；evidence ID 不放在观众可见页面；核验后另存 ","category":"obfuscation","line_end":113,"severity":"high","line_start":113},{"id":"obfuscation:docs/index.html:37:heuristic-very-high-entropy-string-5-73-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.73 bits) - likely encoded/encrypted payload","snippet":">数据、背景和结论均为自主合成内容，不代表任何真实企业表现。Skill不会绑定本案例，也不会把示例结论套到用户数据上。</p><div class=","category":"obfuscation","line_end":37,"severity":"high","line_start":37},{"id":"obfuscation:scripts/report_model_projection.py:171:heuristic-very-high-entropy-string-5-73-bits-lik","file":"scripts/report_model_projection.py","pattern":"[HEURISTIC] Very high entropy string (5.73 bits) - likely encoded/encrypted payload","snippet":"下一完整周期在可比内容组合内，{channel} channel 的 conversion_rate 不低于基期 {rate_value:.2f}%，转化量增加...","category":"obfuscation","line_end":171,"severity":"high","line_start":171},{"id":"obfuscation:scripts/sheet_to_report.py:369:heuristic-very-high-entropy-string-5-74-bits-lik","file":"scripts/sheet_to_report.py","pattern":"[HEURISTIC] Very high entropy string (5.74 bits) - likely encoded/encrypted payload","snippet":"下一完整周期在可比内容组合内，{best_channel} channel 的 conversion_rate 不低于基期 {rate:.2f}%，转化量增加且...","category":"obfuscation","line_end":369,"severity":"high","line_start":369},{"id":"obfuscation:scripts/html_analysis.py:385:heuristic-very-high-entropy-string-5-75-bits-lik","file":"scripts/html_analysis.py","pattern":"[HEURISTIC] Very high entropy string (5.75 bits) - likely encoded/encrypted payload","snippet":"共同且两期净数量为正的条目：数量贡献=(本期数量−前期数量)×前期单位净金额；单位净金额贡献=本期数量×两期单位净金额差。新增、退出及非正净数量单列；单位净金额...","category":"obfuscation","line_end":385,"severity":"high","line_start":385},{"id":"obfuscation:docs/index.html:38:heuristic-very-high-entropy-string-5-76-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.76 bits) - likely encoded/encrypted payload","snippet":">在线报告适合直接阅读；两套PPT可以下载后用 PowerPoint 或 WPS 打开，检查完整23页内容及可编辑结构。</p><div class=","category":"obfuscation","line_end":38,"severity":"high","line_start":38},{"id":"obfuscation:scripts/html_transaction_facts.py:171:heuristic-very-high-entropy-string-5-78-bits-lik","file":"scripts/html_transaction_facts.py","pattern":"[HEURISTIC] Very high entropy string (5.78 bits) - likely encoded/encrypted payload","snippet":"各质量条件可能重叠，行数和金额不能直接相加；缺失客户不等同收入损失；字母前缀只是可观察线索，不宣称已确认取消；异常价格尚无业务阈值。","category":"obfuscation","line_end":171,"severity":"high","line_start":171},{"id":"obfuscation:scripts/transactional_story.py:346:heuristic-very-high-entropy-string-5-78-bits-lik","file":"scripts/transactional_story.py","pattern":"[HEURISTIC] Very high entropy string (5.78 bits) - likely encoded/encrypted payload","snippet":"{label}头部贡献需要与订单覆盖及单均金额一起管理；以已算出的历史占比范围作为下一完整月的变化触发线，超出后先定位对象变化。","category":"obfuscation","line_end":346,"severity":"high","line_start":346},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-80-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.80 bits) - likely encoded/encrypted payload","snippet":">同一已确认总体的两期对象并集，包含新增/退出；不存在的加总/计数为零，比率无定义时不伪造。变动为数学贡献，不等同因果。</p><div class=","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:references/chapter-presentation.md:32:heuristic-very-high-entropy-string-5-81-bits-lik","file":"references/chapter-presentation.md","pattern":"[HEURISTIC] Very high entropy string (5.81 bits) - likely encoded/encrypted payload","snippet":"，按当前数据逐页选择下述设计意图；空的重点映射表示未发现应单独强调的类别，仍启用通用层级与容量适配。历史无visual或","category":"obfuscation","line_end":32,"severity":"high","line_start":32},{"id":"obfuscation:docs/index.html:31:heuristic-very-high-entropy-string-5-82-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.82 bits) - likely encoded/encrypted payload","snippet":">下面四组页面来自同一个23页案例。左侧标准版优先保证编辑与复用，右侧美化版加强构图、层级和现场阅读节奏。</p><nav class=","category":"obfuscation","line_end":31,"severity":"high","line_start":31},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-84-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.84 bits) - likely encoded/encrypted payload","snippet":">可优先验证高价值客维护与转介绍的增量效果；唤醒活动需单独核对触达成本和有效回流，避免仅用收入规模评价。</p><p class=","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-85-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.85 bits) - likely encoded/encrypted payload","snippet":">服饰收入仍增长，但退款比例也在上升，扩大获客可能同时放大售后压力。需要先对齐退款归属，再核验尺码、质量、物流等可能原因。</p><p class=","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/index.html:26:heuristic-very-high-entropy-string-5-94-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.94 bits) - likely encoded/encrypted payload","snippet":">先把判断、证据与行动关系分析清楚，再根据阅读和汇报场景改变呈现方式。视觉变化不能改数字，也不能漏掉会影响决策的信息。</p><div class=","category":"obfuscation","line_end":26,"severity":"high","line_start":26},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-94-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.94 bits) - likely encoded/encrypted payload","snippet":">对比去年同月有助于减少月份差异，但未控制素材、定向、活动及归因规则；渠道间成本覆盖不同，不能按平均回报机械搬预算。</p></section><section...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-96-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (5.96 bits) - likely encoded/encrypted payload","snippet":">没有客户唯一标识与层级历史，无法计算留存或生命周期价值；高价值标签可能本就依赖消费表现，组间差异不是运营因果证据。</p></section><section...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/index.html:25:heuristic-very-high-entropy-string-5-98-bits-lik","file":"docs/index.html","pattern":"[HEURISTIC] Very high entropy string (5.98 bits) - likely encoded/encrypted payload","snippet":">从一张 Excel 到完整经营简报</h1><p><strong>同一份分析模型</strong>驱动三种产物：可追溯的 HTML、可编辑的标准 PPT，以及...","category":"obfuscation","line_end":25,"severity":"high","line_start":25},{"id":"obfuscation:references/report-model.md:205:heuristic-very-high-entropy-string-6-04-bits-lik","file":"references/report-model.md","pattern":"[HEURISTIC] Very high entropy string (6.04 bits) - likely encoded/encrypted payload","snippet":"。主分析窗口统一日期、去重、完整周期及数值策略。交易排名进一步要求订单、金额及对应对象有效；客户覆盖不冒用销售总盘。质量影响分别绑定基准／受影响行与金额范围，绝...","category":"obfuscation","line_end":205,"severity":"high","line_start":205},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-13-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (6.13 bits) - likely encoded/encrypted payload","snippet":">03</span><div><h3>对客户维护和唤醒分别验证增量</h3><p><b>行动对象：</b>高价值客的维护活动与沉睡唤醒人群的召回活动</p><p...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-16-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (6.16 bits) - likely encoded/encrypted payload","snippet":">同一已确认总体的两期对象并集，包含新增/退出；不存在的加总/计数为零，比率无定义时不伪造。变动为数学贡献，不等同因果。；起点加全部已计算分量等于终点；累计坐标...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-17-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (6.17 bits) - likely encoded/encrypted payload","snippet":">各指标按已确认聚合合同独立计算；按每个已聚合对象的指标值等宽分箱；箱数为Sturges规则向上取整并最多十二箱；左闭右开，最后箱包含右端点；缺失不当零；常数样...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:references/chapter-presentation.md:15:heuristic-very-high-entropy-string-6-19-bits-lik","file":"references/chapter-presentation.md","pattern":"[HEURISTIC] Very high entropy string (6.19 bits) - likely encoded/encrypted payload","snippet":" 为每个已选 chart ID 提供判断标题片段数组。逐图核对标题是否由图内指标、范围和比较条件直接支撑，数字只能引用该图的 evidence cell。不能把...","category":"obfuscation","line_end":15,"severity":"high","line_start":15},{"id":"obfuscation:SKILL.md:164:heuristic-very-high-entropy-string-6-23-bits-lik","file":"SKILL.md","pattern":"[HEURISTIC] Very high entropy string (6.23 bits) - likely encoded/encrypted payload","snippet":" 记录选择理由、限制、尺度和重点；新运行不能退回旧细横条合同。柱图、分布、构成、关系和贡献图各有数据约束，不按行业名或固定图型配额选择。图中分箱、比例和累计坐标...","category":"obfuscation","line_end":164,"severity":"high","line_start":164},{"id":"obfuscation:references/html-analysis.md:13:heuristic-very-high-entropy-string-6-29-bits-lik","file":"references/html-analysis.md","pattern":"[HEURISTIC] Very high entropy string (6.29 bits) - likely encoded/encrypted payload","snippet":"，同一对象同序显示两指标，各用独立标尺和单位。contribution 使用全部证据行显示首要拉动对象、其余对象合计与全体净变动，limit 不裁掉尾部抵减；仅...","category":"obfuscation","line_end":13,"severity":"high","line_start":13},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-34-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (6.34 bits) - likely encoded/encrypted payload","snippet":">02</span><div><h3>优先核验服饰退款原因与归属时点</h3><p><b>行动对象：</b>服饰品类的订单、退款记录及售后问题</p><p>服饰...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-42-bits-lik","file":"docs/report.html","pattern":"[HEURISTIC] Very high entropy string (6.42 bits) - likely encoded/encrypted payload","snippet":">01</span><div><h3>先核验付费效率，再进行有限预算对照</h3><p><b>行动对象：</b>付费广告的投放配置与内容种草渠道的增量验证</p...","category":"obfuscation","line_end":24,"severity":"high","line_start":24},{"id":"obfuscation:references/chapter-presentation.md:21:heuristic-very-high-entropy-string-6-87-bits-lik","file":"references/chapter-presentation.md","pattern":"[HEURISTIC] Very high entropy string (6.87 bits) - likely encoded/encrypted payload","snippet":" 再核对源模型/主题/投影与场景，输出draft.pptx、draft.qa.json和来源回执；包含中文字体脚本及换行声明，不再需要宿主私有最终化工具。核对来...","category":"obfuscation","line_end":21,"severity":"high","line_start":21},{"id":"obfuscation:scripts/slideviber_handoff.py:113:heuristic-very-high-entropy-string-6-95-bits-lik","file":"scripts/slideviber_handoff.py","pattern":"[HEURISTIC] Very high entropy string (6.95 bits) - likely encoded/encrypted payload","snippet":" 为唯一内容真相源，按以上逐页 ID 和锁定证据重绘 16:9 演示稿；先依照上述主题选择来源处理：已确认方向直接沿用，明确授权代选时默认清晰商务，否则先给候选...","category":"obfuscation","line_end":113,"severity":"high","line_start":113},{"id":"obfuscation:scripts/chapter_deck.mjs:63:hex-encoded-characters","file":"scripts/chapter_deck.mjs","pattern":"Hex-encoded characters","snippet":"const label=chartNumber(value),actualWidth=[...label].reduce((s,c)=>s+(/[^\\x00-\\xff]/.test(c)?20:11)","category":"obfuscation","line_end":63,"severity":"high","line_start":63},{"id":"obfuscation:scripts/chapter_slideviber_layout.mjs:13:hex-encoded-characters","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Hex-encoded characters","snippet":"const width=[...token].reduce((sum,ch)=>sum+(/[^\\x00-\\xff]/.test(ch)?1:.55),0);","category":"obfuscation","line_end":13,"severity":"high","line_start":13},{"id":"obfuscation:scripts/content_qa.py:56:hex-encoded-characters","file":"scripts/content_qa.py","pattern":"Hex-encoded characters","snippet":"if re.search(r\"[^\\x00-\\x7f]\", field):","category":"obfuscation","line_end":56,"severity":"high","line_start":56},{"id":"external_commands:scripts/chapter_deck.mjs:5:node-js-child-process-module","file":"scripts/chapter_deck.mjs","pattern":"Node.js child_process module","snippet":"import {execFileSync} from 'node:child_process';","category":"external_commands","line_end":5,"severity":"high","line_start":5},{"id":"external_commands:scripts/ppt_theme_samples.mjs:6:node-js-child-process-module","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js child_process module","snippet":"import {execFileSync} from 'node:child_process';","category":"external_commands","line_end":6,"severity":"high","line_start":6},{"id":"filesystem:scripts/chapter_deck.mjs:24:path-traversal-sequence","file":"scripts/chapter_deck.mjs","pattern":"Path traversal sequence","snippet":"const rgb=c.chart[index%c.chart.length].match(/../g).map(n=>parseInt(n,16));","category":"filesystem","line_end":24,"severity":"high","line_start":24},{"id":"filesystem:scripts/chapter_deck.mjs:26:path-traversal-sequence","file":"scripts/chapter_deck.mjs","pattern":"Path traversal sequence","snippet":"const bg=luminance(c.background.match(/../g).map(n=>parseInt(n,16)));","category":"filesystem","line_end":26,"severity":"high","line_start":26},{"id":"filesystem:scripts/chapter_presentation_qa.py:152:path-traversal-sequence","file":"scripts/chapter_presentation_qa.py","pattern":"Path traversal sequence","snippet":"if part.startswith(\"../\") or part not in names:","category":"filesystem","line_end":152,"severity":"high","line_start":152},{"id":"external_commands:.github/workflows/public-checks.yml:51:python-subprocess-check-output","file":".github/workflows/public-checks.yml","pattern":"Python subprocess.check_output","snippet":"tracked = [Path(item) for item in subprocess.check_output(","category":"external_commands","line_end":51,"severity":"high","line_start":51},{"id":"external_commands:scripts/html_analysis.py:60:python-subprocess-check-output","file":"scripts/html_analysis.py","pattern":"Python subprocess.check_output","snippet":"return subprocess.check_output(","category":"external_commands","line_end":60,"severity":"high","line_start":60},{"id":"external_commands:scripts/environment_check.py:47:python-subprocess-run","file":"scripts/environment_check.py","pattern":"Python subprocess.run","snippet":"result=subprocess.run([str(executable),'--version'],capture_output=True,text=True,timeout=10,check=T","category":"external_commands","line_end":47,"severity":"high","line_start":47},{"id":"external_commands:scripts/visual_verification.py:102:python-subprocess-run","file":"scripts/visual_verification.py","pattern":"Python subprocess.run","snippet":"completed = subprocess.run(","category":"external_commands","line_end":102,"severity":"high","line_start":102},{"id":"external_commands:scripts/visual_verification.py:128:python-subprocess-run","file":"scripts/visual_verification.py","pattern":"Python subprocess.run","snippet":"converted = subprocess.run(","category":"external_commands","line_end":128,"severity":"high","line_start":128},{"id":"external_commands:scripts/chapter_deck.mjs:14:synchronous-file-execution","file":"scripts/chapter_deck.mjs","pattern":"Synchronous file execution","snippet":"execFileSync(PY,[path.join(root,'chapter_presentation.py'),'--model',modelFile,'--selection',selecti","category":"external_commands","line_end":14,"severity":"high","line_start":14},{"id":"external_commands:scripts/chapter_deck.mjs:199:synchronous-file-execution","file":"scripts/chapter_deck.mjs","pattern":"Synchronous file execution","snippet":"execFileSync(PY,[path.join(root,'chapter_pptx_export.py'),'--model',modelFile,'--selection',selectio","category":"external_commands","line_end":199,"severity":"high","line_start":199},{"id":"external_commands:scripts/ppt_theme_samples.mjs:15:synchronous-file-execution","file":"scripts/ppt_theme_samples.mjs","pattern":"Synchronous file execution","snippet":"const validated=JSON.parse(execFileSync(PY,['-c',","category":"external_commands","line_end":15,"severity":"high","line_start":15},{"id":"external_commands:scripts/ppt_theme_samples.mjs:51:synchronous-file-execution","file":"scripts/ppt_theme_samples.mjs","pattern":"Synchronous file execution","snippet":"execFileSync(PY,[path.join(root,'ppt_theme_sample_export.py'),'--source',inputFile,'--selection',sel","category":"external_commands","line_end":51,"severity":"high","line_start":51},{"id":"external_commands:scripts/ppt_theme_samples.mjs:54:synchronous-file-execution","file":"scripts/ppt_theme_samples.mjs","pattern":"Synchronous file execution","snippet":"const sv=JSON.parse(execFileSync(PY,['-c','import sys,json;sys.path.insert(0,sys.argv[1]);from ppt_t","category":"external_commands","line_end":54,"severity":"high","line_start":54},{"id":"blocker:scripts/html_renderer.py:269:template-injection-targeting-system-prompt","file":"scripts/html_renderer.py","pattern":"Template injection targeting system prompt","snippet":"*{{box-sizing:border-box}}body{{margin:0;background:var(--bg);color:var(--ink);font-family:\"Microsof","category":"blocker","line_end":269,"severity":"medium","line_start":269},{"id":"blocker:scripts/html_renderer.py:662:template-injection-targeting-system-prompt","file":"scripts/html_renderer.py","pattern":"Template injection targeting system prompt","snippet":"*{{box-sizing:border-box}} body{{margin:0;background:var(--bg);color:var(--ink);font-family:\"Microso","category":"blocker","line_end":662,"severity":"medium","line_start":662},{"id":"sensitive:.gitignore:30:sqlite-database-file","file":".gitignore","pattern":"SQLite database file","snippet":"Thumbs.db","category":"sensitive","line_end":30,"severity":"medium","line_start":30},{"id":"obfuscation:scripts/html_qa.py:219:deprecated-unescape-function","file":"scripts/html_qa.py","pattern":"Deprecated unescape function","snippet":"readable = html.unescape(re.sub(r'<[^>]+>', ' ', action_block))","category":"obfuscation","line_end":219,"severity":"medium","line_start":219},{"id":"obfuscation:scripts/html_qa.py:235:deprecated-unescape-function","file":"scripts/html_qa.py","pattern":"Deprecated unescape function","snippet":"visible = html.unescape(re.sub(r\"<[^>]+>\", \" \", visible))","category":"obfuscation","line_end":235,"severity":"medium","line_start":235},{"id":"scripts:scripts/build_pptx.py:22:dynamic-import-expression","file":"scripts/build_pptx.py","pattern":"Dynamic import() expression","snippet":"from presentation_contracts import (","category":"scripts","line_end":29,"severity":"medium","line_start":22},{"id":"scripts:scripts/content_qa.py:7:dynamic-import-expression","file":"scripts/content_qa.py","pattern":"Dynamic import() expression","snippet":"from content_selection import (","category":"scripts","line_end":13,"severity":"medium","line_start":7},{"id":"scripts:scripts/html_renderer.py:9:dynamic-import-expression","file":"scripts/html_renderer.py","pattern":"Dynamic import() expression","snippet":"from content_resolver import (","category":"scripts","line_end":14,"severity":"medium","line_start":9},{"id":"scripts:scripts/model_validation.py:8:dynamic-import-expression","file":"scripts/model_validation.py","pattern":"Dynamic import() expression","snippet":"from presentation_contracts import (","category":"scripts","line_end":12,"severity":"medium","line_start":8},{"id":"scripts:scripts/model_validation.py:17:dynamic-import-expression","file":"scripts/model_validation.py","pattern":"Dynamic import() expression","snippet":"from content_resolver import (","category":"scripts","line_end":21,"severity":"medium","line_start":17},{"id":"scripts:scripts/narrative_planner.py:7:dynamic-import-expression","file":"scripts/narrative_planner.py","pattern":"Dynamic import() expression","snippet":"from story_topology import (","category":"scripts","line_end":11,"severity":"medium","line_start":7},{"id":"scripts:scripts/ppt_qa.py:13:dynamic-import-expression","file":"scripts/ppt_qa.py","pattern":"Dynamic import() expression","snippet":"from presentation_contracts import (","category":"scripts","line_end":19,"severity":"medium","line_start":13},{"id":"scripts:scripts/sheet_to_report.py:32:dynamic-import-expression","file":"scripts/sheet_to_report.py","pattern":"Dynamic import() expression","snippet":"from evidence_catalog import (","category":"scripts","line_end":35,"severity":"medium","line_start":32},{"id":"scripts:scripts/sheet_to_report.py:40:dynamic-import-expression","file":"scripts/sheet_to_report.py","pattern":"Dynamic import() expression","snippet":"from input_preflight import (","category":"scripts","line_end":45,"severity":"medium","line_start":40},{"id":"scripts:scripts/chart_contract.py:20:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"def _require(condition, message):","category":"scripts","line_end":20,"severity":"medium","line_start":20},{"id":"scripts:scripts/chart_contract.py:48:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(value, str), \"时间标签必须是 ISO 字符串\")","category":"scripts","line_end":48,"severity":"medium","line_start":48},{"id":"scripts:scripts/chart_contract.py:51:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(len(value) == 7, \"月份必须使用 YYYY-MM\")","category":"scripts","line_end":51,"severity":"medium","line_start":51},{"id":"scripts:scripts/chart_contract.py:55:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(result.isoformat() == value, \"日期必须使用 YYYY-MM-DD\")","category":"scripts","line_end":55,"severity":"medium","line_start":55},{"id":"scripts:scripts/chart_contract.py:70:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(chart, dict) and required <= set(chart) and not set(chart) - required - optional","category":"scripts","line_end":70,"severity":"medium","line_start":70},{"id":"scripts:scripts/chart_contract.py:71:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(chart[\"version\"] == VERSION, \"不支持的图表合同版本\")","category":"scripts","line_end":71,"severity":"medium","line_start":71},{"id":"scripts:scripts/chart_contract.py:73:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(chart[key], str) and bool(chart[key].strip()), \"图表标识、任务和理由必须非空\")","category":"scripts","line_end":73,"severity":"medium","line_start":73},{"id":"scripts:scripts/chart_contract.py:75:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(kind in KINDS and kind in TASK_KINDS.get(chart[\"task\"], set()), \"任务与图型不匹配\")","category":"scripts","line_end":75,"severity":"medium","line_start":75},{"id":"scripts:scripts/chart_contract.py:76:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(chart[\"title\"], list) and bool(chart[\"title\"]), \"标题必须使用证据文本片段\")","category":"scripts","line_end":76,"severity":"medium","line_start":76},{"id":"scripts:scripts/chart_contract.py:77:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(chart[\"constraints\"], list) and all(isinstance(s, str) and s.strip() for s in ch","category":"scripts","line_end":77,"severity":"medium","line_start":77},{"id":"scripts:scripts/chart_contract.py:78:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(type(chart[\"limit\"]) is int and 1 <= chart[\"limit\"] <= 500, \"limit 必须为 1 至 500 整数\")","category":"scripts","line_end":78,"severity":"medium","line_start":78},{"id":"scripts:scripts/chart_contract.py:80:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(scale in {\"category\", \"time\", \"linear\"} and order in {\"source\", \"descending\", \"absolute\"}, ","category":"scripts","line_end":80,"severity":"medium","line_start":80},{"id":"scripts:scripts/chart_contract.py:81:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(chart.get(\"emphasis\", \"supporting\") in {\"primary\", \"supporting\"}, \"图表层级不合法\")","category":"scripts","line_end":81,"severity":"medium","line_start":81},{"id":"scripts:scripts/chart_contract.py:82:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require((kind == \"paired\") == (\"y2\" in chart), \"仅 paired 必须提供 y2\")","category":"scripts","line_end":82,"severity":"medium","line_start":82},{"id":"scripts:scripts/chart_contract.py:83:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require((kind in {\"grouped\", \"stacked\"}) == (\"series\" in chart), \"仅 grouped/stacked 必须提供 series\")","category":"scripts","line_end":83,"severity":"medium","line_start":83},{"id":"scripts:scripts/chart_contract.py:85:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(chart[\"series\"], list) and 2 <= len(chart[\"series\"]) <= 6 and chart[\"series\"][0]","category":"scripts","line_end":85,"severity":"medium","line_start":85},{"id":"scripts:scripts/chart_contract.py:87:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(scale != \"linear\" or kind in {\"line\", \"scatter\"}, \"数值横轴仅用于线图和散点\")","category":"scripts","line_end":87,"severity":"medium","line_start":87},{"id":"scripts:scripts/chart_contract.py:88:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(kind != \"scatter\" or scale == \"linear\", \"散点必须使用数值横轴\")","category":"scripts","line_end":88,"severity":"medium","line_start":88},{"id":"scripts:scripts/chart_contract.py:89:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(scale != \"time\" or kind in {\"line\", \"column\", \"grouped\", \"paired\"}, \"此图型不支持时间横轴\")","category":"scripts","line_end":89,"severity":"medium","line_start":89},{"id":"scripts:scripts/chart_contract.py:90:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(scale == \"category\" or order == \"source\", \"时间与数值横轴不能按数值排名重排\")","category":"scripts","line_end":90,"severity":"medium","line_start":90},{"id":"scripts:scripts/chart_contract.py:91:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(kind not in {\"waterfall\", \"histogram\"} or order == \"source\", \"贡献步骤和箱边界不可重排\")","category":"scripts","line_end":91,"severity":"medium","line_start":91},{"id":"scripts:scripts/chart_contract.py:92:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(record, dict) and isinstance(record.get(\"columns\"), dict) and isinstance(record.","category":"scripts","line_end":92,"severity":"medium","line_start":92},{"id":"scripts:scripts/chart_contract.py:96:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(isinstance(k, str) and k in columns for k in keys) and len(set(keys)) == len(keys), \"列不","category":"scripts","line_end":96,"severity":"medium","line_start":96},{"id":"scripts:scripts/chart_contract.py:98:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(columns[key].get(\"label\"), str) and isinstance(columns[key].get(\"unit\"), str), \"","category":"scripts","line_end":98,"severity":"medium","line_start":98},{"id":"scripts:scripts/chart_contract.py:100:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(len({columns[k][\"unit\"] for k in series}) == 1, \"同轴系列单位必须一致\")","category":"scripts","line_end":100,"severity":"medium","line_start":100},{"id":"scripts:scripts/chart_contract.py:102:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(isinstance(columns[k].get(\"denominator\"), str) and columns[k][\"denominator\"] for k in s","category":"scripts","line_end":102,"severity":"medium","line_start":102},{"id":"scripts:scripts/chart_contract.py:104:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(columns[k].get(\"additive\") is True for k in series), \"贡献只能使用可加总指标\")","category":"scripts","line_end":104,"severity":"medium","line_start":104},{"id":"scripts:scripts/chart_contract.py:105:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(len(rows) <= chart[\"limit\"], \"贡献视图不得截掉尾部\")","category":"scripts","line_end":105,"severity":"medium","line_start":105},{"id":"scripts:scripts/chart_contract.py:109:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(row, dict), \"证据行必须是对象\")","category":"scripts","line_end":109,"severity":"medium","line_start":109},{"id":"scripts:scripts/chart_contract.py:111:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(type(value) in (str, int, float) and bool(str(value).strip()) and (type(value) is str or _n","category":"scripts","line_end":111,"severity":"medium","line_start":111},{"id":"scripts:scripts/chart_contract.py:114:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(_number(row.get(key)), \"全部证据数值必须有限,不得忽略尾部缺失\")","category":"scripts","line_end":114,"severity":"medium","line_start":114},{"id":"scripts:scripts/chart_contract.py:116:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(_number(row.get(x)), \"数值横轴必须使用有限数值\")","category":"scripts","line_end":116,"severity":"medium","line_start":116},{"id":"scripts:scripts/chart_contract.py:119:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(len(set(labels)) == len(labels), \"对象标签重复\")","category":"scripts","line_end":119,"severity":"medium","line_start":119},{"id":"scripts:scripts/chart_contract.py:121:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(a < b for a, b in zip(numeric_x, numeric_x[1:])), \"数值横轴必须严格递增\")","category":"scripts","line_end":121,"severity":"medium","line_start":121},{"id":"scripts:scripts/chart_contract.py:123:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(highlight, list) and all(isinstance(v, str) and v in labels for v in highlight) ","category":"scripts","line_end":123,"severity":"medium","line_start":123},{"id":"scripts:scripts/chart_contract.py:125:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(len(rows) <= chart[\"limit\"], \"此图型必须完整展示,不能截尾\")","category":"scripts","line_end":125,"severity":"medium","line_start":125},{"id":"scripts:scripts/chart_contract.py:127:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(min(len(rows), chart[\"limit\"]) <= readable_limit, \"类别过多,需显式选择可读图型或计算聚合证据\")","category":"scripts","line_end":127,"severity":"medium","line_start":127},{"id":"scripts:scripts/chart_contract.py:129:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(isinstance(semantics, dict), \"图形语义必须由计算端提供\")","category":"scripts","line_end":129,"severity":"medium","line_start":129},{"id":"scripts:scripts/chart_contract.py:134:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(frequency in {\"day\", \"week\", \"month\"} and isinstance(expected, list) and bool(expected), \"时","category":"scripts","line_end":134,"severity":"medium","line_start":134},{"id":"scripts:scripts/chart_contract.py:136:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(_next_date(a, frequency) == b for a, b in zip(domain, domain[1:])), \"预期时间域必须连续且有序\")","category":"scripts","line_end":136,"severity":"medium","line_start":136},{"id":"scripts:scripts/chart_contract.py:138:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(all(v in domain for v in observed) and all(a < b for a, b in zip(observed, observed[1:])), ","category":"scripts","line_end":138,"severity":"medium","line_start":138},{"id":"scripts:scripts/chart_contract.py:139:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(len(expected) <= chart[\"limit\"], \"时间域不可截尾\")","category":"scripts","line_end":139,"severity":"medium","line_start":139},{"id":"scripts:scripts/chart_contract.py:142:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(partition.get(\"mutually_exclusive\") is True and partition.get(\"complete\") is True, \"环形图需要完整","category":"scripts","line_end":142,"severity":"medium","line_start":142},{"id":"scripts:scripts/chart_contract.py:143:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(columns[y][\"unit\"] == \"%\" and isinstance(columns[y].get(\"denominator\"), str) and bool(colum","category":"scripts","line_end":143,"severity":"medium","line_start":143},{"id":"scripts:scripts/chart_contract.py:144:dynamic-require-with-variable","file":"scripts/chart_contract.py","pattern":"Dynamic require with variable","snippet":"_require(2 <= len(rows) <= 6 and all(r[y] >= 0 for r in rows) and _close(fsum(r[y] for r in rows), 1","category":"scripts","line_end":144,"severity":"medium","line_start":144},{"id":"filesystem:scripts/chapter_deck.mjs:31:hidden-file-access","file":"scripts/chapter_deck.mjs","pattern":"Hidden file access","snippet":"const color=role=>'#'+(/^design-\\d+$/.test(role)?readableAccent(Number(role.slice(7))):(c[role]??c.i","category":"filesystem","line_end":31,"severity":"medium","line_start":31},{"id":"filesystem:scripts/chapter_deck.mjs:63:hidden-file-access","file":"scripts/chapter_deck.mjs","pattern":"Hidden file access","snippet":"const label=chartNumber(value),actualWidth=[...label].reduce((s,c)=>s+(/[^\\x00-\\xff]/.test(c)?20:11)","category":"filesystem","line_end":63,"severity":"medium","line_start":63},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:7:hidden-file-access","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Hidden file access","snippet":"if(/^[,。、;:!?)】》”’]$/.test(token)&&tokens.length&&tokens.at(-1)!=='\\n')tokens[tokens.length-1]+=toke","category":"filesystem","line_end":7,"severity":"medium","line_start":7},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:13:hidden-file-access","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Hidden file access","snippet":"const width=[...token].reduce((sum,ch)=>sum+(/[^\\x00-\\xff]/.test(ch)?1:.55),0);","category":"filesystem","line_end":13,"severity":"medium","line_start":13},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:25:hidden-file-access","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Hidden file access","snippet":"if(!tokens.length || tokens.some(t=>!/^page-\\d{3}$/.test(t)) || new Set(tokens).size!==tokens.length","category":"filesystem","line_end":25,"severity":"medium","line_start":25},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:34:hidden-file-access","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Hidden file access","snippet":"if (tokens.length !== 2 || tokens.some(t => !/^[1-9]\\d*$/.test(t)))","category":"filesystem","line_end":34,"severity":"medium","line_start":34},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:154:hidden-file-access","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Hidden file access","snippet":"if(last>0 && /^[\\u3400-\\u9fff]$/.test(titleRows[last]) && /[\\u3400-\\u9fff]{2}$/.test(titleRows[last-","category":"filesystem","line_end":154,"severity":"medium","line_start":154},{"id":"filesystem:scripts/chapter_deck.mjs:15:node-js-fs-operations","file":"scripts/chapter_deck.mjs","pattern":"Node.js fs operations","snippet":"const d=JSON.parse(await fs.readFile(projectionFile,'utf8')),c=d.selection.config.palette,F=d.select","category":"filesystem","line_end":15,"severity":"medium","line_start":15},{"id":"filesystem:scripts/chapter_deck.mjs:166:node-js-fs-operations","file":"scripts/chapter_deck.mjs","pattern":"Node.js fs operations","snippet":"await fs.mkdir(outDir,{recursive:false});","category":"filesystem","line_end":166,"severity":"medium","line_start":166},{"id":"filesystem:scripts/chapter_deck.mjs:167:node-js-fs-operations","file":"scripts/chapter_deck.mjs","pattern":"Node.js fs operations","snippet":"await fs.writeFile(path.join(outDir,'scene.json'),JSON.stringify({source:d.sha256,width:1280,height:","category":"filesystem","line_end":167,"severity":"medium","line_start":167},{"id":"filesystem:scripts/chapter_deck.mjs:176:node-js-fs-operations","file":"scripts/chapter_deck.mjs","pattern":"Node.js fs operations","snippet":"await fs.writeFile(path.join(outDir,'theme.json'),JSON.stringify(theme,null,2));await fs.mkdir(path.","category":"filesystem","line_end":176,"severity":"medium","line_start":176},{"id":"filesystem:scripts/chapter_deck.mjs:196:node-js-fs-operations","file":"scripts/chapter_deck.mjs","pattern":"Node.js fs operations","snippet":"await fs.writeFile(path.join(outDir,'slides',`slide_${String(i+1).padStart(2,'0')}.svg`),parts.join(","category":"filesystem","line_end":196,"severity":"medium","line_start":196},{"id":"filesystem:scripts/html_chapter_renderer.py:127:node-js-fs-operations","file":"scripts/html_chapter_renderer.py","pattern":"Node.js fs operations","snippet":"proofs.append(f'<details><summary>{esc(record[\"label\"])}</summary><p class=\"limit\">{esc(record[\"scop","category":"filesystem","line_end":127,"severity":"medium","line_start":127},{"id":"filesystem:scripts/html_renderer.py:521:node-js-fs-operations","file":"scripts/html_renderer.py","pattern":"Node.js fs operations","snippet":"proofs.append(","category":"filesystem","line_end":521,"severity":"medium","line_start":521},{"id":"filesystem:scripts/html_renderer.py:526:node-js-fs-operations","file":"scripts/html_renderer.py","pattern":"Node.js fs operations","snippet":"proofs.append(_svg_chart(chart, render_scope(chart)))","category":"filesystem","line_end":526,"severity":"medium","line_start":526},{"id":"filesystem:scripts/html_renderer.py:530:node-js-fs-operations","file":"scripts/html_renderer.py","pattern":"Node.js fs operations","snippet":"proofs.append(f'<p class=\"chapter-proof-link\">共同证据:<a href=\"#{proof_anchors[evidence_id]}\">查看前文数值证明表","category":"filesystem","line_end":530,"severity":"medium","line_start":530},{"id":"filesystem:scripts/html_renderer.py:537:node-js-fs-operations","file":"scripts/html_renderer.py","pattern":"Node.js fs operations","snippet":"proofs.append(f'<div class=\"proof-block\"><div class=\"evidence-table-wrap\" tabindex=\"0\" role=\"region\"","category":"filesystem","line_end":537,"severity":"medium","line_start":537},{"id":"filesystem:scripts/html_renderer.py:545:node-js-fs-operations","file":"scripts/html_renderer.py","pattern":"Node.js fs operations","snippet":"proofs.append(f'<div class=\"evidence-table-wrap\" tabindex=\"0\" role=\"region\" aria-label=\"集中度逐月证明\">'","category":"filesystem","line_end":545,"severity":"medium","line_start":545},{"id":"filesystem:scripts/ppt_theme_samples.mjs:14:node-js-fs-operations","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js fs operations","snippet":"const s=JSON.parse(await fs.readFile(selectionFile,'utf8')),d=JSON.parse(await fs.readFile(inputFile","category":"filesystem","line_end":14,"severity":"medium","line_start":14},{"id":"filesystem:scripts/ppt_theme_samples.mjs:21:node-js-fs-operations","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js fs operations","snippet":"await fs.mkdir(outDir,{recursive:false});","category":"filesystem","line_end":21,"severity":"medium","line_start":21},{"id":"filesystem:scripts/ppt_theme_samples.mjs:45:node-js-fs-operations","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js fs operations","snippet":"const manifest={schema:'ppt-theme-sample-export/1',selection:s,source_file_sha256:sha(await fs.readF","category":"filesystem","line_end":45,"severity":"medium","line_start":45},{"id":"filesystem:scripts/ppt_theme_samples.mjs:46:node-js-fs-operations","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js fs operations","snippet":"await fs.writeFile(path.join(outDir,'manifest.json'),JSON.stringify(manifest,null,2));","category":"filesystem","line_end":46,"severity":"medium","line_start":46},{"id":"filesystem:scripts/ppt_theme_samples.mjs:58:node-js-fs-operations","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js fs operations","snippet":"await fs.writeFile(path.join(outDir,'theme.json'),JSON.stringify(sv,null,2));await fs.mkdir(path.joi","category":"filesystem","line_end":58,"severity":"medium","line_start":58},{"id":"filesystem:scripts/ppt_theme_samples.mjs:79:node-js-fs-operations","file":"scripts/ppt_theme_samples.mjs","pattern":"Node.js fs operations","snippet":"}await fs.writeFile(path.join(outDir,'slides',`slide_${n+1}.svg`),parts.join('\\n'));","category":"filesystem","line_end":79,"severity":"medium","line_start":79},{"id":"filesystem:scripts/chapter_native_scene_qa.py:6:python-archive-libraries","file":"scripts/chapter_native_scene_qa.py","pattern":"Python archive libraries","snippet":"from zipfile import ZipFile","category":"filesystem","line_end":6,"severity":"medium","line_start":6},{"id":"filesystem:scripts/chapter_pptx_prepare.py:6:python-archive-libraries","file":"scripts/chapter_pptx_prepare.py","pattern":"Python archive libraries","snippet":"from zipfile import ZipFile","category":"filesystem","line_end":6,"severity":"medium","line_start":6},{"id":"filesystem:scripts/chapter_presentation_qa.py:9:python-archive-libraries","file":"scripts/chapter_presentation_qa.py","pattern":"Python archive libraries","snippet":"from zipfile import ZipFile","category":"filesystem","line_end":9,"severity":"medium","line_start":9},{"id":"filesystem:scripts/generate_sample.py:10:python-archive-libraries","file":"scripts/generate_sample.py","pattern":"Python archive libraries","snippet":"from zipfile import ZIP_DEFLATED, ZipFile, ZipInfo","category":"filesystem","line_end":10,"severity":"medium","line_start":10},{"id":"filesystem:scripts/slideviber_consistency.py:9:python-archive-libraries","file":"scripts/slideviber_consistency.py","pattern":"Python archive libraries","snippet":"import zipfile","category":"filesystem","line_end":9,"severity":"medium","line_start":9},{"id":"filesystem:scripts/slideviber_consistency.py:547:python-archive-libraries","file":"scripts/slideviber_consistency.py","pattern":"Python archive libraries","snippet":"with zipfile.ZipFile(source_path, \"r\") as source, zipfile.ZipFile(","category":"filesystem","line_end":547,"severity":"medium","line_start":547},{"id":"filesystem:scripts/sheet_to_report.py:2954:python-shutil-operations","file":"scripts/sheet_to_report.py","pattern":"Python shutil operations","snippet":"shutil.copy2(output_dir / name, backup_dir / name)","category":"filesystem","line_end":2954,"severity":"medium","line_start":2954},{"id":"filesystem:scripts/sheet_to_report.py:2979:python-shutil-operations","file":"scripts/sheet_to_report.py","pattern":"Python shutil operations","snippet":"shutil.rmtree(backup_dir, ignore_errors=True)","category":"filesystem","line_end":2979,"severity":"medium","line_start":2979},{"id":"filesystem:scripts/sheet_to_report.py:3129:python-shutil-operations","file":"scripts/sheet_to_report.py","pattern":"Python shutil operations","snippet":"shutil.rmtree(staging_dir, ignore_errors=True)","category":"filesystem","line_end":3129,"severity":"medium","line_start":3129},{"id":"filesystem:scripts/visual_verification.py:18:python-shutil-operations","file":"scripts/visual_verification.py","pattern":"Python shutil operations","snippet":"shutil.rmtree(path, ignore_errors=True)","category":"filesystem","line_end":18,"severity":"medium","line_start":18},{"id":"filesystem:scripts/visual_verification.py:180:python-shutil-operations","file":"scripts/visual_verification.py","pattern":"Python shutil operations","snippet":"shutil.rmtree(run_directory, ignore_errors=True)","category":"filesystem","line_end":180,"severity":"medium","line_start":180},{"id":"external_commands:scripts/analysis_engine.py:592:ruby-shell-backtick-execution","file":"scripts/analysis_engine.py","pattern":"Ruby/shell backtick execution","snippet":"\"\"\"Keep pandas grouping keys typed: ``1`` and ``\\\"1\\\"`` are distinct.\"\"\"","category":"external_commands","line_end":592,"severity":"medium","line_start":592},{"id":"external_commands:scripts/chapter_chart_geometry.mjs:14:ruby-shell-backtick-execution","file":"scripts/chapter_chart_geometry.mjs","pattern":"Ruby/shell backtick execution","snippet":"const t=wrap(`${i+1} ${label}\\n${fmt(v.x_values[i])}, ${fmt(v.series[0].values[i])}`,Math.floor(w/19","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:scripts/chapter_chart_geometry.mjs:120:ruby-shell-backtick-execution","file":"scripts/chapter_chart_geometry.mjs","pattern":"Ruby/shell backtick execution","snippet":"const shown=histogram?`[${fmt(v.bin_lower[i])}, ${fmt(v.bin_upper[i])}${i===v.labels.length-1?']':')","category":"external_commands","line_end":120,"severity":"medium","line_start":120},{"id":"external_commands:scripts/chapter_deck.mjs:49:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"objects.push({kind:'path',d:`M ${p} A ${r} ${r} 0 ${b-a>Math.PI?1:0} 1 ${q} L ${u} A ${inner} ${inne","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:scripts/chapter_deck.mjs:104:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"text(`${String(d.slides.indexOf(page)+1).padStart(2,'0')} / ${d.slides.length}`,1100,688,130,26,18,'","category":"external_commands","line_end":104,"severity":"medium","line_start":104},{"id":"external_commands:scripts/chapter_deck.mjs:173:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"const reverse=new Map(Object.entries(theme.colors).map(([key,value])=>[value.toLowerCase(),`var(--${","category":"external_commands","line_end":173,"severity":"medium","line_start":173},{"id":"external_commands:scripts/chapter_deck.mjs:184:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.kind==='polygon')return `<polygon points=\"${o.points.map(p=>p.join(',')).join(' ')}\" fill=\"${co","category":"external_commands","line_end":184,"severity":"medium","line_start":184},{"id":"external_commands:scripts/chapter_deck.mjs:185:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.kind==='text')return `<foreignObject x=\"${o.x}\" y=\"${o.y}\" width=\"${o.w}\" height=\"${o.h}\"><div ","category":"external_commands","line_end":185,"severity":"medium","line_start":185},{"id":"external_commands:scripts/chapter_deck.mjs:186:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.kind==='rect')return `<rect x=\"${o.x}\" y=\"${o.y}\" width=\"${o.w}\" height=\"${o.h}\" fill=\"${col(o.","category":"external_commands","line_end":186,"severity":"medium","line_start":186},{"id":"external_commands:scripts/chapter_deck.mjs:188:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.x1===o.x2||o.y1===o.y2)return `<rect x=\"${Math.min(o.x1,o.x2)}\" y=\"${Math.min(o.y1,o.y2)}\" widt","category":"external_commands","line_end":188,"severity":"medium","line_start":188},{"id":"external_commands:scripts/chapter_deck.mjs:189:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"return `<line x1=\"${o.x1}\" y1=\"${o.y1}\" x2=\"${o.x2}\" y2=\"${o.y2}\" stroke=\"${col(o.fill)}\" stroke-wid","category":"external_commands","line_end":189,"severity":"medium","line_start":189},{"id":"external_commands:scripts/chapter_deck.mjs:191:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.kind==='circle')return `<circle cx=\"${o.cx}\" cy=\"${o.cy}\" r=\"${o.r}\" fill=\"${col(o.fill)}\"/>`;","category":"external_commands","line_end":191,"severity":"medium","line_start":191},{"id":"external_commands:scripts/chapter_deck.mjs:192:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.kind==='polyline')return `<polyline points=\"${o.points.map(p=>p.join(',')).join(' ')}\" fill=\"no","category":"external_commands","line_end":192,"severity":"medium","line_start":192},{"id":"external_commands:scripts/chapter_deck.mjs:193:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"if(o.kind==='path')return `<path transform=\"scale(1.5)\" d=\"${o.d}\" fill=\"${col(o.fill)}\"/>`;","category":"external_commands","line_end":193,"severity":"medium","line_start":193},{"id":"external_commands:scripts/chapter_deck.mjs:196:ruby-shell-backtick-execution","file":"scripts/chapter_deck.mjs","pattern":"Ruby/shell backtick execution","snippet":"await fs.writeFile(path.join(outDir,'slides',`slide_${String(i+1).padStart(2,'0')}.svg`),parts.join(","category":"external_commands","line_end":196,"severity":"medium","line_start":196},{"id":"external_commands:scripts/chapter_slideviber_design.mjs:19:ruby-shell-backtick-execution","file":"scripts/chapter_slideviber_design.mjs","pattern":"Ruby/shell backtick execution","snippet":"const x=64+i*(w+28),role=`design-${i}`;","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:scripts/chapter_slideviber_design.mjs:40:ruby-shell-backtick-execution","file":"scripts/chapter_slideviber_design.mjs","pattern":"Ruby/shell backtick execution","snippet":"put(b.text,x,y+65,298,65,34,`design-${i%2}`,true,9);","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:scripts/chapter_slideviber_design.mjs:56:ruby-shell-backtick-execution","file":"scripts/chapter_slideviber_design.mjs","pattern":"Ruby/shell backtick execution","snippet":"const x=64+i*(w+30),role=`design-${i}`;","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"external_commands:scripts/content_qa.py:53:ruby-shell-backtick-execution","file":"scripts/content_qa.py","pattern":"Ruby/shell backtick execution","snippet":"# ``\\w`` treats Chinese characters as word characters.  A source","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:scripts/content_resolver.py:17:ruby-shell-backtick-execution","file":"scripts/content_resolver.py","pattern":"Ruby/shell backtick execution","snippet":"# This is the shared formal renderer schema. ``None`` is deliberate for a","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:scripts/ppt_theme_samples.mjs:48:ruby-shell-backtick-execution","file":"scripts/ppt_theme_samples.mjs","pattern":"Ruby/shell backtick execution","snippet":"function svgText(t,x,y,w,h,size,color,bold=false,align='left'){return `<foreignObject x=\"${x*1.5}\" y","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:scripts/ppt_theme_samples.mjs:60:ruby-shell-backtick-execution","file":"scripts/ppt_theme_samples.mjs","pattern":"Ruby/shell backtick execution","snippet":"const r=(x,y,w,h,col)=>parts.push(`<rect x=\"${x*1.5}\" y=\"${y*1.5}\" width=\"${w*1.5}\" height=\"${h*1.5}","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:scripts/ppt_theme_samples.mjs:79:ruby-shell-backtick-execution","file":"scripts/ppt_theme_samples.mjs","pattern":"Ruby/shell backtick execution","snippet":"}await fs.writeFile(path.join(outDir,'slides',`slide_${n+1}.svg`),parts.join('\\n'));","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:scripts/report_model_projection.py:47:ruby-shell-backtick-execution","file":"scripts/report_model_projection.py","pattern":"Ruby/shell backtick execution","snippet":"# ``warnings`` and narrative diagnostics are page-order-dependent output","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:scripts/report_model_projection.py:189:ruby-shell-backtick-execution","file":"scripts/report_model_projection.py","pattern":"Ruby/shell backtick execution","snippet":"\"\"\"Return the single canonical formal-content projection, or ``None`` for retail/general models.\"\"\"","category":"external_commands","line_end":189,"severity":"medium","line_start":189},{"id":"external_commands:scripts/slideviber_consistency.py:428:ruby-shell-backtick-execution","file":"scripts/slideviber_consistency.py","pattern":"Ruby/shell backtick execution","snippet":"``python-pptx`` does not expose a reliable ``FillFormat.transparency``;","category":"external_commands","line_end":428,"severity":"medium","line_start":428},{"id":"external_commands:scripts/slideviber_consistency.py:429:ruby-shell-backtick-execution","file":"scripts/slideviber_consistency.py","pattern":"Ruby/shell backtick execution","snippet":"alpha lives under the shape's direct ``spPr`` solid-fill color node in the","category":"external_commands","line_end":429,"severity":"medium","line_start":429},{"id":"external_commands:scripts/slideviber_handoff.py:39:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"f\"  - `{token}`\"","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:scripts/slideviber_handoff.py:44:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"f\"  - `{item['lock_id']}`|{item['lock_type']}|\"","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:scripts/slideviber_handoff.py:57:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"f\"  - `{item['chart_id']}`|指标 {item.get('metric_name', '')}|\"","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:scripts/slideviber_handoff.py:65:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"- 推荐版式:`{slide['layout_id']}`(轮廓 `{slide['silhouette']}`)","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:scripts/slideviber_handoff.py:82:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"标准汇报版 `report.pptx` 必须先独立达到职场汇报标准。若需要更强的演示感,可继续使用 SlideViber,核验预览后导出 `report-polished.pptx`;没有已确认风格且","category":"external_commands","line_end":82,"severity":"medium","line_start":82},{"id":"external_commands:scripts/slideviber_handoff.py:93:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"- 有色强调卡或分区色带中的独立标题、标签和核心数值必须以容器几何中心为基准水平居中;SVG 文本使用容器中心 x 坐标并设置 `text-anchor=\"middle\"`,多行组合按整体视觉中心布置","category":"external_commands","line_end":93,"severity":"medium","line_start":93},{"id":"external_commands:scripts/slideviber_handoff.py:94:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"- 日期、数字与单位、指标名称和英文缩写属于不可拆语义单元;在 SVG `foreignObject` 中使用 `white-space: nowrap` 的内联容器保护,或使用等效不换行标记,不得把","category":"external_commands","line_end":94,"severity":"medium","line_start":94},{"id":"external_commands:scripts/slideviber_handoff.py:95:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"- 同一页的完整同比/环比周期只在固定元信息区声明一次;标题使用 `display_claim`,正文只保留“同比/环比”短标签与业务判断。语义锁中的完整原句用于追溯,不得机械复制到每个段落。","category":"external_commands","line_end":95,"severity":"medium","line_start":95},{"id":"external_commands:scripts/slideviber_handoff.py:98:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"- 导出后执行:`python scripts/slideviber_consistency.py --model report_model.json --pptx report-polished.p","category":"external_commands","line_end":98,"severity":"medium","line_start":98},{"id":"external_commands:scripts/slideviber_handoff.py:113:ruby-shell-backtick-execution","file":"scripts/slideviber_handoff.py","pattern":"Ruby/shell backtick execution","snippet":"请以 `report_model.json` 的 `slide_plan` 为唯一内容真相源,按以上逐页 ID 和锁定证据重绘 16:9 演示稿;先依照上述主题选择来源处理:已确认方向直接沿用,明确授","category":"external_commands","line_end":113,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `business_review`:回答经营变化、结构驱动、风险与行动;正式 HTML 按有证据的业务问题组织章节,不预设页数。","category":"external_commands","line_end":97,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `exploration`:在已确认语义范围内探索可验证线索;证据不足的内容降级为带限制的假设。","category":"external_commands","line_end":98,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `engineering_regression`:只输出计算合同、数据质量与回归核验 dossier,不生成经营洞察或行动建议。","category":"external_commands","line_end":99,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"确认分析计划时,面向用户只显示“分析范围、重点问题、必要待确认项、预计交付”四项短句;没有待确认项就明确写“无”。不要让用户填写 `analysis_intent`、JSON、脚本参数或其他内部合同。","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 汇报目标、受众和 `analysis_intent`","category":"external_commands","line_end":110,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"先查看字段名和少量预览。可运行 `python scripts/sheet_to_report.py --inspect path/to/data.xlsx` 获取机器可读的候选字段与待确认问题。若发","category":"external_commands","line_end":116,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`分析意图 → 语义能力与质量决定 → 分析简报 → 候选问题图 → 确定性计算与受控补查 → 决策章节 → 行动合同 → 内容 QA → HTML/PPT`","category":"external_commands","line_end":122,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `analysis_profile=auto` 是默认入口。`general`、`retail_growth` 与 `transactional_commerce` 为 verified;`con","category":"external_commands","line_end":124,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 新比率请求明确单行分母为零的处理。全量投入除以全量产出等总量比率使用 `zero_denominator_policy=include_in_totals`,保留零产出行的投入;仅汇总分母为零时不","category":"external_commands","line_end":127,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 高优先问题按“事实—驱动—细分—经营含义”记录 `required_depth / achieved_depth`。深度不足且仍有合法表内路径时必须继续受控补查;没有真实信息增量时降级,不能用非空","category":"external_commands","line_end":129,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `report_model.json` 是一次生成的内容真相源,洞察、行动、图表均引用可解析的 evidence ID。新版 `html-chapters/1` 通过独立 `chapter-pre","category":"external_commands","line_end":131,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":139,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":141,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"PPT阶段另运行 `python scripts/environment_check.py --target standard`;美化版改为 `--target slideviber --slidev","category":"external_commands","line_end":141,"severity":"medium","line_start":141},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. 预检提示缺少依赖时,再运行 `python -m pip install -r requirements.txt`;不要把依赖或生成文件打包进 Skill。普通安装不要求Git;版本追溯保留文件","category":"external_commands","line_end":146,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":148,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":150,"severity":"medium","line_start":148},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **正式 HTML 默认由宿主 AI 驱动**。先读 [宿主 HTML 分析合同](references/html-analysis.md),显式使用本 Skill 绝对目录。初扫 → 阅读证据","category":"external_commands","line_end":152,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":154,"severity":"medium","line_start":152},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":156,"severity":"medium","line_start":154},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **以下为旧模型兼容入口,不接续上面的新版 HTML 流程。** 经确认的旧分析流程可分两阶段运行。`--analyse-only` 只生成确定性 `analysis_evidence.json","category":"external_commands","line_end":156,"severity":"medium","line_start":156},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":161,"severity":"medium","line_start":158},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":163,"severity":"medium","line_start":161},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"默认 story plan 只能重排已有内容。若表内已有结构证据却缺经营判断,先由当前 AI 阅读冻结证据,按 [证据后判断提案](references/report-model.md#证据后判断提案","category":"external_commands","line_end":164,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. 新版 HTML 在组织提案前读取 [共享图表规格](references/chart-spec.md)。按判断任务与数据条件选图,用 `chart-spec/1` 记录选择理由、限制、尺度和重点","category":"external_commands","line_end":164,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"7. 若用户选择 PPTX,新版 HTML 先读取 [章节到演示投影](references/chapter-presentation.md),使用独立 `chapter-presentation/1","category":"external_commands","line_end":167,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"一个待选择节点只发一次清楚问题,然后停止并等待新用户输入。没有新输入时,不重复催选、重做小样或自行生成完整稿;自动续跑不构成用户确认。只列当前完整稿已经验证的主题,`editorial` 两页小样可做","category":"external_commands","line_end":172,"severity":"medium","line_start":170},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"标准版通过后,交付完整稿阅读入口和独立可编辑 PPTX;只有入口实际可用时才写“预览完整稿”或“下载可编辑 PPT”。随后若用户尚未表态,简短说明可回复“制作美化版”通过 SlideViber 继续;","category":"external_commands","line_end":172,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"9. 美化稿在同一显示尺寸下对照标准稿,检查视觉焦点、图文对应、图表可读性及整稿节奏;只换颜色、分辨率或导出器不算美化完成。精修版导出后运行对应合同的一致性检查;缺少日期、关键数值、判断标题或 evi","category":"external_commands","line_end":173,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":177,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":181,"severity":"medium","line_start":177},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"本节页数、旧字段与 featured 限制描述旧模型兼容行为。新版 `html-chapters/1` 以宿主 HTML 合同为准,背景可进正文、无需制造行动;主图设计与正文事实选择相互独立。","category":"external_commands","line_end":183,"severity":"medium","line_start":181},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 6–10 页只适用于证据充足的 `business_review`;页面由已选择的分析镜头和直接证据决定,不凑固定页数。证据不足返回 `needs_input / insufficient_evi","category":"external_commands","line_end":183,"severity":"medium","line_start":183},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `engineering_regression` 使用明确的 QA dossier,允许少于 6 页;不得出现经营复盘、管理摘要、经营杠杆或行动路线等业务包装。","category":"external_commands","line_end":185,"severity":"medium","line_start":184},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `analysis_brief` 固化受众、目标、节奏与最小必要确认;`candidate_question_graph` 保留问题来源、初扫信号、选择/拒绝理由和字段支持。","category":"external_commands","line_end":185,"severity":"medium","line_start":185},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `analysis_lenses` 记录问题、优先级、所需对象、指标、深度缺口、补查轨迹和停止原因。未选择、不可用或深度不足的问题不得伪装成核心回答。","category":"external_commands","line_end":187,"severity":"medium","line_start":186},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `analysis_chapters` 以问题为单位组合事实、驱动、细分、经营含义、图表和行动;管理摘要只引用已入选章节。","category":"external_commands","line_end":188,"severity":"medium","line_start":187},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- evidence 必须记录公式、过滤范围、样本数、受影响行数/金额、业务对象和限制;事实、诊断、推断、假设分别声明 `claim_type`、`evidence_strength` 和限制。","category":"external_commands","line_end":188,"severity":"medium","line_start":188},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `content_validation` 阻断原始字段泄漏、数字复述、无证据因果、重复结论、套话、空槽、悬空 evidence 和未解析占位符。","category":"external_commands","line_end":196,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 主标题是报告身份与分析主题,不得使用 Skill 产品名。`report_subtitle` 只承载周期或范围,`judgement_headline` 承载最重要判断。","category":"external_commands","line_end":196,"severity":"medium","line_start":196},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `period_overview` 展示分析期累计或整体口径;`latest_snapshot` 展示最新完整周期及实际对比周期。禁止把最新一个周期冒充整个分析期。","category":"external_commands","line_end":197,"severity":"medium","line_start":197},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 章节标题使用业务判断,正文明确对应问题、经营含义、证明图表、行动和边界。原始 `chapter_id / question_id / evidence_id` 只留在模型与 QA,不进入观众可见正","category":"external_commands","line_end":200,"severity":"medium","line_start":199},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `featured` 继续作为旧接口兼容和章节内部候选记录;最终正文选择以 `value_selection.selection_unit=analysis_chapter` 与 `analysi","category":"external_commands","line_end":200,"severity":"medium","line_start":200},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 设计表达根据本页已有内容关系选择构图,不能用大小、顺序或颜色制造未经支持的优先级与因果;图表重点须绑定图中类别及本页判断,强调区不能只重复原读数。美化可将正文无损分段或呈现有原文依据的步骤,必须逐","category":"external_commands","line_end":214,"severity":"medium","line_start":205},{"id":"external_commands:.github/workflows/public-checks.yml:27:shell-command-substitution","file":".github/workflows/public-checks.yml","pattern":"Shell command substitution","snippet":"sample=\"$(find generated-sample -maxdepth 1 -type f -name '*.xlsx' -print -quit)\"","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"blocker:scripts/environment_check.py:51:network-reconnaissance","file":"scripts/environment_check.py","pattern":"Network reconnaissance","snippet":"if not good:issues.append('Node.js 18+ unavailable; install Node or pass --node PATH')","category":"blocker","line_end":51,"severity":"low","line_start":51},{"id":"blocker:scripts/environment_check.py:57:network-reconnaissance","file":"scripts/environment_check.py","pattern":"Network reconnaissance","snippet":"if not good:issues.append('SlideViber not located; install separately and pass --slideviber-dir PATH","category":"blocker","line_end":57,"severity":"low","line_start":57},{"id":"blocker:docs/index.html:11:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":"*{box-sizing:border-box}html{scroll-behavior:smooth}body{margin:0;background:var(--paper);color:var(","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"blocker:docs/index.html:12:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":".site-nav{position:sticky;top:0;z-index:20;background:rgba(247,249,252,.96);border-bottom:1px solid ","category":"blocker","line_end":12,"severity":"low","line_start":12},{"id":"blocker:docs/index.html:13:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":"main{overflow:hidden}.hero{width:min(calc(100% - 40px),var(--max));min-height:650px;margin:0 auto;di","category":"blocker","line_end":13,"severity":"low","line_start":13},{"id":"blocker:docs/index.html:14:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":".section{width:min(calc(100% - 40px),var(--max));margin:0 auto;padding:96px 0}.section-title{margin:","category":"blocker","line_end":14,"severity":"low","line_start":14},{"id":"blocker:docs/index.html:15:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":".compare-wrap{background:var(--white)}.pair-nav{display:flex;flex-wrap:wrap;gap:10px;margin:30px 0 0","category":"blocker","line_end":15,"severity":"low","line_start":15},{"id":"blocker:docs/index.html:16:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":".case-band{background:#102b4e;color:#fff}.case-band .section-lead{color:#bfd0e6}.facts{display:grid;","category":"blocker","line_end":16,"severity":"low","line_start":16},{"id":"blocker:docs/index.html:17:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":"@media(max-width:900px){.hero{min-height:0;grid-template-columns:1fr;gap:46px;padding-top:60px}.hero","category":"blocker","line_end":17,"severity":"low","line_start":17},{"id":"blocker:docs/index.html:18:system-reconnaissance","file":"docs/index.html","pattern":"System reconnaissance","snippet":"@media(max-width:660px){.nav-inner{width:min(calc(100% - 28px),var(--max))}.nav-links a:not(:last-ch","category":"blocker","line_end":18,"severity":"low","line_start":18},{"id":"blocker:docs/report.html:3:system-reconnaissance","file":"docs/report.html","pattern":"System reconnaissance","snippet":":root{--ink:#263341;--muted:#596777;--paper:#faf9f6;--line:#dde2e8;--nav:64px;--blue:#24528a;--green","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:README.md:25:system-reconnaissance","file":"README.md","pattern":"System reconnaissance","snippet":"| ![Standard deck: a full-width editable chart shows that paid advertising return fell from the prio","category":"blocker","line_end":25,"severity":"low","line_start":25},{"id":"blocker:references/report-model.md:92:system-reconnaissance","file":"references/report-model.md","pattern":"System reconnaissance","snippet":"- 默认 story plan 只保存已有 `slide_id / layout_id / evidence_ids / chart_ids / content_refs` 的选择与顺序;不能修改页面","category":"blocker","line_end":92,"severity":"low","line_start":92},{"id":"blocker:references/report-model.md:109:system-reconnaissance","file":"references/report-model.md","pattern":"System reconnaissance","snippet":"- `proposal_id / question_id`:唯一提案 ID、受支持且已选择的真实问题 ID。","category":"blocker","line_end":109,"severity":"low","line_start":109},{"id":"blocker:references/report-model.md:187:system-reconnaissance","file":"references/report-model.md","pattern":"System reconnaissance","snippet":"- `analysis_chapters[]` 是正式正文选择单位。每章至少包含 `chapter_id / question_id / decision_question / judgement /","category":"blocker","line_end":187,"severity":"low","line_start":187},{"id":"blocker:references/report-model.md:207:system-reconnaissance","file":"references/report-model.md","pattern":"System reconnaissance","snippet":"- 洞察、章节、图表和行动通过证据引用绑定 `scope_id / scope_disclosure`。章节合并校验 `fact_evidence_ids / driver_evidence_ids ","category":"blocker","line_end":207,"severity":"low","line_start":207},{"id":"blocker:references/report-model.md:225:system-reconnaissance","file":"references/report-model.md","pattern":"System reconnaissance","snippet":"`formal` 必须严格为布尔 true;action_id 唯一且非空,步骤/护栏为非空字符串列表,限制为字符串列表,成功信号为非空字符串,不能把当前观测直接重复为试验成功条件。标准化只补真正缺省","category":"blocker","line_end":225,"severity":"low","line_start":225},{"id":"blocker:scripts/analysis_depth.py:118:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"\"window\": next((scope_id for scope_id in seen if catalog[scope_id].get(\"rules\", {}).get(\"stage\") == ","category":"blocker","line_end":118,"severity":"low","line_start":118},{"id":"blocker:scripts/analysis_depth.py:193:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"for cid in owners:","category":"blocker","line_end":193,"severity":"low","line_start":193},{"id":"blocker:scripts/analysis_depth.py:195:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"if chapter.get(\"selection_status\") != \"selected\" or aid not in chapter.get(\"action_ids\", []):","category":"blocker","line_end":195,"severity":"low","line_start":195},{"id":"blocker:scripts/analysis_depth.py:199:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"iid in chapter.get(\"insight_ids\", [])","category":"blocker","line_end":199,"severity":"low","line_start":199},{"id":"blocker:scripts/analysis_depth.py:201:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"for iid in source_ids","category":"blocker","line_end":201,"severity":"low","line_start":201},{"id":"blocker:scripts/analysis_depth.py:205:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"# one valid source cannot lend this action to another question.","category":"blocker","line_end":205,"severity":"low","line_start":205},{"id":"blocker:scripts/analysis_depth.py:206:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"for iid in action.get(\"source_insight_ids\", []):","category":"blocker","line_end":206,"severity":"low","line_start":206},{"id":"blocker:scripts/analysis_depth.py:207:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"if not any(iid in chapters[cid].get(\"insight_ids\", [])","category":"blocker","line_end":207,"severity":"low","line_start":207},{"id":"blocker:scripts/analysis_depth.py:208:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"and insights.get(iid, {}).get(\"question_id\") == chapters[cid].get(\"question_id\") for cid in owners):","category":"blocker","line_end":208,"severity":"low","line_start":208},{"id":"blocker:scripts/analysis_depth.py:213:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"aid not in actions or cid not in actions[aid].get(\"source_chapter_ids\", []) for aid in refs","category":"blocker","line_end":213,"severity":"low","line_start":213},{"id":"blocker:scripts/analysis_depth.py:220:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"insights=[representative], actions=[actions[aid] for aid in refs], scope_catalog=model.get(\"scope_ca","category":"blocker","line_end":220,"severity":"low","line_start":220},{"id":"blocker:scripts/analysis_depth.py:230:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"valid = [r for r in history if _positive(r.get('total')) and _number(r.get('top_5_share'))","category":"blocker","line_end":230,"severity":"low","line_start":230},{"id":"blocker:scripts/analysis_depth.py:323:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"scope_id = evidence.get(\"scope_id\")","category":"blocker","line_end":323,"severity":"low","line_start":323},{"id":"blocker:scripts/analysis_depth.py:324:system-reconnaissance","file":"scripts/analysis_depth.py","pattern":"System reconnaissance","snippet":"if scope_id not in catalog or not catalog[scope_id].get(\"population_sha256\"):","category":"blocker","line_end":324,"severity":"low","line_start":324},{"id":"blocker:scripts/analysis_engine.py:117:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"raise ValueError(\"invalid zero_denominator_policy\")","category":"blocker","line_end":117,"severity":"low","line_start":117},{"id":"blocker:scripts/analysis_engine.py:457:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"valid = numerator.notna() & denominator.notna()","category":"blocker","line_end":457,"severity":"low","line_start":457},{"id":"blocker:scripts/analysis_engine.py:459:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"return valid","category":"blocker","line_end":460,"severity":"low","line_start":459},{"id":"blocker:scripts/analysis_engine.py:460:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"return valid & denominator.ne(0)","category":"blocker","line_end":460,"severity":"low","line_start":460},{"id":"blocker:scripts/analysis_engine.py:508:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"valid = _source_valid_mask(frame, contract)","category":"blocker","line_end":508,"severity":"low","line_start":508},{"id":"blocker:scripts/analysis_engine.py:539:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"valid = _source_valid_mask(frame, contract)","category":"blocker","line_end":539,"severity":"low","line_start":539},{"id":"blocker:scripts/analysis_engine.py:579:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"valid = _source_valid_mask(frame, contract)","category":"blocker","line_end":579,"severity":"low","line_start":579},{"id":"blocker:scripts/analysis_engine.py:729:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"valid = source.loc[_source_valid_mask(source, contract)]","category":"blocker","line_end":729,"severity":"low","line_start":729},{"id":"blocker:scripts/analysis_engine.py:736:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"scope_id = register(rows, \"baseline\" if tool == \"quality_impact\" else \"result\")","category":"blocker","line_end":736,"severity":"low","line_start":736},{"id":"blocker:scripts/analysis_engine.py:983:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = f\"dimension:{dimension}:{metric_name}\"","category":"blocker","line_end":983,"severity":"low","line_start":983},{"id":"blocker:scripts/analysis_engine.py:1051:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"rank_by_id = {","category":"blocker","line_end":1051,"severity":"low","line_start":1051},{"id":"blocker:scripts/analysis_engine.py:1057:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"candidate_by_id = {","category":"blocker","line_end":1057,"severity":"low","line_start":1057},{"id":"blocker:scripts/analysis_engine.py:1193:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"window_scope_id = scope_registry.register(work, rules={","category":"blocker","line_end":1193,"severity":"low","line_start":1193},{"id":"blocker:scripts/analysis_engine.py:1253:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = f\"metric:{name}:trend\"","category":"blocker","line_end":1253,"severity":"low","line_start":1253},{"id":"blocker:scripts/analysis_engine.py:1366:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = f\"dimension:{dimension}:{name}\"","category":"blocker","line_end":1366,"severity":"low","line_start":1366},{"id":"blocker:scripts/analysis_engine.py:1389:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = f\"dimension:{dimension}:{name}\"","category":"blocker","line_end":1389,"severity":"low","line_start":1389},{"id":"blocker:scripts/analysis_engine.py:1459:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = f\"dimension-yoy:{dimension}:{name}:{value}\"","category":"blocker","line_end":1459,"severity":"low","line_start":1459},{"id":"blocker:scripts/analysis_engine.py:1460:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id += value_identity[\"evidence_suffix\"]","category":"blocker","line_end":1460,"severity":"low","line_start":1460},{"id":"blocker:scripts/analysis_engine.py:1574:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"valid = source_rows.loc[_source_valid_mask(source_rows, contract)]","category":"blocker","line_end":1574,"severity":"low","line_start":1574},{"id":"blocker:scripts/analysis_engine.py:1601:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"insight_id = f\"diagnostic-{len(diagnostic_insights) + 1:02d}\"","category":"blocker","line_end":1601,"severity":"low","line_start":1601},{"id":"blocker:scripts/analysis_engine.py:1633:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"for eid in evidence_ids if eid in evidence_index","category":"blocker","line_end":1633,"severity":"low","line_start":1633},{"id":"blocker:scripts/analysis_engine.py:1792:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = (","category":"blocker","line_end":1792,"severity":"low","line_start":1792},{"id":"blocker:scripts/analysis_engine.py:2364:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id = f\"seasonality:{revenue_name}:year-end\"","category":"blocker","line_end":2364,"severity":"low","line_start":2364},{"id":"blocker:scripts/analysis_engine.py:2425:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"evidence_id","category":"blocker","line_end":2426,"severity":"low","line_start":2425},{"id":"blocker:scripts/analysis_engine.py:2427:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"for evidence_id in chart.get(\"evidence_ids\", [])","category":"blocker","line_end":2427,"severity":"low","line_start":2427},{"id":"blocker:scripts/analysis_engine.py:2509:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"dimension_evidence_id = f\"dimension:{dimension}:{name}\"","category":"blocker","line_end":2509,"severity":"low","line_start":2509},{"id":"blocker:scripts/analysis_engine.py:2767:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"insight_by_id = {item[\"insight_id\"]: item for item in diagnostic_insights}","category":"blocker","line_end":2767,"severity":"low","line_start":2767},{"id":"blocker:scripts/analysis_engine.py:2770:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"for insight_id in narrative_insights[:3]","category":"blocker","line_end":2770,"severity":"low","line_start":2770},{"id":"blocker:scripts/analysis_engine.py:2774:system-reconnaissance","file":"scripts/analysis_engine.py","pattern":"System reconnaissance","snippet":"for insight_id in narrative_insights[:3]","category":"blocker","line_end":2774,"severity":"low","line_start":2774},{"id":"blocker:scripts/analysis_followup.py:359:system-reconnaissance","file":"scripts/analysis_followup.py","pattern":"System reconnaissance","snippet":"evidence_id = \"followup:\" + path_hash[:16]","category":"blocker","line_end":359,"severity":"low","line_start":359},{"id":"blocker:SKILL.md:199:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- 章节标题使用业务判断,正文明确对应问题、经营含义、证明图表、行动和边界。原始 `chapter_id / question_id / evidence_id` 只留在模型与 QA,不进入观众可见正","category":"blocker","line_end":199,"severity":"low","line_start":199},{"id":"obfuscation:scripts/chapter_deck.mjs:29:array-join-empty-string","file":"scripts/chapter_deck.mjs","pattern":"Array join empty string","snippet":"return result.map(v=>v.toString(16).padStart(2,'0')).join('').toUpperCase();","category":"obfuscation","line_end":29,"severity":"low","line_start":29},{"id":"obfuscation:scripts/chapter_slideviber_layout.mjs:154:unicode-escape-sequence","file":"scripts/chapter_slideviber_layout.mjs","pattern":"Unicode escape sequence","snippet":"if(last>0 && /^[\\u3400-\\u9fff]$/.test(titleRows[last]) && /[\\u3400-\\u9fff]{2}$/.test(titleRows[last-","category":"obfuscation","line_end":154,"severity":"low","line_start":154},{"id":"obfuscation:scripts/ppt_qa.py:23:unicode-escape-sequence","file":"scripts/ppt_qa.py","pattern":"Unicode escape sequence","snippet":"CJK_PATTERN = re.compile(r\"[\\u3400-\\u9fff]\")","category":"obfuscation","line_end":23,"severity":"low","line_start":23},{"id":"obfuscation:scripts/slideviber_consistency.py:21:unicode-escape-sequence","file":"scripts/slideviber_consistency.py","pattern":"Unicode escape sequence","snippet":"CJK_PATTERN = re.compile(r\"[\\u3400-\\u9fff]\")","category":"obfuscation","line_end":21,"severity":"low","line_start":21},{"id":"env_access:scripts/chapter_deck.mjs:12:environment-variable-access-dot-notation","file":"scripts/chapter_deck.mjs","pattern":"Environment variable access (dot notation)","snippet":"const PY=process.env.RUNTIME_PYTHON||(process.platform==='win32'?'python':'python3');","category":"env_access","line_end":12,"severity":"low","line_start":12},{"id":"env_access:scripts/chapter_deck.mjs:13:environment-variable-access-dot-notation","file":"scripts/chapter_deck.mjs","pattern":"Environment variable access (dot notation)","snippet":"process.env.PYTHONUTF8='1';","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"env_access:scripts/ppt_theme_samples.mjs:12:environment-variable-access-dot-notation","file":"scripts/ppt_theme_samples.mjs","pattern":"Environment variable access (dot notation)","snippet":"const PY=process.env.RUNTIME_PYTHON||(process.platform==='win32'?'python':'python3');","category":"env_access","line_end":12,"severity":"low","line_start":12},{"id":"env_access:scripts/ppt_theme_samples.mjs:13:environment-variable-access-dot-notation","file":"scripts/ppt_theme_samples.mjs","pattern":"Environment variable access (dot notation)","snippet":"process.env.PYTHONUTF8='1';","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"env_access:scripts/chapter_deck.mjs:12:environment-variable-object","file":"scripts/chapter_deck.mjs","pattern":"Environment variable object","snippet":"const PY=process.env.RUNTIME_PYTHON||(process.platform==='win32'?'python':'python3');","category":"env_access","line_end":12,"severity":"low","line_start":12},{"id":"env_access:scripts/chapter_deck.mjs:13:environment-variable-object","file":"scripts/chapter_deck.mjs","pattern":"Environment variable object","snippet":"process.env.PYTHONUTF8='1';","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"env_access:scripts/ppt_theme_samples.mjs:12:environment-variable-object","file":"scripts/ppt_theme_samples.mjs","pattern":"Environment variable object","snippet":"const PY=process.env.RUNTIME_PYTHON||(process.platform==='win32'?'python':'python3');","category":"env_access","line_end":12,"severity":"low","line_start":12},{"id":"env_access:scripts/ppt_theme_samples.mjs:13:environment-variable-object","file":"scripts/ppt_theme_samples.mjs","pattern":"Environment variable object","snippet":"process.env.PYTHONUTF8='1';","category":"env_access","line_end":13,"severity":"low","line_start":13},{"id":"network:.claude-plugin/marketplace.json:5:hardcoded-url","file":".claude-plugin/marketplace.json","pattern":"Hardcoded URL","snippet":"\"url\": \"https://github.com/majichuan\"","category":"network","line_end":5,"severity":"low","line_start":5},{"id":"network:.claude-plugin/marketplace.json:20:hardcoded-url","file":".claude-plugin/marketplace.json","pattern":"Hardcoded URL","snippet":"\"url\": \"https://github.com/majichuan\"","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"network:.claude-plugin/marketplace.json:22:hardcoded-url","file":".claude-plugin/marketplace.json","pattern":"Hardcoded URL","snippet":"\"homepage\": \"https://majichuan.github.io/sheet-to-report/\",","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:.claude-plugin/marketplace.json:23:hardcoded-url","file":".claude-plugin/marketplace.json","pattern":"Hardcoded URL","snippet":"\"repository\": \"https://github.com/majichuan/sheet-to-report\",","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:.claude-plugin/plugin.json:2:hardcoded-url","file":".claude-plugin/plugin.json","pattern":"Hardcoded URL","snippet":"\"$schema\": \"https://json.schemastore.org/claude-code-plugin-manifest.json\",","category":"network","line_end":2,"severity":"low","line_start":2},{"id":"network:.claude-plugin/plugin.json:9:hardcoded-url","file":".claude-plugin/plugin.json","pattern":"Hardcoded URL","snippet":"\"url\": \"https://github.com/majichuan\"","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:.claude-plugin/plugin.json:11:hardcoded-url","file":".claude-plugin/plugin.json","pattern":"Hardcoded URL","snippet":"\"homepage\": \"https://majichuan.github.io/sheet-to-report/\",","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:.claude-plugin/plugin.json:12:hardcoded-url","file":".claude-plugin/plugin.json","pattern":"Hardcoded URL","snippet":"\"repository\": \"https://github.com/majichuan/sheet-to-report\",","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"network:docs/index.html:23:hardcoded-url","file":"docs/index.html","pattern":"Hardcoded URL","snippet":"<nav class=\"site-nav\" aria-label=\"案例导航\"><div class=\"nav-inner\"><a class=\"brand\" href=\"#top\" aria-lab","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:docs/index.html:38:hardcoded-url","file":"docs/index.html","pattern":"Hardcoded URL","snippet":"<section class=\"section\" aria-labelledby=\"download-title\"><h2 class=\"section-title\" id=\"download-tit","category":"network","line_end":38,"severity":"low","line_start":38},{"id":"network:docs/index.html:40:hardcoded-url","file":"docs/index.html","pattern":"Hardcoded URL","snippet":"<footer><span>sheet-to-report · v0.2 · Chinese-first</span><span><a href=\"https://github.com/majichu","category":"network","line_end":40,"severity":"low","line_start":40},{"id":"network:INSTALL.en.md:22:hardcoded-url","file":"INSTALL.en.md","pattern":"Hardcoded URL","snippet":"npx skills add https://github.com/majichuan/sheet-to-report","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:README.md:110:hardcoded-url","file":"README.md","pattern":"Hardcoded URL","snippet":"npx skills add https://github.com/majichuan/sheet-to-report --skill sheet-to-report","category":"network","line_end":110,"severity":"low","line_start":110},{"id":"network:README.zh-CN.md:112:hardcoded-url","file":"README.zh-CN.md","pattern":"Hardcoded URL","snippet":"npx skills add https://github.com/majichuan/sheet-to-report --skill sheet-to-report","category":"network","line_end":112,"severity":"low","line_start":112},{"id":"network:scripts/chapter_chart_qa.py:4:hardcoded-url","file":"scripts/chapter_chart_qa.py","pattern":"Hardcoded URL","snippet":"NS={'a':'http://schemas.openxmlformats.org/drawingml/2006/main','c':'http://schemas.openxmlformats.o","category":"network","line_end":4,"severity":"low","line_start":4},{"id":"network:scripts/chapter_native_scene_qa.py:11:hardcoded-url","file":"scripts/chapter_native_scene_qa.py","pattern":"Hardcoded URL","snippet":"NS={'c':'http://schemas.openxmlformats.org/drawingml/2006/chart',","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:scripts/chapter_native_scene_qa.py:12:hardcoded-url","file":"scripts/chapter_native_scene_qa.py","pattern":"Hardcoded URL","snippet":"'r':'http://schemas.openxmlformats.org/officeDocument/2006/relationships'}","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"network:scripts/chapter_pptx_prepare.py:9:hardcoded-url","file":"scripts/chapter_pptx_prepare.py","pattern":"Hardcoded URL","snippet":"A = 'http://schemas.openxmlformats.org/drawingml/2006/main'","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:scripts/chapter_presentation_qa.py:14:hardcoded-url","file":"scripts/chapter_presentation_qa.py","pattern":"Hardcoded URL","snippet":"NS = {\"a\": \"http://schemas.openxmlformats.org/drawingml/2006/main\",","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:scripts/chapter_presentation_qa.py:15:hardcoded-url","file":"scripts/chapter_presentation_qa.py","pattern":"Hardcoded URL","snippet":"\"p\": \"http://schemas.openxmlformats.org/presentationml/2006/main\",","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:scripts/chapter_presentation_qa.py:16:hardcoded-url","file":"scripts/chapter_presentation_qa.py","pattern":"Hardcoded URL","snippet":"\"c\": \"http://schemas.openxmlformats.org/drawingml/2006/chart\",","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:scripts/chapter_presentation_qa.py:17:hardcoded-url","file":"scripts/chapter_presentation_qa.py","pattern":"Hardcoded URL","snippet":"\"r\": \"http://schemas.openxmlformats.org/officeDocument/2006/relationships\"}","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:scripts/chapter_vector_qa.py:14:hardcoded-url","file":"scripts/chapter_vector_qa.py","pattern":"Hardcoded URL","snippet":"NS = {'a': 'http://schemas.openxmlformats.org/drawingml/2006/main',","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:scripts/chapter_vector_qa.py:15:hardcoded-url","file":"scripts/chapter_vector_qa.py","pattern":"Hardcoded URL","snippet":"'p': 'http://schemas.openxmlformats.org/presentationml/2006/main'}","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:scripts/slideviber_consistency.py:23:hardcoded-url","file":"scripts/slideviber_consistency.py","pattern":"Hardcoded URL","snippet":"A_NS = \"http://schemas.openxmlformats.org/drawingml/2006/main\"","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:scripts/slideviber_handoff.py:89:hardcoded-url","file":"scripts/slideviber_handoff.py","pattern":"Hardcoded URL","snippet":"- 官方项目:https://github.com/tf71991/slideviber-skill","category":"network","line_end":89,"severity":"low","line_start":89},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **实际效果:** [在线查看完整合成案例](https://majichuan.github.io/sheet-to-report/),包括 HTML、标准 PPT 与 SlideViber 美","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:scripts/generate_sample.py:278:http-client-library","file":"scripts/generate_sample.py","pattern":"HTTP client library","snippet":"def _retail_main_request(source_path: str = \"retail-omnichannel-main.csv\") -> dict:","category":"network","line_end":278,"severity":"low","line_start":278},{"id":"network:scripts/generate_sample.py:634:http-client-library","file":"scripts/generate_sample.py","pattern":"HTTP client library","snippet":"request = _retail_main_request(experience_source)","category":"network","line_end":634,"severity":"low","line_start":634},{"id":"network:scripts/html_analysis.py:150:http-client-library","file":"scripts/html_analysis.py","pattern":"HTTP client library","snippet":"validate_request(request)","category":"network","line_end":150,"severity":"low","line_start":150},{"id":"network:scripts/sheet_to_report.py:1420:http-client-library","file":"scripts/sheet_to_report.py","pattern":"HTTP client library","snippet":"def validate_request(request: ReportRequest) -> None:","category":"network","line_end":1420,"severity":"low","line_start":1420},{"id":"network:scripts/sheet_to_report.py:1744:http-client-library","file":"scripts/sheet_to_report.py","pattern":"HTTP client library","snippet":"validate_request(request)","category":"network","line_end":1744,"severity":"low","line_start":1744},{"id":"network:scripts/sheet_to_report.py:2650:http-client-library","file":"scripts/sheet_to_report.py","pattern":"HTTP client library","snippet":"validate_request(request)","category":"network","line_end":2650,"severity":"low","line_start":2650},{"id":"network:scripts/sheet_to_report.py:3193:http-client-library","file":"scripts/sheet_to_report.py","pattern":"HTTP client library","snippet":"validate_request(request)","category":"network","line_end":3193,"severity":"low","line_start":3193},{"id":"env_access:scripts/environment_check.py:43:python-environment-access","file":"scripts/environment_check.py","pattern":"Python environment access","snippet":"executable=node or os.environ.get('RUNTIME_NODE') or shutil.which('node')","category":"env_access","line_end":43,"severity":"low","line_start":43},{"id":"env_access:scripts/environment_check.py:53:python-environment-access","file":"scripts/environment_check.py","pattern":"Python environment access","snippet":"folder=slideviber_dir or os.environ.get('SLIDEVIBER_DIR')","category":"env_access","line_end":53,"severity":"low","line_start":53},{"id":"env_access:scripts/html_analysis.py:56:python-environment-access","file":"scripts/html_analysis.py","pattern":"Python environment access","snippet":"env = {k: v for k, v in os.environ.items() if not k.upper().startswith(\"GIT_\")}","category":"env_access","line_end":56,"severity":"low","line_start":56},{"id":"network:SUPPORT.md:5:python-http-libraries","file":"SUPPORT.md","pattern":"Python HTTP libraries","snippet":"Use [GitHub Issues](https://github.com/majichuan/sheet-to-report/issues) for installation problems, ","category":"network","line_end":5,"severity":"low","line_start":5},{"id":"filesystem:scripts/sheet_to_report.py:12:temp-file-creation","file":"scripts/sheet_to_report.py","pattern":"Temp file creation","snippet":"import tempfile","category":"filesystem","line_end":12,"severity":"low","line_start":12},{"id":"filesystem:scripts/sheet_to_report.py:2946:temp-file-creation","file":"scripts/sheet_to_report.py","pattern":"Temp file creation","snippet":"tempfile.mkdtemp(prefix=f\".{output_dir.name}.backup-\", dir=output_dir.parent)","category":"filesystem","line_end":2946,"severity":"low","line_start":2946},{"id":"filesystem:scripts/sheet_to_report.py:2992:temp-file-creation","file":"scripts/sheet_to_report.py","pattern":"Temp file creation","snippet":"tempfile.mkdtemp(prefix=f\".{output_dir.name}.staging-\", dir=output_dir.parent)","category":"filesystem","line_end":2992,"severity":"low","line_start":2992},{"id":"filesystem:scripts/slideviber_consistency.py:7:temp-file-creation","file":"scripts/slideviber_consistency.py","pattern":"Temp file creation","snippet":"import tempfile","category":"filesystem","line_end":7,"severity":"low","line_start":7},{"id":"filesystem:scripts/slideviber_consistency.py:540:temp-file-creation","file":"scripts/slideviber_consistency.py","pattern":"Temp file creation","snippet":"with tempfile.NamedTemporaryFile(","category":"filesystem","line_end":540,"severity":"low","line_start":540}],"finding_verdicts":[{"id":"sensitive:scripts/transactional_story.py:108:certificate-key-files","reason":"The match is a comment about an evidence row identifier named key. It does not reference certificate or private-key files.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:.github/workflows/public-checks.yml:56:environment-file-access","reason":"The workflow checks tracked paths to reject committed .env and generated files. It does not read environment-file contents.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:.gitignore:20:environment-file-access","reason":"This is a standard ignore rule that prevents environment files from being committed. It does not access or expose their contents.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:.gitignore:21:environment-file-access","reason":"This is a standard ignore rule that prevents environment files from being committed. It does not access or expose their contents.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:.gitignore:22:environment-file-access","reason":"This is a standard ignore rule that prevents environment files from being committed. It does not access or expose their contents.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/chapter_deck.mjs:12:environment-file-access","reason":"The code reads RUNTIME_PYTHON or sets PYTHONUTF8 for a local subprocess. It does not open a .env file or collect secrets.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/chapter_deck.mjs:13:environment-file-access","reason":"The code reads RUNTIME_PYTHON or sets PYTHONUTF8 for a local subprocess. It does not open a .env file or collect secrets.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/ppt_theme_samples.mjs:12:environment-file-access","reason":"The code reads RUNTIME_PYTHON or sets PYTHONUTF8 for a local subprocess. It does not open a .env file or collect secrets.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/ppt_theme_samples.mjs:13:environment-file-access","reason":"The code reads RUNTIME_PYTHON or sets PYTHONUTF8 for a local subprocess. It does not open a .env file or collect secrets.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:3:heuristic-extremely-long-line-5138-chars-likely-","reason":"The long line is generated or embedded HTML and CSS for the report demo. Its content is readable markup and report text, not obfuscated code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/html_chapter_renderer.py:131:heuristic-extremely-long-line-5138-chars-likely-","reason":"The long line is generated or embedded HTML and CSS for the report demo. Its content is readable markup and report text, not obfuscated code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-extremely-long-line-78488-chars-likely","reason":"The long line is generated or embedded HTML and CSS for the report demo. Its content is readable markup and report text, not obfuscated code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/slideviber_handoff.py:1:heuristic-high-file-entropy-6-21-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/chart-spec.md:1:heuristic-high-file-entropy-6-94-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:DEMO.zh-CN.md:1:heuristic-high-file-entropy-7-20-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/report-model.md:1:heuristic-high-file-entropy-7-24-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:QUICKSTART.zh-CN.md:1:heuristic-high-file-entropy-7-50-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/quick-help.md:1:heuristic-high-file-entropy-7-51-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:FAQ.md:1:heuristic-high-file-entropy-7-64-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:README.zh-CN.md:1:heuristic-high-file-entropy-7-74-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/ppt-theme-selection.md:1:heuristic-high-file-entropy-7-74-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:INSTALL.md:1:heuristic-high-file-entropy-7-83-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/html-analysis.md:1:heuristic-high-file-entropy-7-90-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-8-01-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/chapter-presentation.md:1:heuristic-high-file-entropy-8-04-bits-possible-b","reason":"The file contains readable UTF-8 Chinese prose or ordinary source code. Multibyte text raises the entropy heuristic without indicating encryption or binary content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/html_transaction_facts.py:1:heuristic-multiple-bracket-chains-10-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/question_evidence.py:1:heuristic-multiple-bracket-chains-10-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/html_qa.py:1:heuristic-multiple-bracket-chains-12-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/presentation_contracts.py:1:heuristic-multiple-bracket-chains-13-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/analysis_questions.py:1:heuristic-multiple-bracket-chains-15-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/analysis_depth.py:1:heuristic-multiple-bracket-chains-18-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/slideviber_consistency.py:1:heuristic-multiple-bracket-chains-18-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/analysis_followup.py:1:heuristic-multiple-bracket-chains-20-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/html_evidence.py:1:heuristic-multiple-bracket-chains-20-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/analysis_engine.py:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/build_pptx.py:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/model_validation.py:1:heuristic-multiple-bracket-chains-24-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/content_resolver.py:1:heuristic-multiple-bracket-chains-29-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/narrative_planner.py:1:heuristic-multiple-bracket-chains-32-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/sheet_to_report.py:1:heuristic-multiple-bracket-chains-33-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/content_qa.py:1:heuristic-multiple-bracket-chains-38-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/html_renderer.py:1:heuristic-multiple-bracket-chains-43-jsfuck-obfu","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/chart_svg_renderer.py:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/html_analysis.py:1:heuristic-multiple-bracket-chains-6-jsfuck-obfus","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/chapter_deck.mjs:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/chart_evidence.py:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/ppt_qa.py:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/report_model_projection.py:1:heuristic-multiple-bracket-chains-7-jsfuck-obfus","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/transactional_story.py:1:heuristic-multiple-bracket-chains-9-jsfuck-obfus","reason":"The heuristic sampled ordinary nested Python or JavaScript collections and indexing. The file is readable source and contains no JSFuck decoding or execution chain.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-53-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/index.html:29:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/html_transaction_facts.py:111:heuristic-very-high-entropy-string-5-54-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/html_renderer.py:717:heuristic-very-high-entropy-string-5-55-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/analysis_engine.py:2073:heuristic-very-high-entropy-string-5-57-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/analysis_engine.py:1678:heuristic-very-high-entropy-string-5-61-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/report-model.md:171:heuristic-very-high-entropy-string-5-62-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/index.html:27:heuristic-very-high-entropy-string-5-66-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-66-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-67-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/chapter-presentation.md:9:heuristic-very-high-entropy-string-5-70-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-71-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/slideviber_handoff.py:113:heuristic-very-high-entropy-string-5-72-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/index.html:37:heuristic-very-high-entropy-string-5-73-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/report_model_projection.py:171:heuristic-very-high-entropy-string-5-73-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/sheet_to_report.py:369:heuristic-very-high-entropy-string-5-74-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/html_analysis.py:385:heuristic-very-high-entropy-string-5-75-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/index.html:38:heuristic-very-high-entropy-string-5-76-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/html_transaction_facts.py:171:heuristic-very-high-entropy-string-5-78-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/transactional_story.py:346:heuristic-very-high-entropy-string-5-78-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-80-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/chapter-presentation.md:32:heuristic-very-high-entropy-string-5-81-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/index.html:31:heuristic-very-high-entropy-string-5-82-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-84-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-85-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/index.html:26:heuristic-very-high-entropy-string-5-94-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-94-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-5-96-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/index.html:25:heuristic-very-high-entropy-string-5-98-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/report-model.md:205:heuristic-very-high-entropy-string-6-04-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-13-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-16-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-17-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/chapter-presentation.md:15:heuristic-very-high-entropy-string-6-19-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:164:heuristic-very-high-entropy-string-6-23-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/html-analysis.md:13:heuristic-very-high-entropy-string-6-29-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-34-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:docs/report.html:24:heuristic-very-high-entropy-string-6-42-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/chapter-presentation.md:21:heuristic-very-high-entropy-string-6-87-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/slideviber_handoff.py:113:heuristic-very-high-entropy-string-6-95-bits-lik","reason":"The matched string is readable Chinese report, documentation, or template prose. It is not encoded, encrypted, or decoded before execution.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/chapter_deck.mjs:63:hex-encoded-characters","reason":"The hexadecimal escapes define ASCII or non-ASCII character ranges in a regular expression. They do not conceal or decode executable content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/chapter_slideviber_layout.mjs:13:hex-encoded-characters","reason":"The hexadecimal escapes define ASCII or non-ASCII character ranges in a regular expression. They do not conceal or decode executable content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/content_qa.py:56:hex-encoded-characters","reason":"The hexadecimal escapes define ASCII or non-ASCII character ranges in a regular expression. They do not conceal or decode executable content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:5:node-js-child-process-module","reason":"The module supports fixed local Python helper invocations through execFileSync. Calls use argument arrays without a shell or command-string interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/ppt_theme_samples.mjs:6:node-js-child-process-module","reason":"The module supports fixed local Python helper invocations through execFileSync. Calls use argument arrays without a shell or command-string interpolation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/chapter_deck.mjs:24:path-traversal-sequence","reason":"The /../g expression is a JavaScript regular expression that groups hexadecimal color pairs. It is not a filesystem parent-directory sequence.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/chapter_deck.mjs:26:path-traversal-sequence","reason":"The /../g expression is a JavaScript regular expression that groups hexadecimal color pairs. It is not a filesystem parent-directory sequence.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/chapter_presentation_qa.py:152:path-traversal-sequence","reason":"The code explicitly rejects normalized archive relationships that start with ../ or are absent. This is a traversal defense, not traversal behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:.github/workflows/public-checks.yml:51:python-subprocess-check-output","reason":"The CI check runs the fixed command git ls-files with an argument array. No untrusted input reaches a shell.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/html_analysis.py:60:python-subprocess-check-output","reason":"The function runs fixed git provenance subcommands with an argument array, a repository-bound working directory, and a timeout. It does not invoke a shell.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/environment_check.py:47:python-subprocess-run","reason":"The environment check runs the explicitly selected Node executable with only --version. It uses an argument array, no shell, and a timeout.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/visual_verification.py:102:python-subprocess-run","reason":"The visual verifier invokes locally discovered LibreOffice or pdftoppm executables with fixed flags and path arguments. It uses no shell interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/visual_verification.py:128:python-subprocess-run","reason":"The visual verifier invokes locally discovered LibreOffice or pdftoppm executables with fixed flags and path arguments. It uses no shell interpolation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/chapter_deck.mjs:14:synchronous-file-execution","reason":"The call launches bundled Python validation or export helpers with an argument array. It does not use a shell, evaluate report text, or construct a command string.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/chapter_deck.mjs:199:synchronous-file-execution","reason":"The call launches bundled Python validation or export helpers with an argument array. It does not use a shell, evaluate report text, or construct a command string.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/ppt_theme_samples.mjs:15:synchronous-file-execution","reason":"The call launches bundled Python validation or export helpers with an argument array. It does not use a shell, evaluate report text, or construct a command string.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/ppt_theme_samples.mjs:51:synchronous-file-execution","reason":"The call launches bundled Python validation or export helpers with an argument array. It does not use a shell, evaluate report text, or construct a command string.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/ppt_theme_samples.mjs:54:synchronous-file-execution","reason":"The call launches bundled Python validation or export helpers with an argument array. It does not use a shell, evaluate report text, or construct a command string.","verdict":"false_positive","confidence":0.96},{"id":"blocker:scripts/html_renderer.py:269:template-injection-targeting-system-prompt","reason":"The matched double braces escape CSS braces inside a Python format template. The text is styling, not a system-prompt instruction or injection target.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/html_renderer.py:662:template-injection-targeting-system-prompt","reason":"The matched double braces escape CSS braces inside a Python format template. The text is styling, not a system-prompt instruction or injection target.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:.gitignore:30:sqlite-database-file","reason":"This is a .gitignore rule for local database artifacts. No database is opened, queried, or transmitted.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/html_qa.py:219:deprecated-unescape-function","reason":"This calls Python html.unescape after removing tags for visible-text checks. It is not JavaScript's deprecated unescape function and executes no content.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/html_qa.py:235:deprecated-unescape-function","reason":"This calls Python html.unescape after removing tags for visible-text checks. It is not JavaScript's deprecated unescape function and executes no content.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/build_pptx.py:22:dynamic-import-expression","reason":"The snippet is a normal static Python from-import statement. There is no dynamic import expression or user-selected module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/content_qa.py:7:dynamic-import-expression","reason":"The snippet is a normal static Python from-import statement. There is no dynamic import expression or user-selected module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/html_renderer.py:9:dynamic-import-expression","reason":"The snippet is a normal static Python from-import statement. There is no dynamic import expression or user-selected module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/model_validation.py:8:dynamic-import-expression","reason":"The snippet is a normal static Python from-import statement. There is no dynamic import expression or user-selected module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/model_validation.py:17:dynamic-import-expression","reason":"The snippet is a normal static Python from-import statement. There is no dynamic import expression or user-selected module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/narrative_planner.py:7:dynamic-import-expression","reason":"The snippet is a normal static Python from-import statement. There is no dynamic import expression or user-selected module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/ppt_qa.py:13:dynamic-import-expression","reason":"The snippet is a normal static Python from-import statement. There is no dynamic import expression or user-selected module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/sheet_to_report.py:32:dynamic-import-expression","reason":"The snippet is a normal static Python from-import statement. There is no dynamic import expression or user-selected module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/sheet_to_report.py:40:dynamic-import-expression","reason":"The snippet is a normal static Python from-import statement. There is no dynamic import expression or user-selected module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:20:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:48:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:51:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:55:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:70:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:71:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:73:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:75:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:76:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:77:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:78:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:80:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:81:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:82:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:83:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:85:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:87:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:88:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:89:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:90:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:91:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:92:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:96:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:98:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:100:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:102:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:104:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:105:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:109:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:111:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:114:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:116:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:119:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:121:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:123:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:125:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:127:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:129:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:134:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:136:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:138:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:139:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:142:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:143:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:scripts/chart_contract.py:144:dynamic-require-with-variable","reason":"The matched _require symbol is a local assertion helper used for chart-contract validation. It is unrelated to JavaScript module loading.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/chapter_deck.mjs:31:hidden-file-access","reason":"The match comes from regular-expression escapes or color-prefix construction. It does not name, read, or write a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/chapter_deck.mjs:63:hidden-file-access","reason":"The match comes from regular-expression escapes or color-prefix construction. It does not name, read, or write a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:7:hidden-file-access","reason":"The match comes from regular-expression escapes or color-prefix construction. It does not name, read, or write a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:13:hidden-file-access","reason":"The match comes from regular-expression escapes or color-prefix construction. It does not name, read, or write a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:25:hidden-file-access","reason":"The match comes from regular-expression escapes or color-prefix construction. It does not name, read, or write a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:34:hidden-file-access","reason":"The match comes from regular-expression escapes or color-prefix construction. It does not name, read, or write a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/chapter_slideviber_layout.mjs:154:hidden-file-access","reason":"The match comes from regular-expression escapes or color-prefix construction. It does not name, read, or write a hidden file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/chapter_deck.mjs:15:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/chapter_deck.mjs:166:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/chapter_deck.mjs:167:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/chapter_deck.mjs:176:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/chapter_deck.mjs:196:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/html_chapter_renderer.py:127:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/html_renderer.py:521:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/html_renderer.py:526:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/html_renderer.py:530:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/html_renderer.py:537:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/html_renderer.py:545:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/ppt_theme_samples.mjs:14:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/ppt_theme_samples.mjs:21:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/ppt_theme_samples.mjs:45:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/ppt_theme_samples.mjs:46:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/ppt_theme_samples.mjs:58:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/ppt_theme_samples.mjs:79:node-js-fs-operations","reason":"The code reads declared model inputs and writes report, scene, theme, or slide outputs. These are expected local artifact operations with explicit paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/chapter_native_scene_qa.py:6:python-archive-libraries","reason":"The archive API reads, validates, or rewrites local PPTX package entries. The code does not extract entries to attacker-controlled filesystem paths.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/chapter_pptx_prepare.py:6:python-archive-libraries","reason":"The archive API reads, validates, or rewrites local PPTX package entries. The code does not extract entries to attacker-controlled filesystem paths.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/chapter_presentation_qa.py:9:python-archive-libraries","reason":"The archive API reads, validates, or rewrites local PPTX package entries. The code does not extract entries to attacker-controlled filesystem paths.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/generate_sample.py:10:python-archive-libraries","reason":"The archive API reads, validates, or rewrites local PPTX package entries. The code does not extract entries to attacker-controlled filesystem paths.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/slideviber_consistency.py:9:python-archive-libraries","reason":"The archive API reads, validates, or rewrites local PPTX package entries. The code does not extract entries to attacker-controlled filesystem paths.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/slideviber_consistency.py:547:python-archive-libraries","reason":"The archive API reads, validates, or rewrites local PPTX package entries. The code does not extract entries to attacker-controlled filesystem paths.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/sheet_to_report.py:2954:python-shutil-operations","reason":"The operation copies managed report artifacts or removes tool-created backup, staging, and render directories. It is scoped to explicit workflow paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/sheet_to_report.py:2979:python-shutil-operations","reason":"The operation copies managed report artifacts or removes tool-created backup, staging, and render directories. It is scoped to explicit workflow paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/sheet_to_report.py:3129:python-shutil-operations","reason":"The operation copies managed report artifacts or removes tool-created backup, staging, and render directories. It is scoped to explicit workflow paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/visual_verification.py:18:python-shutil-operations","reason":"The operation copies managed report artifacts or removes tool-created backup, staging, and render directories. It is scoped to explicit workflow paths.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:scripts/visual_verification.py:180:python-shutil-operations","reason":"The operation copies managed report artifacts or removes tool-created backup, staging, and render directories. It is scoped to explicit workflow paths.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:scripts/analysis_engine.py:592:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_chart_geometry.mjs:14:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_chart_geometry.mjs:120:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:49:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:104:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:173:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:184:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:185:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:186:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:188:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:189:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:191:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:192:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:193:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_deck.mjs:196:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_slideviber_design.mjs:19:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_slideviber_design.mjs:40:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/chapter_slideviber_design.mjs:56:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/content_qa.py:53:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/content_resolver.py:17:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/ppt_theme_samples.mjs:48:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/ppt_theme_samples.mjs:60:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/ppt_theme_samples.mjs:79:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/report_model_projection.py:47:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/report_model_projection.py:189:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/slideviber_consistency.py:428:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/slideviber_consistency.py:429:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/slideviber_handoff.py:39:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/slideviber_handoff.py:44:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/slideviber_handoff.py:57:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/slideviber_handoff.py:65:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/slideviber_handoff.py:82:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/slideviber_handoff.py:93:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/slideviber_handoff.py:94:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/slideviber_handoff.py:95:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/slideviber_handoff.py:98:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/slideviber_handoff.py:113:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"The backticks are Markdown code spans, Python documentation, or JavaScript template literals used to build SVG and text. They are not shell execution syntax here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:.github/workflows/public-checks.yml:27:shell-command-substitution","reason":"This CI-only substitution captures the first generated XLSX path from a fixed local directory. The value is quoted and never evaluated as code.","verdict":"false_positive","confidence":0.97},{"id":"blocker:scripts/environment_check.py:51:network-reconnaissance","reason":"The matched text is a local dependency-check error message for Node.js or SlideViber. It performs no host discovery or network probing.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/environment_check.py:57:network-reconnaissance","reason":"The matched text is a local dependency-check error message for Node.js or SlideViber. It performs no host discovery or network probing.","verdict":"false_positive","confidence":0.99},{"id":"blocker:docs/index.html:11:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:docs/index.html:12:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:docs/index.html:13:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:docs/index.html:14:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:docs/index.html:15:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:docs/index.html:16:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:docs/index.html:17:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:docs/index.html:18:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:docs/report.html:3:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:README.md:25:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/report-model.md:92:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/report-model.md:109:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/report-model.md:187:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/report-model.md:207:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/report-model.md:225:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:118:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:193:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:195:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:199:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:201:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:205:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:206:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:207:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:208:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:213:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:220:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:230:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:323:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_depth.py:324:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:117:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:457:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:459:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:460:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:508:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:539:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:579:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:729:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:736:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:983:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:1051:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:1057:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:1193:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:1253:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:1366:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:1389:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:1459:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:1460:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:1574:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:1601:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:1633:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:1792:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:2364:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:2425:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:2427:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:2509:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:2767:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:2770:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_engine.py:2774:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/analysis_followup.py:359:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:199:system-reconnaissance","reason":"The snippet is CSS, documentation, or ordinary report-model identifiers and validation logic. It does not enumerate system details or conduct reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/chapter_deck.mjs:29:array-join-empty-string","reason":"The join converts RGB byte values into a hexadecimal color string. It neither decodes an obfuscated payload nor constructs executable code.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/chapter_slideviber_layout.mjs:154:unicode-escape-sequence","reason":"The Unicode escapes define a CJK character range for typography checks. They are readable validation logic, not an encoded payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/ppt_qa.py:23:unicode-escape-sequence","reason":"The Unicode escapes define a CJK character range for typography checks. They are readable validation logic, not an encoded payload.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/slideviber_consistency.py:21:unicode-escape-sequence","reason":"The Unicode escapes define a CJK character range for typography checks. They are readable validation logic, not an encoded payload.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/chapter_deck.mjs:12:environment-variable-access-dot-notation","reason":"The code reads the documented RUNTIME_PYTHON selector or sets PYTHONUTF8. It does not enumerate the environment or access credentials.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/chapter_deck.mjs:13:environment-variable-access-dot-notation","reason":"The code reads the documented RUNTIME_PYTHON selector or sets PYTHONUTF8. It does not enumerate the environment or access credentials.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/ppt_theme_samples.mjs:12:environment-variable-access-dot-notation","reason":"The code reads the documented RUNTIME_PYTHON selector or sets PYTHONUTF8. It does not enumerate the environment or access credentials.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/ppt_theme_samples.mjs:13:environment-variable-access-dot-notation","reason":"The code reads the documented RUNTIME_PYTHON selector or sets PYTHONUTF8. It does not enumerate the environment or access credentials.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/chapter_deck.mjs:12:environment-variable-object","reason":"The code reads the documented RUNTIME_PYTHON selector or sets PYTHONUTF8. It does not enumerate the environment or access credentials.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/chapter_deck.mjs:13:environment-variable-object","reason":"The code reads the documented RUNTIME_PYTHON selector or sets PYTHONUTF8. It does not enumerate the environment or access credentials.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/ppt_theme_samples.mjs:12:environment-variable-object","reason":"The code reads the documented RUNTIME_PYTHON selector or sets PYTHONUTF8. It does not enumerate the environment or access credentials.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/ppt_theme_samples.mjs:13:environment-variable-object","reason":"The code reads the documented RUNTIME_PYTHON selector or sets PYTHONUTF8. It does not enumerate the environment or access credentials.","verdict":"false_positive","confidence":0.99},{"id":"network:.claude-plugin/marketplace.json:5:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:.claude-plugin/marketplace.json:20:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:.claude-plugin/marketplace.json:22:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:.claude-plugin/marketplace.json:23:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:.claude-plugin/plugin.json:2:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:.claude-plugin/plugin.json:9:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:.claude-plugin/plugin.json:11:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:.claude-plugin/plugin.json:12:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:docs/index.html:23:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:docs/index.html:38:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:docs/index.html:40:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:INSTALL.en.md:22:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:README.md:110:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:README.zh-CN.md:112:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/chapter_chart_qa.py:4:hardcoded-url","reason":"The URL is an XML namespace constant or a documentation reference. It is not used as an outbound request destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/chapter_native_scene_qa.py:11:hardcoded-url","reason":"The URL is an XML namespace constant or a documentation reference. It is not used as an outbound request destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/chapter_native_scene_qa.py:12:hardcoded-url","reason":"The URL is an XML namespace constant or a documentation reference. It is not used as an outbound request destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/chapter_pptx_prepare.py:9:hardcoded-url","reason":"The URL is an XML namespace constant or a documentation reference. It is not used as an outbound request destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/chapter_presentation_qa.py:14:hardcoded-url","reason":"The URL is an XML namespace constant or a documentation reference. It is not used as an outbound request destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/chapter_presentation_qa.py:15:hardcoded-url","reason":"The URL is an XML namespace constant or a documentation reference. It is not used as an outbound request destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/chapter_presentation_qa.py:16:hardcoded-url","reason":"The URL is an XML namespace constant or a documentation reference. It is not used as an outbound request destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/chapter_presentation_qa.py:17:hardcoded-url","reason":"The URL is an XML namespace constant or a documentation reference. It is not used as an outbound request destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/chapter_vector_qa.py:14:hardcoded-url","reason":"The URL is an XML namespace constant or a documentation reference. It is not used as an outbound request destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/chapter_vector_qa.py:15:hardcoded-url","reason":"The URL is an XML namespace constant or a documentation reference. It is not used as an outbound request destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/slideviber_consistency.py:23:hardcoded-url","reason":"The URL is an XML namespace constant or a documentation reference. It is not used as an outbound request destination.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/slideviber_handoff.py:89:hardcoded-url","reason":"The URL is an XML namespace constant or a documentation reference. It is not used as an outbound request destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:22:hardcoded-url","reason":"The URL appears in marketplace metadata, installation documentation, or the public demo page. It does not initiate a network request.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/generate_sample.py:278:http-client-library","reason":"The match is on a report request object or validate_request function. No HTTP client library or outbound request is present.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/generate_sample.py:634:http-client-library","reason":"The match is on a report request object or validate_request function. No HTTP client library or outbound request is present.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/html_analysis.py:150:http-client-library","reason":"The match is on a report request object or validate_request function. No HTTP client library or outbound request is present.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/sheet_to_report.py:1420:http-client-library","reason":"The match is on a report request object or validate_request function. No HTTP client library or outbound request is present.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/sheet_to_report.py:1744:http-client-library","reason":"The match is on a report request object or validate_request function. No HTTP client library or outbound request is present.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/sheet_to_report.py:2650:http-client-library","reason":"The match is on a report request object or validate_request function. No HTTP client library or outbound request is present.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/sheet_to_report.py:3193:http-client-library","reason":"The match is on a report request object or validate_request function. No HTTP client library or outbound request is present.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/environment_check.py:43:python-environment-access","reason":"The code reads documented runtime paths for Node.js or optional SlideViber during local dependency checks. It does not access secret-bearing variables.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/environment_check.py:53:python-environment-access","reason":"The code reads documented runtime paths for Node.js or optional SlideViber during local dependency checks. It does not access secret-bearing variables.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/html_analysis.py:56:python-environment-access","reason":"The code creates a sanitized environment for fixed git provenance commands and removes inherited GIT variables. It does not collect or transmit secrets.","verdict":"false_positive","confidence":0.99},{"id":"network:SUPPORT.md:5:python-http-libraries","reason":"The snippet is a Markdown link to the project's GitHub issue tracker. It is not Python code and imports no HTTP library.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/sheet_to_report.py:12:temp-file-creation","reason":"Temporary paths are created for transactional report output or PPTX rewriting. They remain local and are cleaned after the operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/sheet_to_report.py:2946:temp-file-creation","reason":"Temporary paths are created for transactional report output or PPTX rewriting. They remain local and are cleaned after the operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/sheet_to_report.py:2992:temp-file-creation","reason":"Temporary paths are created for transactional report output or PPTX rewriting. They remain local and are cleaned after the operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/slideviber_consistency.py:7:temp-file-creation","reason":"Temporary paths are created for transactional report output or PPTX rewriting. They remain local and are cleaned after the operation.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/slideviber_consistency.py:540:temp-file-creation","reason":"Temporary paths are created for transactional report output or PPTX rewriting. They remain local and are cleaned after the operation.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"9ea344fdd713f92cfc676d872c148f2ab075405e","subject_content_hash":"6922e34078bed158015eaf98ca5cd24ec55a385a23ebfea5395a3630d4daaeeb","subject_tree_hash":"db3ac15ce97f48fca102b4ee2df2a1a30165dabfb06ad57462164deda25860ff","subject_plugin_path":"skills/majichuan/sheet-to-report","audit_payload_hash":"24244f1066e5debd62c762f33ab20398","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"9ea344fdd713f92cfc676d872c148f2ab075405e","contentHash":"6922e34078bed158015eaf98ca5cd24ec55a385a23ebfea5395a3630d4daaeeb","treeHash":"db3ac15ce97f48fca102b4ee2df2a1a30165dabfb06ad57462164deda25860ff","pluginPath":"skills/majichuan/sheet-to-report","auditPayloadHash":"24244f1066e5debd62c762f33ab20398"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/majichuan-sheet-to-report/audits/2/attestation","status":"superseded"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"superseded","verificationState":"not_verified"},"isLatest":false}}