{"data":{"skill":{"slug":"tahodev-koyobun-check","name":"koyobun-check","icon":"📦","repo":"https://github.com/tahodev/kurashi-skill/tree/09cb7f9eac85f0c85633cce08328a1a57854a94f/koyobun-check","status":"approved","author":"tahodev","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"941bebdf-f55a-44e2-bf7c-ee224566e403","skill_id":"e22bf29f-00e5-45eb-9dbe-90bc8d5e9972","version":1,"content_hash":"v3:7f17813fb6af1acc7d8fd3fb5f05480f5be52783:590e64434296c282a8fbfeec470eb24534c28ff435bbd0a1cd72a43a0b434c33:979417bbda08a4bdf3124a57766b62b050eae50a1afbfb3746c0f2e4bd174f00:736b696c6c732f7461686f6465762f6b6f796f62756e2d636865636b:5a39e2cf3fee09a8ed29703e312bb993","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All five static findings are false positives in the reviewed Japanese proofreading instructions. Official reference links do not transmit document contents, and the parent-directory link is a documentation reference rather than an executable traversal operation. No evidence found of prompt injection, data exfiltration, executable payloads, or concealed instructions.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":21,"line_start":21}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":96,"line_start":96}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":106,"audit_model":"codex","audited_at":"2026-10-13T04:07:35.49+00:00","created_at":"2026-10-13T19:01:15.003617+00:00","static_findings":[{"id":"network:SKILL.md:19:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- 建議「公用文作成の考え方」(付)解説 PDF: https://www.bunka.go.jp/seisaku/bunkashingikai/kokugo/hokoku/pdf/93651301_","category":"network","line_end":19,"severity":"low","line_start":19},{"id":"network:SKILL.md:20:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- 掲載ページ: https://www.bunka.go.jp/seisaku/bunkashingikai/kokugo/hokoku/93657201.html","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"network:SKILL.md:21:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- 一覧ページ(報告・答申・建議等): https://www.bunka.go.jp/seisaku/bunkashingikai/kokugo/hokoku/","category":"network","line_end":21,"severity":"low","line_start":21},{"id":"filesystem:SKILL.md:96:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"共通の取得時チェックリストは [共通レスポンス契約](../docs/response-contract.md) の「取得時の落とし穴チェックリスト」を参照。","category":"filesystem","line_end":96,"severity":"high","line_start":96},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-50-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (7.50 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"network:SKILL.md:19:hardcoded-url","reason":"The URL cites the official Agency for Cultural Affairs recommendation PDF. The skill explicitly requires no network use and contains no instruction to transmit user documents.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:20:hardcoded-url","reason":"The URL is an official government publication page supporting the proofreading checklist. It is a reference link, not a request or data submission endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:21:hardcoded-url","reason":"The URL references the official government index of language policy publications. No document upload, credential transmission, or mandatory network operation is specified.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:96:path-traversal-sequence","reason":"The parent-directory sequence appears only in a Markdown link to shared documentation. There is no user-controlled path, file write, sensitive-file target, or executable traversal operation.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-50-bits-possible-b","reason":"The complete file is readable Japanese Markdown with YAML metadata and an English summary. Its multilingual text explains the entropy signal; no encrypted, binary, or encoded payload is present.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"7f17813fb6af1acc7d8fd3fb5f05480f5be52783","subject_content_hash":"590e64434296c282a8fbfeec470eb24534c28ff435bbd0a1cd72a43a0b434c33","subject_tree_hash":"979417bbda08a4bdf3124a57766b62b050eae50a1afbfb3746c0f2e4bd174f00","subject_plugin_path":"skills/tahodev/koyobun-check","audit_payload_hash":"5a39e2cf3fee09a8ed29703e312bb993","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"7f17813fb6af1acc7d8fd3fb5f05480f5be52783","contentHash":"590e64434296c282a8fbfeec470eb24534c28ff435bbd0a1cd72a43a0b434c33","treeHash":"979417bbda08a4bdf3124a57766b62b050eae50a1afbfb3746c0f2e4bd174f00","pluginPath":"skills/tahodev/koyobun-check","auditPayloadHash":"5a39e2cf3fee09a8ed29703e312bb993"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/tahodev-koyobun-check/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}