{"data":{"skill":{"slug":"tahodev-postal-address","name":"postal-address","icon":"📦","repo":"https://github.com/tahodev/baodao-skill/tree/3ce4b58e4525f5a66390e1236b6d38702790225a/postal-address","status":"approved","author":"tahodev","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"a03f822d-d841-4094-b392-0e9db3f27b98","skill_id":"d6afc303-791e-4509-80a6-c8fdc7f4b353","version":1,"content_hash":"v3:2aab20a3878daa05021884e089a7dd7739e08581:9e2590e8b057a2ff79c0a25228ae167ce020492abc98c1c70230838d1c42e01c:b52d82d1d34901ccdf3fb04bae850e5f0ce50e6e2c4aa0580dc2ddb1b2f2c1f7:736b696c6c732f7461686f6465762f706f7374616c2d61646472657373:320cb010bf8023deaeda7261890ba851","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Four predictable temporary-file writes create overwrite and local symlink risks. Other alerts concern Markdown syntax, public postal downloads, extension descriptions, and expected data reads. No evidence found of prompt injection, credential access, or data exfiltration.","remediation":[{"issue":"Download examples write to predictable filenames in the shared temporary directory.","severity":"medium","suggestion":"Create a private directory with mktemp -d, store all downloads inside it, and clean it up after use. Avoid elevated execution."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":21,"line_start":18},{"file":"SKILL.md","line_end":23,"line_start":21},{"file":"SKILL.md","line_end":27,"line_start":23},{"file":"SKILL.md","line_end":34,"line_start":27},{"file":"SKILL.md","line_end":36,"line_start":34},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":42,"line_start":38},{"file":"SKILL.md","line_end":59,"line_start":42},{"file":"SKILL.md","line_end":64,"line_start":59}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":52,"line_start":52}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":41}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Temp directory access","locations":[{"file":"SKILL.md","line_end":19,"line_start":19}],"confidence":0.98,"description":"curl -sm 30 'https://www.post.gov.tw/post/download/103.12.25-%E8%87%BA%E7%81%A3%E5%9C%B0%E5%8D%80%E9","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"Shell redirection overwrites the predictable shared path /tmp/zip3.txt and follows existing symlinks. A local attacker could redirect writes to another writable file."},{"title":"Temp directory access","locations":[{"file":"SKILL.md","line_end":29,"line_start":29}],"confidence":0.98,"description":"curl -sm 30 -o /tmp/county.xml 'https://www.post.gov.tw/post/download/County_h_10906.xml'","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"Curl writes to the predictable shared path /tmp/county.xml without exclusive creation. Existing files or attacker-created symlink targets could be overwritten."},{"title":"Temp directory access","locations":[{"file":"SKILL.md","line_end":31,"line_start":31}],"confidence":0.98,"description":"curl -sm 30 'https://www.post.gov.tw/post/download/%E6%9D%91%E9%87%8C%E6%96%87%E5%AD%97%E5%B7%B7%E4%","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"Shell redirection overwrites the predictable shared path /tmp/village.txt and follows existing symlinks. A local attacker could redirect writes to another writable file."},{"title":"Temp directory access","locations":[{"file":"SKILL.md","line_end":33,"line_start":33}],"confidence":0.98,"description":"curl -sm 30 'https://www.post.gov.tw/post/download/%E4%B8%AD%E8%8B%B1%E6%96%87%E8%A1%97%E8%B7%AF%E5%","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"Shell redirection overwrites the predictable shared path /tmp/roads.txt and follows existing symlinks. A local attacker could redirect writes to another writable file."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":65,"audit_model":"codex","audited_at":"2026-10-13T02:58:31.513+00:00","created_at":"2026-10-13T18:34:06.991561+00:00","static_findings":[{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"用中華郵政官網下載區的公開對照表查郵遞區號(前 3 碼)與地址英譯。不需要 API 金鑰或登入。下載區總頁:https://www.post.gov.tw/post/internet/Download","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":21,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":23,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2026-09-12 實測:HTTP 200、純文字表格,依縣市分欄列出鄉鎮市區與 3 碼(例:台北市大安區 106)。另有經緯度版(XML):`https://www.post.gov.tw/pos","category":"external_commands","line_end":27,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":34,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":36,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2026-09-12 實測:三個檔都 HTTP 200。路街檔是兩欄 CSV 格式 `中文路名,English Name`(例:`一工路,Yigong Rd.`、`一心二路,Yixin 2nd Rd.","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":42,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":59,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **下載 404**:中華郵政改版時檔名會帶日期更新(如路街檔的 `1130401`)。回下載區總頁找最新檔名替換。","category":"external_commands","line_end":64,"severity":"medium","line_start":59},{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"用中華郵政官網下載區的公開對照表查郵遞區號(前 3 碼)與地址英譯。不需要 API 金鑰或登入。下載區總頁:https://www.post.gov.tw/post/internet/Download","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:19:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -sm 30 'https://www.post.gov.tw/post/download/103.12.25-%E8%87%BA%E7%81%A3%E5%9C%B0%E5%8D%80%E9","category":"network","line_end":19,"severity":"low","line_start":19},{"id":"network:SKILL.md:23:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"2026-09-12 實測:HTTP 200、純文字表格,依縣市分欄列出鄉鎮市區與 3 碼(例:台北市大安區 106)。另有經緯度版(XML):`https://www.post.gov.tw/pos","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:SKILL.md:29:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -sm 30 -o /tmp/county.xml 'https://www.post.gov.tw/post/download/County_h_10906.xml'","category":"network","line_end":29,"severity":"low","line_start":29},{"id":"network:SKILL.md:31:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -sm 30 'https://www.post.gov.tw/post/download/%E6%9D%91%E9%87%8C%E6%96%87%E5%AD%97%E5%B7%B7%E4%","category":"network","line_end":31,"severity":"low","line_start":31},{"id":"network:SKILL.md:33:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -sm 30 'https://www.post.gov.tw/post/download/%E4%B8%AD%E8%8B%B1%E6%96%87%E8%A1%97%E8%B7%AF%E5%","category":"network","line_end":33,"severity":"low","line_start":33},{"id":"network:SKILL.md:52:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **完整 3+3 六碼投遞區段**:官方只透過 Windows 版「3+3 郵遞區號應用系統」(rar 安裝檔)與需申請的 Web Service 提供,沒有免登入的機讀全表。需要六碼時,導使用者","category":"network","line_end":52,"severity":"low","line_start":52},{"id":"filesystem:SKILL.md:58:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"- **亂碼**:TXT 檔忘了 iconv(Big5→UTF-8);或反過來把 UTF-8 的 XML 檔也過了 iconv 轉壞。分工:.TXT/.txt=Big5 要轉,.xml=UTF-8 直","category":"filesystem","line_end":58,"severity":"medium","line_start":58},{"id":"filesystem:SKILL.md:19:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"curl -sm 30 'https://www.post.gov.tw/post/download/103.12.25-%E8%87%BA%E7%81%A3%E5%9C%B0%E5%8D%80%E9","category":"filesystem","line_end":19,"severity":"medium","line_start":19},{"id":"filesystem:SKILL.md:20:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"grep '大安' /tmp/zip3.txt","category":"filesystem","line_end":20,"severity":"medium","line_start":20},{"id":"filesystem:SKILL.md:29:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"curl -sm 30 -o /tmp/county.xml 'https://www.post.gov.tw/post/download/County_h_10906.xml'","category":"filesystem","line_end":29,"severity":"medium","line_start":29},{"id":"filesystem:SKILL.md:31:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"curl -sm 30 'https://www.post.gov.tw/post/download/%E6%9D%91%E9%87%8C%E6%96%87%E5%AD%97%E5%B7%B7%E4%","category":"filesystem","line_end":31,"severity":"medium","line_start":31},{"id":"filesystem:SKILL.md:33:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"curl -sm 30 'https://www.post.gov.tw/post/download/%E4%B8%AD%E8%8B%B1%E6%96%87%E8%A1%97%E8%B7%AF%E5%","category":"filesystem","line_end":33,"severity":"medium","line_start":33},{"id":"filesystem:SKILL.md:39:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"grep '^中正路,' /tmp/roads.txt | head -5","category":"filesystem","line_end":39,"severity":"medium","line_start":39},{"id":"filesystem:SKILL.md:41:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"grep '^\"大安里,\"' /tmp/village.txt | head -3","category":"filesystem","line_end":41,"severity":"medium","line_start":41},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-78-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.78 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"Backticks delimit an inline iconv example in Markdown. There is no Ruby execution or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The backticks open a Markdown bash code fence, not command substitution. Temporary-file risks in the enclosed commands are adjudicated separately.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The backticks close a Markdown code fence. The surrounding text documents postal data and contains no backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"Backticks format a public XML download URL as inline Markdown. The URL is not executed through shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The backticks open a Markdown bash code fence. The examples contain no Ruby or backtick command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"This line closes a Markdown code fence. Following inline examples describe table contents, not executable substitutions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Backticks surround CSV column names and sample address translations. These are data examples, not shell or Ruby execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The backticks open a Markdown fence containing fixed grep and head examples. No backtick execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The line closes a Markdown code fence. The following sections explain dataset limitations and troubleshooting, not executable substitutions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"Backticks format a dated filename component and an iconv example. Neither represents shell command substitution or Ruby execution.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:14:hardcoded-url","reason":"The link points to the official Chunghwa Post public download index. No secret or user address is included in the URL.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:19:hardcoded-url","reason":"Curl downloads a fixed public postal code table over HTTPS. The request contains no credentials, user data, or upload payload.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:23:hardcoded-url","reason":"The inline URL references an official public administrative-coordinate XML dataset. It contains no data transmission or credential collection instructions.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:29:hardcoded-url","reason":"Curl retrieves the official public county translation table over HTTPS. No private data is sent; the output-file risk is evaluated separately.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:31:hardcoded-url","reason":"The fixed HTTPS URL downloads public village and lane translations from Chunghwa Post. No authentication material or user address is transmitted.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:33:hardcoded-url","reason":"The fixed HTTPS URL downloads an official public road-name translation table. The command does not upload local data or transmit secrets.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:52:hardcoded-url","reason":"The official postal website is a user referral for six-digit codes outside this skill's scope. No automated address submission is instructed.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:58:hidden-file-access","reason":"The strings .TXT, .txt, and .xml describe file extensions and encoding rules. No hidden file is opened or requested.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:19:temp-directory-access","reason":"Shell redirection overwrites the predictable shared path /tmp/zip3.txt and follows existing symlinks. A local attacker could redirect writes to another writable file.","verdict":"confirmed","confidence":0.98},{"id":"filesystem:SKILL.md:20:temp-directory-access","reason":"Grep reads the postal table created by the preceding download. This is expected local processing, not arbitrary sensitive-file access; write risks are separately confirmed.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:29:temp-directory-access","reason":"Curl writes to the predictable shared path /tmp/county.xml without exclusive creation. Existing files or attacker-created symlink targets could be overwritten.","verdict":"confirmed","confidence":0.98},{"id":"filesystem:SKILL.md:31:temp-directory-access","reason":"Shell redirection overwrites the predictable shared path /tmp/village.txt and follows existing symlinks. A local attacker could redirect writes to another writable file.","verdict":"confirmed","confidence":0.98},{"id":"filesystem:SKILL.md:33:temp-directory-access","reason":"Shell redirection overwrites the predictable shared path /tmp/roads.txt and follows existing symlinks. A local attacker could redirect writes to another writable file.","verdict":"confirmed","confidence":0.98},{"id":"filesystem:SKILL.md:39:temp-directory-access","reason":"Grep and head read a downloaded road-name table for a fixed lookup. No write, deletion, or sensitive-file collection occurs at this line.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:41:temp-directory-access","reason":"Grep and head read the downloaded village table using a fixed name. This lookup does not modify files or collect credentials.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-78-bits-possible-b","reason":"The entire file is readable Chinese and English Markdown with percent-encoded public URLs. No evidence found of encrypted content, binary payloads, or concealed execution.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"2aab20a3878daa05021884e089a7dd7739e08581","subject_content_hash":"9e2590e8b057a2ff79c0a25228ae167ce020492abc98c1c70230838d1c42e01c","subject_tree_hash":"b52d82d1d34901ccdf3fb04bae850e5f0ce50e6e2c4aa0580dc2ddb1b2f2c1f7","subject_plugin_path":"skills/tahodev/postal-address","audit_payload_hash":"320cb010bf8023deaeda7261890ba851","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"2aab20a3878daa05021884e089a7dd7739e08581","contentHash":"9e2590e8b057a2ff79c0a25228ae167ce020492abc98c1c70230838d1c42e01c","treeHash":"b52d82d1d34901ccdf3fb04bae850e5f0ce50e6e2c4aa0580dc2ddb1b2f2c1f7","pluginPath":"skills/tahodev/postal-address","auditPayloadHash":"320cb010bf8023deaeda7261890ba851"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/tahodev-postal-address/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":4,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}