{"data":{"skill":{"slug":"tahodev-taiwan-aqi","name":"taiwan-aqi","icon":"📦","repo":"https://github.com/tahodev/baodao-skill/tree/3ce4b58e4525f5a66390e1236b6d38702790225a/taiwan-aqi","status":"approved","author":"tahodev","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"9f9d83dd-4153-47a2-bfcc-e8a61a34e1dd","skill_id":"b0a02da9-7963-4662-9e63-7546dc2e2931","version":1,"content_hash":"v3:2aab20a3878daa05021884e089a7dd7739e08581:86dcd1a3a122272b9f1ced3adb869941c491617c8d3ec4524b168d7eb4cf553e:d540b1cfcd70b02d7dee20922fce12ffb97dc4ddef70c9a5078eca98cd48b32b:736b696c6c732f7461686f6465762f74616977616e2d617169:63beb16caa639bee42c1c4d0530a2146","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most detections reflect Markdown formatting, official URLs, credential documentation, or readable multilingual text; no evidence found of prompt injection or malicious exfiltration. The fixed temporary-file output can enable symlink overwrite, and the expanded curl argument can expose the API key through process listings. These two findings are confirmed; all other static findings are false positives.","remediation":[{"issue":"SKILL.md:35 writes downloaded data to a predictable shared temporary-file path.","severity":"medium","suggestion":"Create a private temporary directory with mktemp, use its file for every query, and remove the directory after processing."},{"issue":"SKILL.md:34 expands the API key into a curl argument visible through process inspection on some systems.","severity":"high","suggestion":"Pass authentication through a protected curl configuration or standard input, not expanded command arguments; redact request URLs and disable shell tracing."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":36,"line_start":28},{"file":"SKILL.md","line_end":40,"line_start":36},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":59,"line_start":51},{"file":"SKILL.md","line_end":65,"line_start":59},{"file":"SKILL.md","line_end":71,"line_start":65},{"file":"SKILL.md","line_end":75,"line_start":71},{"file":"SKILL.md","line_end":77,"line_start":75},{"file":"SKILL.md","line_end":92,"line_start":77},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":96,"line_start":96},{"file":"SKILL.md","line_end":97,"line_start":97},{"file":"SKILL.md","line_end":103,"line_start":103},{"file":"SKILL.md","line_end":105,"line_start":104},{"file":"SKILL.md","line_end":108,"line_start":105},{"file":"SKILL.md","line_end":112,"line_start":108},{"file":"SKILL.md","line_end":112,"line_start":112}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":97,"line_start":97},{"file":"SKILL.md","line_end":112,"line_start":112}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":76,"line_start":76}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":97,"line_start":97},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":112,"line_start":112}]}],"critical_findings":[],"high_findings":[{"title":"Generic API/secret keys","locations":[{"file":"SKILL.md","line_end":34,"line_start":34}],"confidence":0.95,"description":"--data-urlencode \"api_key=$MOENV_API_KEY\" \\","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The shell expands MOENV_API_KEY into curl's command arguments. Although authentication targets the correct official host, process inspection can expose the expanded secret on systems permitting it."}],"medium_findings":[{"title":"Temp directory access","locations":[{"file":"SKILL.md","line_end":35,"line_start":35}],"confidence":0.96,"description":"-o /tmp/taiwan-aqi.json","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"curl writes to the predictable shared path /tmp/taiwan-aqi.json without secure temporary-file creation. A pre-existing symlink can redirect the write and overwrite a file accessible to the user."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":113,"audit_model":"codex","audited_at":"2026-10-13T03:02:43.368+00:00","created_at":"2026-10-13T18:34:17.262009+00:00","static_findings":[{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"查環境部環境資料開放平臺的「空氣品質指標(AQI)」資料集(`AQX_P_432`)。資料由空氣品質監測網提供,每小時更新,含測站、縣市、AQI、主要污染物、狀態、PM2.5、PM10、氣體濃度、發布","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**需要 API 金鑰(免費):** 到 https://data.moenv.gov.tw/api-term 註冊後取得 API 金鑰,放在環境變數 `MOENV_API_KEY` 或安全的憑證儲存","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. 確認 `MOENV_API_KEY` 已設定","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. 呼叫 `AQX_P_432`,先取回全台測站","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. 用 `jq` 依縣市或測站篩選","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. 回報 AQI、`status`、主要污染物、PM2.5、PM10 與 `publishtime`","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":36,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":40,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `sitename`、`county`、`siteid`","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `aqi`、`status`、`pollutant`","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `pm2.5`、`pm2.5_avg`、`pm10`、`pm10_avg`","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `o3`、`o3_8hr`、`co`、`co_8hr`、`so2`、`so2_avg`、`no2`","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `wind_speed`、`wind_direc`","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `publishtime`、`longitude`、`latitude`","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"縣市名稱以資料內的 `county` 為準(如 `臺北市`、`新北市`)。把「台」正規化成「臺」再比對:","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":59,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":65,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":71,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":75,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":77,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":92,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"優先使用 API 的 `status` 原文。若 `aqi` 或 `status` 缺值,不自行補算等級;直接說該測站目前缺值。","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 2026-09-20:以有效 MOENV API 金鑰呼叫 `AQX_P_432?format=json&offset=0&limit=2`,HTTP 200,回傳最外層 JSON 陣列。樣本:汐","category":"external_commands","line_end":96,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 2026-09-20:資料集頁確認代碼 `AQX_P_432`、更新頻率 1 小時與 24 個欄位。平台開發指南列出的 API 格式為 `https://data.moenv.gov.tw/api","category":"external_commands","line_end":97,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **空陣列**:先確認 `offset`、`limit`、資料集代碼與平台公告。不要解讀成全台空氣品質良好。","category":"external_commands","line_end":103,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **測站缺值**:`aqi`、污染物或濃度可能是空字串。原樣標示「目前無資料」,可提供同縣市其他有值測站,但不要替缺值站推估。","category":"external_commands","line_end":105,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **資料延遲**:解析 `publishtime`,附在回答中。相對目前時間明顯落後時說明資料可能延遲,不把它稱為即時值。","category":"external_commands","line_end":108,"severity":"medium","line_start":105},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **金鑰保密**:範例只用 `$MOENV_API_KEY`。不得把實際金鑰寫進文件、commit、issue、PR、日誌或回覆。","category":"external_commands","line_end":112,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Queries Taiwan's official hourly Air Quality Index dataset (`AQX_P_432`) from the Ministry of Enviro","category":"external_commands","line_end":112,"severity":"medium","line_start":112},{"id":"network:SKILL.md:16:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"**需要 API 金鑰(免費):** 到 https://data.moenv.gov.tw/api-term 註冊後取得 API 金鑰,放在環境變數 `MOENV_API_KEY` 或安全的憑證儲存","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"network:SKILL.md:30:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"--get 'https://data.moenv.gov.tw/api/v2/aqx_p_432' \\","category":"network","line_end":30,"severity":"low","line_start":30},{"id":"network:SKILL.md:81:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"環境部標準:[空氣品質指標](https://airtw.moenv.gov.tw/cht/Information/Standard/AirQualityIndicator.aspx)","category":"network","line_end":81,"severity":"low","line_start":81},{"id":"network:SKILL.md:97:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- 2026-09-20:資料集頁確認代碼 `AQX_P_432`、更新頻率 1 小時與 24 個欄位。平台開發指南列出的 API 格式為 `https://data.moenv.gov.tw/api","category":"network","line_end":97,"severity":"low","line_start":97},{"id":"network:SKILL.md:112:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Queries Taiwan's official hourly Air Quality Index dataset (`AQX_P_432`) from the Ministry of Enviro","category":"network","line_end":112,"severity":"low","line_start":112},{"id":"filesystem:SKILL.md:35:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"-o /tmp/taiwan-aqi.json","category":"filesystem","line_end":35,"severity":"medium","line_start":35},{"id":"filesystem:SKILL.md:58:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"' /tmp/taiwan-aqi.json","category":"filesystem","line_end":58,"severity":"medium","line_start":58},{"id":"filesystem:SKILL.md:70:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"' /tmp/taiwan-aqi.json","category":"filesystem","line_end":70,"severity":"medium","line_start":70},{"id":"filesystem:SKILL.md:76:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"jq -r '.[].sitename' /tmp/taiwan-aqi.json | sort -u","category":"filesystem","line_end":76,"severity":"medium","line_start":76},{"id":"env_access:SKILL.md:16:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"**需要 API 金鑰(免費):** 到 https://data.moenv.gov.tw/api-term 註冊後取得 API 金鑰,放在環境變數 `MOENV_API_KEY` 或安全的憑證儲存","category":"env_access","line_end":16,"severity":"high","line_start":16},{"id":"env_access:SKILL.md:20:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"1. 確認 `MOENV_API_KEY` 已設定","category":"env_access","line_end":20,"severity":"high","line_start":20},{"id":"env_access:SKILL.md:34:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"--data-urlencode \"api_key=$MOENV_API_KEY\" \\","category":"env_access","line_end":34,"severity":"high","line_start":34},{"id":"env_access:SKILL.md:97:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- 2026-09-20:資料集頁確認代碼 `AQX_P_432`、更新頻率 1 小時與 24 個欄位。平台開發指南列出的 API 格式為 `https://data.moenv.gov.tw/api","category":"env_access","line_end":97,"severity":"high","line_start":97},{"id":"env_access:SKILL.md:108:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- **金鑰保密**:範例只用 `$MOENV_API_KEY`。不得把實際金鑰寫進文件、commit、issue、PR、日誌或回覆。","category":"env_access","line_end":108,"severity":"high","line_start":108},{"id":"env_access:SKILL.md:112:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"Queries Taiwan's official hourly Air Quality Index dataset (`AQX_P_432`) from the Ministry of Enviro","category":"env_access","line_end":112,"severity":"high","line_start":112},{"id":"blocker:SKILL.md:112:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Queries Taiwan's official hourly Air Quality Index dataset (`AQX_P_432`) from the Ministry of Enviro","category":"blocker","line_end":112,"severity":"low","line_start":112},{"id":"obfuscation:SKILL.md:96:heuristic-very-high-entropy-string-5-58-bits-lik","file":"SKILL.md","pattern":"[HEURISTIC] Very high entropy string (5.58 bits) - likely encoded/encrypted payload","snippet":"，HTTP 200，回傳最外層 JSON 陣列。樣本：汐止與基隆皆為 AQI 52、狀態「普通」、主要污染物「細懸浮微粒」，發布時間 ","category":"obfuscation","line_end":96,"severity":"high","line_start":96},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-82-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.82 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"The backticks format the dataset identifier AQX_P_432 as Markdown inline code. They do not execute a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"The backticks identify the MOENV_API_KEY environment variable in prose. The line documents secure storage, not shell or Ruby execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"This checklist item asks whether MOENV_API_KEY is configured. Its backticks are Markdown formatting, not executable substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"AQX_P_432 is an inline-formatted dataset name in a workflow checklist. No backtick execution occurs.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"The line names jq as the JSON filtering tool using Markdown backticks. It contains no executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The backticks mark status and publishtime as response field names. These are reporting instructions, not command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The detected text opens a Markdown Bash code fence, not a Ruby or shell backtick expression. Separate verdicts address the example's credential and temporary-file risks.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"This line closes a Markdown code fence. The following text documents JSON fields and contains no backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"sitename, county, and siteid are inline-formatted JSON field names. The line does not invoke commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"aqi, status, and pollutant are documented response fields. The backticks are Markdown delimiters only.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The line lists particulate concentration field names in Markdown. No Ruby or shell execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The backticks format gas concentration field names. These names are data schema documentation, not commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"wind_speed and wind_direc are listed as JSON fields. Markdown backticks do not execute them.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The line documents publication time and coordinate fields. Its inline code formatting has no executable behavior.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"Backticks format the county field and example county names. The text describes name normalization, not command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"This is a Markdown code fence around a jq query. The query uses a fixed filter and passes the county through quoted --arg.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The detected backticks close the county-query Markdown fence. Nearby prose describes station comparison and contains no executable substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The Markdown fence encloses a fixed jq station filter. The station value is passed through quoted --arg, not interpolated into executable code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"This line closes the station-query Markdown fence. It is not a shell or Ruby expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The detected token opens a Markdown fence for jq and sort. These fixed commands list station names without executing data as commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"This is the closing fence for the station-name example. The following AQI table is ordinary documentation, not executable content.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The backticks format status and aqi within missing-data guidance. The instruction explicitly avoids inventing missing categories and executes nothing.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"The line records a historical request identifier and timestamp as inline code. It contains no shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"The inline-formatted URL illustrates the documented API format. It is not evaluated as a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"offset and limit are inline-formatted pagination parameters in error guidance. No executable expression is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The line formats aqi as a response field when describing missing readings. It contains no shell or Ruby backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"publishtime is Markdown inline code within data-delay guidance. The surrounding instructions do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The backticks format an environment-variable placeholder in a confidentiality warning. The line prohibits publishing actual keys and executes nothing.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"The English summary uses Markdown inline code for dataset names, fields, and an example GET request. No backtick execution occurs.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:16:hardcoded-url","reason":"The URLs point to Ministry of Environment registration and dataset pages under data.moenv.gov.tw. No credential-bearing request or unrelated destination appears on this line.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:30:hardcoded-url","reason":"The HTTPS endpoint retrieves the AQI dataset from the intended Ministry of Environment host. It is not an unrelated exfiltration destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:81:hardcoded-url","reason":"This is a reference link to official AQI standards under airtw.moenv.gov.tw. It sends no local data or credentials.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:97:hardcoded-url","reason":"The URL documents the official API format using placeholders. No actual secret or unauthorized destination is present.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:112:hardcoded-url","reason":"The English summary includes the intended official API endpoint with api_key=... as a placeholder. The URL does not direct data to another service.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:35:temp-directory-access","reason":"curl writes to the predictable shared path /tmp/taiwan-aqi.json without secure temporary-file creation. A pre-existing symlink can redirect the write and overwrite a file accessible to the user.","verdict":"confirmed","confidence":0.96},{"id":"filesystem:SKILL.md:58:temp-directory-access","reason":"jq reads downloaded public AQI data and applies a fixed county filter; it does not modify files or execute the contents. The unsafe file creation is covered by the line 35 verdict.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:70:temp-directory-access","reason":"This is a read-only jq station query over public data, using quoted --arg. The shared-path creation risk is adjudicated separately at line 35.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:76:temp-directory-access","reason":"jq and sort read station names from the downloaded dataset without executing them or altering files. The unsafe temporary-file write is separately confirmed at line 35.","verdict":"false_positive","confidence":0.96},{"id":"env_access:SKILL.md:16:generic-api-secret-keys","reason":"The line documents authorized API-key storage and explicitly prohibits placing keys in repositories, command output, or replies. It does not read or disclose an actual secret.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:20:generic-api-secret-keys","reason":"Checking that the required MOENV_API_KEY is configured is a legitimate authentication prerequisite. No instruction to print it or inspect unrelated credentials appears.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:34:generic-api-secret-keys","reason":"The shell expands MOENV_API_KEY into curl's command arguments. Although authentication targets the correct official host, process inspection can expose the expanded secret on systems permitting it.","verdict":"confirmed","confidence":0.95},{"id":"env_access:SKILL.md:97:generic-api-secret-keys","reason":"api_key=... is a placeholder in an API format example. No actual key, environment read, or secret disclosure appears.","verdict":"false_positive","confidence":1},{"id":"env_access:SKILL.md:108:generic-api-secret-keys","reason":"The line names a variable placeholder and explicitly forbids exposing actual keys in documents, commits, logs, or replies. This is confidentiality guidance, not credential extraction.","verdict":"false_positive","confidence":1},{"id":"env_access:SKILL.md:112:generic-api-secret-keys","reason":"The summary documents the required key and instructs users never to commit or echo it. The example request contains only a placeholder, not a secret.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:112:system-reconnaissance","reason":"The line summarizes environmental data queries and station filtering. No evidence found of host enumeration, system reconnaissance, or unrelated environment inspection.","verdict":"false_positive","confidence":1},{"id":"obfuscation:SKILL.md:96:heuristic-very-high-entropy-string-5-58-bits-lik","reason":"The flagged text is readable Chinese describing historical AQI samples and their publication timestamp. It is not an encoded or encrypted payload.","verdict":"false_positive","confidence":1},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-82-bits-possible-b","reason":"The complete file is readable Markdown with Chinese and English prose, Bash examples, and an AQI table. No evidence found of binary content, encrypted payloads, or hidden executable material.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"2aab20a3878daa05021884e089a7dd7739e08581","subject_content_hash":"86dcd1a3a122272b9f1ced3adb869941c491617c8d3ec4524b168d7eb4cf553e","subject_tree_hash":"d540b1cfcd70b02d7dee20922fce12ffb97dc4ddef70c9a5078eca98cd48b32b","subject_plugin_path":"skills/tahodev/taiwan-aqi","audit_payload_hash":"63beb16caa639bee42c1c4d0530a2146","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"2aab20a3878daa05021884e089a7dd7739e08581","contentHash":"86dcd1a3a122272b9f1ced3adb869941c491617c8d3ec4524b168d7eb4cf553e","treeHash":"d540b1cfcd70b02d7dee20922fce12ffb97dc4ddef70c9a5078eca98cd48b32b","pluginPath":"skills/tahodev/taiwan-aqi","auditPayloadHash":"63beb16caa639bee42c1c4d0530a2146"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/tahodev-taiwan-aqi/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}