{"data":{"skill":{"slug":"tahodev-taiwan-holidays","name":"taiwan-holidays","icon":"📦","repo":"https://github.com/tahodev/baodao-skill/tree/3ce4b58e4525f5a66390e1236b6d38702790225a/taiwan-holidays","status":"approved","author":"tahodev","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"89d06eef-7bb6-469b-a32b-da2c99f3b74c","skill_id":"5d718957-d258-432d-9125-1824f6c9b0ab","version":1,"content_hash":"v3:2aab20a3878daa05021884e089a7dd7739e08581:51b07c79e2f135ca07c2aa519aa15854468dabd874832f6dea01a4b7159d8e4b:b9538bb46fce28271737905bd27f11b14df547bf12d40a205fbe16b8391d2070:736b696c6c732f7461686f6465762f74616977616e2d686f6c6964617973:4d0922098475e268f29c382a7c154c38","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Three temporary-file writes pose overwrite and symlink risks because they use predictable paths in a shared directory. The remaining 33 alerts concern Markdown formatting, public government data, local parsing, or readable multilingual text rather than dangerous behavior. No evidence found of prompt injection, credential theft, or data exfiltration.","remediation":[{"issue":"SKILL.md:22, 34, and 46 write calendar downloads to predictable shared temporary paths.","severity":"medium","suggestion":"Create a private directory with mktemp -d, quote its paths, and use it for all downloads and reads. Remove it on exit."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":27,"line_start":21},{"file":"SKILL.md","line_end":30,"line_start":27},{"file":"SKILL.md","line_end":33,"line_start":30},{"file":"SKILL.md","line_end":37,"line_start":33},{"file":"SKILL.md","line_end":39,"line_start":37},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":47,"line_start":45},{"file":"SKILL.md","line_end":49,"line_start":47},{"file":"SKILL.md","line_end":74,"line_start":49},{"file":"SKILL.md","line_end":76,"line_start":74},{"file":"SKILL.md","line_end":81,"line_start":76},{"file":"SKILL.md","line_end":83,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":83}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":85,"line_start":85}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":52,"line_start":52}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Temp directory access","locations":[{"file":"SKILL.md","line_end":22,"line_start":22}],"confidence":0.96,"description":"curl -sm 30 -o /tmp/cal115.csv 'https://www.dgpa.gov.tw/FileConversion?filename=dgpa/files/202506/a5","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"curl writes to the predictable shared path /tmp/cal115.csv without exclusive creation. A preexisting file or attacker-planted symlink can cause unintended overwrites under the agent's permissions."},{"title":"Temp directory access","locations":[{"file":"SKILL.md","line_end":34,"line_start":34}],"confidence":0.98,"description":"curl -sm 30 'https://www.dgpa.gov.tw/FileConversion?filename=dgpa/files/202510/b84cb88a-803c-4621-a8","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"Shell redirection truncates the predictable shared path /tmp/cal114.csv and follows existing symlinks. A planted link can redirect the write to another writable file."},{"title":"Temp directory access","locations":[{"file":"SKILL.md","line_end":46,"line_start":46}],"confidence":0.96,"description":"curl -sm 30 -o /tmp/cal.xlsx 'https://www.dgpa.gov.tw/uploads/dgpa/files/202511/1d88999f-f893-47dd-8","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"curl writes the workbook to predictable /tmp/cal.xlsx without exclusive creation or a private directory. Existing files or planted symlinks can redirect or suffer overwrites."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":90,"audit_model":"codex","audited_at":"2026-10-13T03:13:37.821+00:00","created_at":"2026-10-13T18:34:37.670423+00:00","static_findings":[{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"資料集 https://data.gov.tw/dataset/14718 有 106-116 年的 CSV。欄位:`西元日期,星期,是否放假,備註`(西元日期為 YYYYMMDD;是否放假 0=上班","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":27,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"116 年(2027)CSV 也已存在:`https://www.dgpa.gov.tw/FileConversion?filename=dgpa/files/202607/f538b1ff-ba60","category":"external_commands","line_end":33,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":37,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":39,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**編碼依檔案而不同**(2026-09-12 實測):115、116 與舊版 114 是 UTF-8 含 BOM;114 更新版是 Big5。處理前先 `file` 或 `head -c` 確認——","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":47,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":49,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":74,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":76,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2026-09-12 實測:115 年 xlsx 解析出 365 天,星期全部與實際日期吻合,結果與 115 CSV 完全一致(LibreOffice 渲染目視確認:圖例為「□上班日/粉紅=放假日」)","category":"external_commands","line_end":81,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **亂碼**:編碼依檔案不同(見上),先確認再決定要不要 iconv;另外檔案是 CRLF,awk 比對最後一欄(備註)前先 `sub(/\\r$/,\"\",$4)`。","category":"external_commands","line_end":83,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **xlsx 連結 404**:人事總處每年換檔案 GUID。回列表頁 https://www.dgpa.gov.tw/informationlist?uid=30 找當年度公告取附件網址;解析邏","category":"external_commands","line_end":83,"severity":"medium","line_start":83},{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"用行政院人事行政總處公布的「政府行政機關辦公日曆表」查台灣的放假日與補班日。不需要 API 金鑰或登入。資料來源:https://www.dgpa.gov.tw/informationlist?uid","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:18:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"資料集 https://data.gov.tw/dataset/14718 有 106-116 年的 CSV。欄位:`西元日期,星期,是否放假,備註`(西元日期為 YYYYMMDD;是否放假 0=上班","category":"network","line_end":18,"severity":"low","line_start":18},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -sm 30 -o /tmp/cal115.csv 'https://www.dgpa.gov.tw/FileConversion?filename=dgpa/files/202506/a5","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:SKILL.md:30:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"116 年(2027)CSV 也已存在:`https://www.dgpa.gov.tw/FileConversion?filename=dgpa/files/202607/f538b1ff-ba60","category":"network","line_end":30,"severity":"low","line_start":30},{"id":"network:SKILL.md:34:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -sm 30 'https://www.dgpa.gov.tw/FileConversion?filename=dgpa/files/202510/b84cb88a-803c-4621-a8","category":"network","line_end":34,"severity":"low","line_start":34},{"id":"network:SKILL.md:43:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"當年度 xlsx(115 年):https://www.dgpa.gov.tw/uploads/dgpa/files/202511/1d88999f-f893-47dd-8757-ee7df20765","category":"network","line_end":43,"severity":"low","line_start":43},{"id":"network:SKILL.md:46:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -sm 30 -o /tmp/cal.xlsx 'https://www.dgpa.gov.tw/uploads/dgpa/files/202511/1d88999f-f893-47dd-8","category":"network","line_end":46,"severity":"low","line_start":46},{"id":"network:SKILL.md:51:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"NS='{http://schemas.openxmlformats.org/spreadsheetml/2006/main}'","category":"network","line_end":51,"severity":"low","line_start":51},{"id":"network:SKILL.md:80:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **CSV 連結 404 或要其他年份**:回資料集頁 https://data.gov.tw/dataset/14718 取最新 FileConversion 連結(每年一檔,檔名含年份;注意有","category":"network","line_end":80,"severity":"low","line_start":80},{"id":"network:SKILL.md:83:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **xlsx 連結 404**:人事總處每年換檔案 GUID。回列表頁 https://www.dgpa.gov.tw/informationlist?uid=30 找當年度公告取附件網址;解析邏","category":"network","line_end":83,"severity":"low","line_start":83},{"id":"network:SKILL.md:85:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- 重要判斷(請假、排程截止日)請提醒使用者回 https://www.dgpa.gov.tw 確認原文。","category":"network","line_end":85,"severity":"low","line_start":85},{"id":"filesystem:SKILL.md:22:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"curl -sm 30 -o /tmp/cal115.csv 'https://www.dgpa.gov.tw/FileConversion?filename=dgpa/files/202506/a5","category":"filesystem","line_end":22,"severity":"medium","line_start":22},{"id":"filesystem:SKILL.md:24:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"awk -F, 'NR>1 && $3==2 {print $1, $2, $4}' /tmp/cal115.csv","category":"filesystem","line_end":24,"severity":"medium","line_start":24},{"id":"filesystem:SKILL.md:26:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"awk -F, 'NR>1{sub(/\\r$/,\"\",$4)} $4==\"補行上班\" {print $1, $2}' /tmp/cal115.csv","category":"filesystem","line_end":26,"severity":"medium","line_start":26},{"id":"filesystem:SKILL.md:34:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"curl -sm 30 'https://www.dgpa.gov.tw/FileConversion?filename=dgpa/files/202510/b84cb88a-803c-4621-a8","category":"filesystem","line_end":34,"severity":"medium","line_start":34},{"id":"filesystem:SKILL.md:35:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"awk -F, 'NR>1{sub(/\\r$/,\"\",$4)} ($1==\"20250929\"||$1==\"20251024\"||$1==\"20251225\")' /tmp/cal114.csv","category":"filesystem","line_end":35,"severity":"medium","line_start":35},{"id":"filesystem:SKILL.md:46:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"curl -sm 30 -o /tmp/cal.xlsx 'https://www.dgpa.gov.tw/uploads/dgpa/files/202511/1d88999f-f893-47dd-8","category":"filesystem","line_end":46,"severity":"medium","line_start":46},{"id":"filesystem:SKILL.md:52:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"z=zipfile.ZipFile('/tmp/cal.xlsx')","category":"filesystem","line_end":52,"severity":"medium","line_start":52},{"id":"filesystem:SKILL.md:50:python-archive-libraries","file":"SKILL.md","pattern":"Python archive libraries","snippet":"import zipfile, re, bisect, xml.etree.ElementTree as ET","category":"filesystem","line_end":50,"severity":"medium","line_start":50},{"id":"filesystem:SKILL.md:52:python-archive-libraries","file":"SKILL.md","pattern":"Python archive libraries","snippet":"z=zipfile.ZipFile('/tmp/cal.xlsx')","category":"filesystem","line_end":52,"severity":"medium","line_start":52},{"id":"blocker:SKILL.md:43:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"當年度 xlsx(115 年):https://www.dgpa.gov.tw/uploads/dgpa/files/202511/1d88999f-f893-47dd-8757-ee7df20765","category":"blocker","line_end":43,"severity":"low","line_start":43},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-70-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.70 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The backticks delimit CSV column names in Markdown prose. No Ruby or shell command substitution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"These are Markdown code fences around curl and awk examples, not executable backtick substitution. Temporary-file write risks are adjudicated separately.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The matched text is a closing Markdown fence followed by calendar documentation. No executable backtick substitution appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Backticks format a government CSV URL as inline Markdown. They do not execute the URL or interpolate shell input.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The backticks open a Markdown bash example using fixed arguments. The predictable output-file risk is covered by its filesystem finding.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown code block. Subsequent inline commands describe file encoding inspection, not command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"Inline Markdown names file, head, and iconv commands for checking downloaded calendar encodings. No Ruby execution or shell backtick substitution is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown fences around a fixed curl download example. Its temporary-file write is assessed separately.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"This is a closing Markdown bash fence before a Python example. It is not a shell or Ruby expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The fence encloses Python that reads XLSX XML and calendar cell styles. No subprocess invocation, eval, or executable backtick substitution appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The matched text closes a Markdown Python block and describes prior calendar validation. No shell backtick execution is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"Backticks format the arithmetic expression band*3+block+1 in explanatory prose. The expression computes a month number, not a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"Inline backticks display an awk carriage-return cleanup expression and parser constant names. These are Markdown formatting, not shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"HDR and RED are formatted as inline Markdown variable names. The surrounding instructions validate spreadsheet layouts without executing backticks.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:14:hardcoded-url","reason":"The HTTPS URL identifies the official DGPA calendar listing. It supports the stated lookup task and contains no private data or upload instruction.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:18:hardcoded-url","reason":"The URL points to Taiwan's public government calendar dataset. The prose describes reading public CSV data, not sending user information.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:22:hardcoded-url","reason":"curl retrieves a fixed CSV over HTTPS from the official DGPA domain. Its query identifies a public attachment and sends no credentials or local content.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:30:hardcoded-url","reason":"This is a documented public 2027 calendar attachment on the official HTTPS domain. No exfiltration payload or remote-code execution instruction appears.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:34:hardcoded-url","reason":"The fixed HTTPS request retrieves the updated 2025 government calendar for local encoding conversion. No upload, secret access, or downloaded-code execution occurs.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:43:hardcoded-url","reason":"The official DGPA XLSX link supplies a calendar fallback. The surrounding discussion concerns holiday cell colors, not an unrelated network destination.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:46:hardcoded-url","reason":"curl downloads a public calendar workbook over HTTPS from DGPA. It does not upload files, transmit credentials, or execute workbook content.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:51:hardcoded-url","reason":"The HTTP-shaped string is an OpenXML namespace identifier used for local XML element matching. The code makes no network request to it.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:80:hardcoded-url","reason":"The public dataset page is a recovery source for expired calendar attachment links. No instruction sends private data to that page.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:83:hardcoded-url","reason":"The official calendar listing helps locate replacement XLSX attachments. This is task-related source discovery, not an exfiltration endpoint.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:85:hardcoded-url","reason":"The instruction asks users to verify important scheduling decisions against the official DGPA website. It requests no sensitive information or upload.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:22:temp-directory-access","reason":"curl writes to the predictable shared path /tmp/cal115.csv without exclusive creation. A preexisting file or attacker-planted symlink can cause unintended overwrites under the agent's permissions.","verdict":"confirmed","confidence":0.96},{"id":"filesystem:SKILL.md:24:temp-directory-access","reason":"awk only reads the downloaded calendar and prints holiday fields. It does not modify files, execute CSV values, or access unrelated private data.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:26:temp-directory-access","reason":"awk reads the calendar and matches a fixed makeup-workday label after stripping carriage returns. It performs no filesystem writes or data-driven execution.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:34:temp-directory-access","reason":"Shell redirection truncates the predictable shared path /tmp/cal114.csv and follows existing symlinks. A planted link can redirect the write to another writable file.","verdict":"confirmed","confidence":0.98},{"id":"filesystem:SKILL.md:35:temp-directory-access","reason":"The awk command only reads the converted calendar and filters three fixed dates. The unsafe creation of that file is covered by the preceding write finding.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:46:temp-directory-access","reason":"curl writes the workbook to predictable /tmp/cal.xlsx without exclusive creation or a private directory. Existing files or planted symlinks can redirect or suffer overwrites.","verdict":"confirmed","confidence":0.96},{"id":"filesystem:SKILL.md:52:temp-directory-access","reason":"ZipFile opens the previously downloaded workbook in its default read mode. It does not write or extract archive members to the filesystem.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:50:python-archive-libraries","reason":"zipfile and ElementTree parse the XLSX container and XML using standard libraries. The code reads named members without archive extraction or executing workbook content.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:52:python-archive-libraries","reason":"The workbook is opened read-only and two fixed XML members are read. No extract or extractall call exists, so archive paths cannot cause filesystem traversal.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:43:system-reconnaissance","reason":"The line documents a public workbook URL, file size, and spreadsheet styles. No host inventory, process enumeration, or system reconnaissance operation appears.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-70-bits-possible-b","reason":"The file is readable Chinese and English Markdown containing ordinary URLs and parsing examples. No evidence found of binary payloads, encrypted content, or hidden executable code.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"2aab20a3878daa05021884e089a7dd7739e08581","subject_content_hash":"51b07c79e2f135ca07c2aa519aa15854468dabd874832f6dea01a4b7159d8e4b","subject_tree_hash":"b9538bb46fce28271737905bd27f11b14df547bf12d40a205fbe16b8391d2070","subject_plugin_path":"skills/tahodev/taiwan-holidays","audit_payload_hash":"4d0922098475e268f29c382a7c154c38","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"2aab20a3878daa05021884e089a7dd7739e08581","contentHash":"51b07c79e2f135ca07c2aa519aa15854468dabd874832f6dea01a4b7159d8e4b","treeHash":"b9538bb46fce28271737905bd27f11b14df547bf12d40a205fbe16b8391d2070","pluginPath":"skills/tahodev/taiwan-holidays","auditPayloadHash":"4d0922098475e268f29c382a7c154c38"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/tahodev-taiwan-holidays/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}