{"data":{"skill":{"slug":"tahodev-yubin-fee","name":"yubin-fee","icon":"📦","repo":"https://github.com/tahodev/kurashi-skill/tree/09cb7f9eac85f0c85633cce08328a1a57854a94f/yubin-fee","status":"approved","author":"tahodev","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"d7334f7e-a54b-4393-8c7c-c8ce6f9d3c1d","skill_id":"cd983fb0-8101-4402-b36f-b50fe4f02bd6","version":1,"content_hash":"v3:7f17813fb6af1acc7d8fd3fb5f05480f5be52783:0f64c0379042961cc39d2d1a5ef4eb6e9e496e6d6287bf8cfea967e51da6e79c:a5f525274efb800d019aff102f90e3bb2f9b4c4802e513477cd000a306566485:736b696c6c732f7461686f6465762f797562696e2d666565:a33c69283c4a8bb3bb054ca4250a4ea6","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All ten static findings are false positives in this readable, documentation-only skill. URLs cite official Japan Post sources; backticks mark metadata, and the parent-directory path links documentation rather than performing filesystem operations. No evidence found of prompt injection, secret access, data exfiltration, or executable commands.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":145,"line_start":145}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":125,"line_start":125},{"file":"SKILL.md","line_end":141,"line_start":141},{"file":"SKILL.md","line_end":145,"line_start":145}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":136,"line_start":136}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":152,"audit_model":"codex","audited_at":"2026-10-13T04:31:16.197+00:00","created_at":"2026-10-13T19:02:08.53475+00:00","static_findings":[{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 料金は改定される。直近では2024-10-01に手紙・はがきが改定(定形郵便は50g以内110円の一律に統一)、2025-11-01にゆうメール運賃が改定されている。**2026-10-01のゆう","category":"external_commands","line_end":145,"severity":"medium","line_start":145},{"id":"network:SKILL.md:18:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"根拠URL: 手紙(第一種) https://www.post.japanpost.jp/send/domestic/charge/list/one_two.html / はがき https://ww","category":"network","line_end":18,"severity":"low","line_start":18},{"id":"network:SKILL.md:55:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"基本料金・基本運賃に加算する料金。**2026-09-19に公式「オプションサービスの加算料金一覧」( https://www.post.japanpost.jp/send/domestic/char","category":"network","line_end":55,"severity":"low","line_start":55},{"id":"network:SKILL.md:104:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"**2026-10-13に公式ページ( https://www.post.japanpost.jp/send/domestic/charge/list/parcel.html と基本運賃表(東京) h","category":"network","line_end":104,"severity":"low","line_start":104},{"id":"network:SKILL.md:109:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- 重さは25kg以内。25kg超30kg以内は重量ゆうパック(基本運賃+620円、公式: https://www.post.japanpost.jp/service/send/domestic/de","category":"network","line_end":109,"severity":"low","line_start":109},{"id":"network:SKILL.md:125:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **他の都道府県から差し出す場合は運賃が異なる**(例: 大阪発は大阪の基本運賃表を使う)。このスキルに表があるのは東京発だけなので、他の差出地は公式の料金計算( https://www.post","category":"network","line_end":125,"severity":"low","line_start":125},{"id":"network:SKILL.md:141:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **表にないもの(ゆうメール運賃、国際郵便、本人限定受取・内容証明・代金引換など上記以外のオプション)**: 対象外と明示し、公式の料金ページ( https://www.post.japanpos","category":"network","line_end":141,"severity":"low","line_start":141},{"id":"network:SKILL.md:145:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- 料金は改定される。直近では2024-10-01に手紙・はがきが改定(定形郵便は50g以内110円の一律に統一)、2025-11-01にゆうメール運賃が改定されている。**2026-10-01のゆう","category":"network","line_end":145,"severity":"low","line_start":145},{"id":"filesystem:SKILL.md:136:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"共通の取得時チェックリストは [共通レスポンス契約](../docs/response-contract.md) の「取得時の落とし穴チェックリスト」を参照。","category":"filesystem","line_end":136,"severity":"high","line_start":136},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-89-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.89 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"Line 145 uses Markdown backticks around the metadata key effective_until. The surrounding text discusses rate expiry; there is no shell command or Ruby execution.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:18:hardcoded-url","reason":"Line 18 lists official Japan Post source pages for the embedded rate tables. These are reference links, not requests transmitting user data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:55:hardcoded-url","reason":"Line 55 cites the official Japan Post surcharge list with a verification date. No executable request or sensitive payload accompanies the link.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:104:hardcoded-url","reason":"Line 104 cites official Japan Post parcel and Tokyo-origin fare pages as rate-table sources. These documentation links contain no user data or exfiltration instructions.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:109:hardcoded-url","reason":"Line 109 links the official Japan Post heavy-parcel service page to support its weight limit and surcharge. This is a public reference, not an outbound data transfer.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:125:hardcoded-url","reason":"Line 125 directs users to the official Japan Post calculator for origins missing from the embedded table. It prohibits guessing and does not instruct automated submission of personal information.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:141:hardcoded-url","reason":"Line 141 provides an official Japan Post fee-page referral for unsupported services. It contains no credential collection, external payload, or executable network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:145:hardcoded-url","reason":"Line 145 cites an official Japan Post press release explaining a rate revision. The link is supporting documentation, with no data transmission instruction.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:136:path-traversal-sequence","reason":"Line 136 contains a fixed relative Markdown link to a shared documentation checklist. No user-controlled path, filesystem write, or instruction to access sensitive files appears.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-89-bits-possible-b","reason":"The complete file is readable Japanese and English Markdown containing YAML metadata and postage tables. Its multilingual text explains the entropy signal; no encrypted or binary payload appears.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"7f17813fb6af1acc7d8fd3fb5f05480f5be52783","subject_content_hash":"0f64c0379042961cc39d2d1a5ef4eb6e9e496e6d6287bf8cfea967e51da6e79c","subject_tree_hash":"a5f525274efb800d019aff102f90e3bb2f9b4c4802e513477cd000a306566485","subject_plugin_path":"skills/tahodev/yubin-fee","audit_payload_hash":"a33c69283c4a8bb3bb054ca4250a4ea6","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"7f17813fb6af1acc7d8fd3fb5f05480f5be52783","contentHash":"0f64c0379042961cc39d2d1a5ef4eb6e9e496e6d6287bf8cfea967e51da6e79c","treeHash":"a5f525274efb800d019aff102f90e3bb2f9b4c4802e513477cd000a306566485","pluginPath":"skills/tahodev/yubin-fee","auditPayloadHash":"a33c69283c4a8bb3bb054ca4250a4ea6"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/tahodev-yubin-fee/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}