{"data":{"skill":{"slug":"tencentcloudbase-auth-wechat-miniprogram","name":"auth-wechat-miniprogram","icon":"📦","repo":"https://github.com/tencentcloudbase/skills/tree/main/skills/auth-wechat","status":"approved","author":"tencentcloudbase","authorVersion":"2.23.8","skillstoreRevision":1},"audit":{"id":"94bc2e52-4170-4a84-a272-caf6cdfdca6a","skill_id":"427f64b3-2f41-4c98-81c9-899ae19a51a5","version":2,"content_hash":"v3:24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec:6dbc2b788aaa970b9b05d30669eb07277d2b59f8977ed141e7e7861e70495b51:bc7cc00dc93a089cbd8f2398e0ea09d7f09812b89d3dba93f2bee31f6d69fbcb:736b696c6c732f74656e63656e74636c6f7564626173652f617574682d7765636861742d6d696e6970726f6772616d:79331e82d5b4f38ae451c4ea4cd5d550","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Static detections are false positives caused by Markdown inline code, fenced JavaScript examples, reference URLs, and sibling skill paths. The review found two medium-risk content issues: an authorization example that relies on client-supplied owner data and examples that log sensitive identifiers.","remediation":[{"issue":"Authorization example uses client-supplied owner data.","severity":"medium","suggestion":"Revise the example to fetch the resource owner from server-side storage and compare that value to verified OPENID."},{"issue":"Examples log OPENID, UNIONID, and auth user objects.","severity":"medium","suggestion":"Mask identifiers in examples and state that full identity logs should be limited to local debugging."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":114,"line_start":114},{"file":"SKILL.md","line_end":129,"line_start":129},{"file":"SKILL.md","line_end":142,"line_start":131},{"file":"SKILL.md","line_end":146,"line_start":142},{"file":"SKILL.md","line_end":147,"line_start":146},{"file":"SKILL.md","line_end":148,"line_start":147},{"file":"SKILL.md","line_end":156,"line_start":148},{"file":"SKILL.md","line_end":180,"line_start":156},{"file":"SKILL.md","line_end":184,"line_start":180},{"file":"SKILL.md","line_end":185,"line_start":184},{"file":"SKILL.md","line_end":186,"line_start":185},{"file":"SKILL.md","line_end":187,"line_start":186},{"file":"SKILL.md","line_end":191,"line_start":187},{"file":"SKILL.md","line_end":195,"line_start":191},{"file":"SKILL.md","line_end":196,"line_start":195},{"file":"SKILL.md","line_end":197,"line_start":196},{"file":"SKILL.md","line_end":198,"line_start":197},{"file":"SKILL.md","line_end":206,"line_start":198},{"file":"SKILL.md","line_end":232,"line_start":206},{"file":"SKILL.md","line_end":236,"line_start":232},{"file":"SKILL.md","line_end":247,"line_start":236},{"file":"SKILL.md","line_end":271,"line_start":247},{"file":"SKILL.md","line_end":275,"line_start":271},{"file":"SKILL.md","line_end":313,"line_start":275},{"file":"SKILL.md","line_end":319,"line_start":313},{"file":"SKILL.md","line_end":320,"line_start":319},{"file":"SKILL.md","line_end":329,"line_start":320},{"file":"SKILL.md","line_end":333,"line_start":329},{"file":"SKILL.md","line_end":339,"line_start":333},{"file":"SKILL.md","line_end":341,"line_start":339},{"file":"SKILL.md","line_end":345,"line_start":341},{"file":"SKILL.md","line_end":355,"line_start":345},{"file":"SKILL.md","line_end":359,"line_start":355}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Client-Supplied Authorization Boundary","locations":[{"file":"SKILL.md","line_end":436,"line_start":420}],"confidence":0.78,"description":"The authorization example compares verified OPENID to event.resourceOwnerId. In a Mini Program cloud function, event data is client-supplied, so this can teach unsafe ownership checks if used alone.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The code example directly uses event.resourceOwnerId as the authorization boundary. Legitimate use is possible, but auth guidance should derive ownership from server-side data."},{"title":"Sensitive Identifier Logging in Examples","locations":[{"file":"SKILL.md","line_end":169,"line_start":169},{"file":"SKILL.md","line_end":258,"line_start":258},{"file":"SKILL.md","line_end":350,"line_start":350},{"file":"SKILL.md","line_end":453,"line_start":453},{"file":"SKILL.md","line_end":484,"line_start":484},{"file":"SKILL.md","line_end":506,"line_start":506}],"confidence":0.74,"description":"Several examples log OPENID, UNIONID, or auth result objects. These identifiers are sensitive and should be masked or limited to local debugging guidance.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The examples explicitly log user identifiers and auth user objects. The intent appears instructional, but the pattern can expose private identifiers in production logs."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":536,"audit_model":"codex","audited_at":"2026-07-09T15:29:01.958+00:00","created_at":"2026-07-15T09:20:39.986093+00:00","static_findings":[{"id":"external_commands:SKILL.md:3:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"description: CloudBase WeChat Mini Program native authentication guide. This skill should be used wh","category":"external_commands","line_end":3,"severity":"medium","line_start":3},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If this environment only installed the current skill, start from the CloudBase main entry and use th","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Keep local `references/...` paths for files that ship with the current skill directory. When this fi","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- The task is about WeChat Mini Program auth behavior, `wx.cloud` identity, `OPENID` / `UNIONID`, or","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- The request mentions mini program login, user identity in cloud functions, or `wx.cloud` auth assu","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Mini program project implementation -> `../miniprogram-development/SKILL.md` (standalone fallback:","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Cloud function implementation -> `../cloud-functions/SKILL.md` (standalone fallback: `https://cnb.","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Generating a Web-style login page for a `wx.cloud` mini program.","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Key advantage:** WeChat Mini Program authentication with CloudBase is **seamless and automatic** -","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `env` – CloudBase environment ID","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `wx-server-sdk` in cloud functions","category":"external_commands","line_end":87,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `wx.cloud` in Mini Program client code","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `OPENID` – Unique identifier for the user in this specific Mini Program","category":"external_commands","line_end":107,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `APPID` – The Mini Program's App ID","category":"external_commands","line_end":108,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `UNIONID` – (Optional) Unique identifier across all apps under the same WeChat Open Platform accou","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- The `openid`, `appid`, and `unionid` are **verified and trustworthy**","category":"external_commands","line_end":114,"severity":"medium","line_start":114},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use this in your Mini Program's `app.js` or entry point:","category":"external_commands","line_end":129,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":142,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":146,"severity":"medium","line_start":142},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Call `wx.cloud.init()` once when the Mini Program launches","category":"external_commands","line_end":147,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Set `env` to your CloudBase environment ID","category":"external_commands","line_end":148,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `traceUser: true` enables user access tracking in CloudBase console (optional but recommended)","category":"external_commands","line_end":156,"severity":"medium","line_start":148},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":180,"severity":"medium","line_start":156},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":184,"severity":"medium","line_start":180},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `cloud.getWXContext()` to get user identity","category":"external_commands","line_end":185,"severity":"medium","line_start":184},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `OPENID` is always available and uniquely identifies the user","category":"external_commands","line_end":186,"severity":"medium","line_start":185},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `APPID` identifies the Mini Program","category":"external_commands","line_end":187,"severity":"medium","line_start":186},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `UNIONID` is only available when:","category":"external_commands","line_end":191,"severity":"medium","line_start":187},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `cloud.DYNAMIC_CURRENT_ENV` to automatically use the current environment","category":"external_commands","line_end":195,"severity":"medium","line_start":191},{"id":"external_commands:SKILL.md:195:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Store `OPENID` in your database to associate data with users","category":"external_commands","line_end":196,"severity":"medium","line_start":195},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `OPENID` for authorization and access control","category":"external_commands","line_end":197,"severity":"medium","line_start":196},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `UNIONID` when you need to identify users across multiple Mini Programs or Official Accounts","category":"external_commands","line_end":198,"severity":"medium","line_start":197},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Never expose `OPENID` to other users (it's a private identifier)","category":"external_commands","line_end":206,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:206:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":232,"severity":"medium","line_start":206},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":236,"severity":"medium","line_start":232},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `wx.cloud.callFunction()` to call cloud functions","category":"external_commands","line_end":247,"severity":"medium","line_start":236},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":271,"severity":"medium","line_start":247},{"id":"external_commands:SKILL.md:271:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":275,"severity":"medium","line_start":271},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":313,"severity":"medium","line_start":275},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":319,"severity":"medium","line_start":313},{"id":"external_commands:SKILL.md:319:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `OPENID` is always present and verified","category":"external_commands","line_end":320,"severity":"medium","line_start":319},{"id":"external_commands:SKILL.md:320:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `UNIONID` may be undefined if not available","category":"external_commands","line_end":329,"severity":"medium","line_start":320},{"id":"external_commands:SKILL.md:329:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":333,"severity":"medium","line_start":329},{"id":"external_commands:SKILL.md:333:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":339,"severity":"medium","line_start":333},{"id":"external_commands:SKILL.md:339:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `OPENID` as the primary user identifier","category":"external_commands","line_end":341,"severity":"medium","line_start":339},{"id":"external_commands:SKILL.md:341:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Never expose `OPENID` to other users","category":"external_commands","line_end":345,"severity":"medium","line_start":341},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":355,"severity":"medium","line_start":345},{"id":"external_commands:SKILL.md:355:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":359,"severity":"medium","line_start":355},{"id":"external_commands:SKILL.md:359:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `OPENID` to identify and authorize users","category":"external_commands","line_end":360,"severity":"medium","line_start":359},{"id":"external_commands:SKILL.md:360:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Store `OPENID` when you need to associate data with users","category":"external_commands","line_end":361,"severity":"medium","line_start":360},{"id":"external_commands:SKILL.md:361:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `OPENID` in queries to ensure users only access their own data","category":"external_commands","line_end":367,"severity":"medium","line_start":361},{"id":"external_commands:SKILL.md:367:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":382,"severity":"medium","line_start":367},{"id":"external_commands:SKILL.md:382:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":386,"severity":"medium","line_start":382},{"id":"external_commands:SKILL.md:386:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Initialize CloudBase in `app.js` `onLaunch`:","category":"external_commands","line_end":386,"severity":"medium","line_start":386},{"id":"external_commands:SKILL.md:388:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":397,"severity":"medium","line_start":388},{"id":"external_commands:SKILL.md:397:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":405,"severity":"medium","line_start":397},{"id":"external_commands:SKILL.md:405:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":418,"severity":"medium","line_start":405},{"id":"external_commands:SKILL.md:418:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":422,"severity":"medium","line_start":418},{"id":"external_commands:SKILL.md:422:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":437,"severity":"medium","line_start":422},{"id":"external_commands:SKILL.md:437:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":441,"severity":"medium","line_start":437},{"id":"external_commands:SKILL.md:441:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":458,"severity":"medium","line_start":441},{"id":"external_commands:SKILL.md:458:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":464,"severity":"medium","line_start":458},{"id":"external_commands:SKILL.md:464:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If the Mini Program uses `@cloudbase/js-sdk` (Web SDK v3) instead of `wx-server-sdk`, the following ","category":"external_commands","line_end":464,"severity":"medium","line_start":464},{"id":"external_commands:SKILL.md:470:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":489,"severity":"medium","line_start":470},{"id":"external_commands:SKILL.md:489:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":495,"severity":"medium","line_start":489},{"id":"external_commands:SKILL.md:495:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":508,"severity":"medium","line_start":495},{"id":"external_commands:SKILL.md:508:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":511,"severity":"medium","line_start":508},{"id":"external_commands:SKILL.md:511:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- These methods are from `@cloudbase/js-sdk`, **not** `wx-server-sdk` or `wx.cloud`","category":"external_commands","line_end":511,"severity":"medium","line_start":511},{"id":"external_commands:SKILL.md:513:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For the standard `wx.cloud` + cloud function path, use the scenarios above instead","category":"external_commands","line_end":514,"severity":"medium","line_start":513},{"id":"external_commands:SKILL.md:514:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `signInWithPhoneAuth` requires the user to tap a `<button open-type=\"getPhoneNumber\">` in the Mini","category":"external_commands","line_end":514,"severity":"medium","line_start":514},{"id":"external_commands:SKILL.md:523:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **User identity is verified** - `OPENID`, `APPID`, and `UNIONID` are trustworthy","category":"external_commands","line_end":523,"severity":"medium","line_start":523},{"id":"external_commands:SKILL.md:524:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Easy to use** - just call `cloud.getWXContext()` in cloud functions","category":"external_commands","line_end":529,"severity":"medium","line_start":524},{"id":"external_commands:SKILL.md:529:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Initialize CloudBase with `wx.cloud.init()` in Mini Program","category":"external_commands","line_end":530,"severity":"medium","line_start":529},{"id":"external_commands:SKILL.md:530:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `cloud.getWXContext()` to get user identity in cloud functions","category":"external_commands","line_end":531,"severity":"medium","line_start":530},{"id":"external_commands:SKILL.md:531:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `OPENID` for user identification and authorization","category":"external_commands","line_end":532,"severity":"medium","line_start":531},{"id":"network:SKILL.md:12:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:31:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Mini program project implementation -> `../miniprogram-development/SKILL.md` (standalone fallback:","category":"network","line_end":31,"severity":"low","line_start":31},{"id":"network:SKILL.md:32:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Cloud function implementation -> `../cloud-functions/SKILL.md` (standalone fallback: `https://cnb.","category":"network","line_end":32,"severity":"low","line_start":32},{"id":"filesystem:SKILL.md:31:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Mini program project implementation -> `../miniprogram-development/SKILL.md` (standalone fallback:","category":"filesystem","line_end":31,"severity":"high","line_start":31},{"id":"filesystem:SKILL.md:32:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Cloud function implementation -> `../cloud-functions/SKILL.md` (standalone fallback: `https://cnb.","category":"filesystem","line_end":32,"severity":"high","line_start":32},{"id":"blocker:SKILL.md:219:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"// res.result contains { openid, appid, unionid }","category":"blocker","line_end":219,"severity":"low","line_start":219},{"id":"blocker:SKILL.md:223:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"openid: res.result.openid","category":"blocker","line_end":224,"severity":"low","line_start":223}],"finding_verdicts":[{"id":"external_commands:SKILL.md:3:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:156:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:195:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:206:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:271:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:319:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:320:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:329:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:333:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:339:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:341:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:355:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:359:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:360:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:361:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:367:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:382:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:386:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:388:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:397:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:405:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:418:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:422:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:437:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:441:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:458:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:464:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:470:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:489:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:495:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:508:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:511:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:513:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:514:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:523:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:524:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:529:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:530:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:531:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code or fenced JavaScript examples, not Ruby or shell execution. No command is executed by the skill file.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:12:hardcoded-url","reason":"The hardcoded URL is a documented fallback reference to CloudBase skill material, not an executed request. It does not transmit secrets or perform network I/O by itself.","verdict":"false_positive","confidence":0.86},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The hardcoded URL is a documented fallback reference to CloudBase skill material, not an executed request. It does not transmit secrets or perform network I/O by itself.","verdict":"false_positive","confidence":0.86},{"id":"network:SKILL.md:31:hardcoded-url","reason":"The hardcoded URL is a documented fallback reference to CloudBase skill material, not an executed request. It does not transmit secrets or perform network I/O by itself.","verdict":"false_positive","confidence":0.86},{"id":"network:SKILL.md:32:hardcoded-url","reason":"The hardcoded URL is a documented fallback reference to CloudBase skill material, not an executed request. It does not transmit secrets or perform network I/O by itself.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:SKILL.md:31:path-traversal-sequence","reason":"The ../ path is a documented sibling skill reference, not a filesystem read or write operation. It is not constructed from user input.","verdict":"false_positive","confidence":0.93},{"id":"filesystem:SKILL.md:32:path-traversal-sequence","reason":"The ../ path is a documented sibling skill reference, not a filesystem read or write operation. It is not constructed from user input.","verdict":"false_positive","confidence":0.93},{"id":"blocker:SKILL.md:219:system-reconnaissance","reason":"The snippet reads an openid property from a CloudBase result object, not host, process, network, or OS reconnaissance. It does not enumerate local system state.","verdict":"false_positive","confidence":0.95},{"id":"blocker:SKILL.md:223:system-reconnaissance","reason":"The snippet reads an openid property from a CloudBase result object, not host, process, network, or OS reconnaissance. It does not enumerate local system state.","verdict":"false_positive","confidence":0.95}],"semantic_findings":[{"title":"Client-Supplied Authorization Boundary","severity":"medium","locations":[{"file":"SKILL.md","line_end":436,"line_start":420}],"confidence":0.78,"description":"The authorization example compares verified OPENID to event.resourceOwnerId. In a Mini Program cloud function, event data is client-supplied, so this can teach unsafe ownership checks if used alone.","confidence_reasoning":"The code example directly uses event.resourceOwnerId as the authorization boundary. Legitimate use is possible, but auth guidance should derive ownership from server-side data."},{"title":"Sensitive Identifier Logging in Examples","severity":"medium","locations":[{"file":"SKILL.md","line_end":169,"line_start":169},{"file":"SKILL.md","line_end":258,"line_start":258},{"file":"SKILL.md","line_end":350,"line_start":350},{"file":"SKILL.md","line_end":453,"line_start":453},{"file":"SKILL.md","line_end":484,"line_start":484},{"file":"SKILL.md","line_end":506,"line_start":506}],"confidence":0.74,"description":"Several examples log OPENID, UNIONID, or auth result objects. These identifiers are sensitive and should be masked or limited to local debugging guidance.","confidence_reasoning":"The examples explicitly log user identifiers and auth user objects. The intent appears instructional, but the pattern can expose private identifiers in production logs."}],"subject_marketplace_commit_sha":"24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec","subject_content_hash":"6dbc2b788aaa970b9b05d30669eb07277d2b59f8977ed141e7e7861e70495b51","subject_tree_hash":"bc7cc00dc93a089cbd8f2398e0ea09d7f09812b89d3dba93f2bee31f6d69fbcb","subject_plugin_path":"skills/tencentcloudbase/auth-wechat-miniprogram","audit_payload_hash":"79331e82d5b4f38ae451c4ea4cd5d550","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec","contentHash":"6dbc2b788aaa970b9b05d30669eb07277d2b59f8977ed141e7e7861e70495b51","treeHash":"bc7cc00dc93a089cbd8f2398e0ea09d7f09812b89d3dba93f2bee31f6d69fbcb","pluginPath":"skills/tencentcloudbase/auth-wechat-miniprogram","auditPayloadHash":"79331e82d5b4f38ae451c4ea4cd5d550"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}