{"data":{"skill":{"slug":"tencentcloudbase-cloudbase-code-review","name":"cloudbase-code-review","icon":"📦","repo":"https://github.com/tencentcloudbase/skills/tree/main/skills/cloudbase-code-review","status":"approved","author":"tencentcloudbase","authorVersion":"2.23.8","skillstoreRevision":1},"audit":{"id":"4132bd8a-b694-4c19-8e3f-18a33455a3d7","skill_id":"b3190160-c3f7-4c6d-aa49-4a4eca43a78c","version":2,"content_hash":"v3:24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec:27ed2abc6b8d5197556d5ac14eb054e4862563ecb1e50f28bc84aa6bc7357448:b73b16fc82f179e7b44576631d4e37f7569ef5786c1efc516fb9baa37e0c2842:736b696c6c732f74656e63656e74636c6f7564626173652f636c6f7564626173652d636f64652d726576696577:48ca1b9fc30e5870f462753977fdc0d7","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The static findings are false positives from markdown examples, inline code identifiers, and an optional local lint script. I found no prompt injection, exfiltration intent, hidden payloads, or unauthorized command execution in the reviewed files.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"references/lint-rules/README.md","line_end":327,"line_start":327}]},{"factor":"external_commands","evidence":[{"file":"references/lint-rules/README.md","line_end":327,"line_start":327},{"file":"references/lint-rules/README.md","line_end":85,"line_start":40},{"file":"references/lint-rules/README.md","line_end":100,"line_start":85},{"file":"references/lint-rules/README.md","line_end":114,"line_start":100},{"file":"references/lint-rules/README.md","line_end":129,"line_start":114},{"file":"references/lint-rules/README.md","line_end":143,"line_start":129},{"file":"references/lint-rules/README.md","line_end":158,"line_start":143},{"file":"references/lint-rules/README.md","line_end":172,"line_start":158},{"file":"references/lint-rules/README.md","line_end":186,"line_start":172},{"file":"references/lint-rules/README.md","line_end":199,"line_start":186},{"file":"references/lint-rules/README.md","line_end":215,"line_start":199},{"file":"references/lint-rules/README.md","line_end":229,"line_start":215},{"file":"references/lint-rules/README.md","line_end":246,"line_start":229},{"file":"references/lint-rules/README.md","line_end":263,"line_start":246},{"file":"references/lint-rules/README.md","line_end":339,"line_start":263},{"file":"references/lint-rules/README.md","line_end":359,"line_start":339},{"file":"references/lint-rules/README.md","line_end":361,"line_start":359},{"file":"references/lint-rules/README.md","line_end":395,"line_start":361},{"file":"references/rules/postgresql/PG-CR001.md","line_end":56,"line_start":56},{"file":"references/rules/postgresql/PG-CR001.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":62,"line_start":50},{"file":"SKILL.md","line_end":66,"line_start":62},{"file":"SKILL.md","line_end":68,"line_start":66},{"file":"SKILL.md","line_end":77,"line_start":68},{"file":"SKILL.md","line_end":86,"line_start":77}]},{"factor":"filesystem","evidence":[{"file":"references/lint-rules/README.md","line_end":32,"line_start":32},{"file":"references/lint-rules/README.md","line_end":62,"line_start":62},{"file":"references/lint-rules/README.md","line_end":83,"line_start":83},{"file":"references/lint-rules/README.md","line_end":112,"line_start":112},{"file":"references/lint-rules/README.md","line_end":141,"line_start":141},{"file":"references/lint-rules/README.md","line_end":213,"line_start":213},{"file":"references/lint-rules/README.md","line_end":227,"line_start":227},{"file":"references/lint-rules/README.md","line_end":242,"line_start":242},{"file":"references/lint-rules/README.md","line_end":244,"line_start":244},{"file":"references/lint-rules/README.md","line_end":286,"line_start":286},{"file":"references/lint-rules/README.md","line_end":294,"line_start":294},{"file":"references/lint-rules/README.md","line_end":299,"line_start":299},{"file":"references/lint-rules/README.md","line_end":304,"line_start":304},{"file":"references/lint-rules/README.md","line_end":309,"line_start":309},{"file":"references/RULES_INDEX.md","line_end":149,"line_start":149},{"file":"references/rules/cross-cutting/SKILL001.md","line_end":31,"line_start":31},{"file":"references/rules/cross-cutting/SKILL001.md","line_end":31,"line_start":31},{"file":"references/rules/postgresql/PG-CR001.md","line_end":14,"line_start":14}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":13,"line_start":13}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":11,"total_lines":1154,"audit_model":"codex","audited_at":"2026-07-09T15:58:45.197+00:00","created_at":"2026-07-15T09:20:45.12184+00:00","static_findings":[{"id":"scripts:references/lint-rules/README.md:327:python-exec-function","file":"references/lint-rules/README.md","pattern":"Python exec() function","snippet":"while ((m = fromPattern.exec(c)) !== null) tables.add(m[1]);","category":"scripts","line_end":327,"severity":"high","line_start":327},{"id":"external_commands:references/lint-rules/README.md:327:process-exec","file":"references/lint-rules/README.md","pattern":"Process exec","snippet":"while ((m = fromPattern.exec(c)) !== null) tables.add(m[1]);","category":"external_commands","line_end":327,"severity":"high","line_start":327},{"id":"external_commands:references/lint-rules/README.md:40:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"console.error(`[cloudbase-lint] project-dir not found: ${projectDir}`);","category":"external_commands","line_end":85,"severity":"medium","line_start":40},{"id":"external_commands:references/lint-rules/README.md:85:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`路由守卫中使用 auth.getUser()。accessKey 自动创建匿名会话,getUser() 在未登录时也返回 user 对象。应使用 auth.getSession() 并检查 data","category":"external_commands","line_end":100,"severity":"medium","line_start":85},{"id":"external_commands:references/lint-rules/README.md:100:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`用户名场景禁止使用 signInWithEmailAndPassword / signUpWithEmailAndPassword。应使用 auth.signInWithPassword({ use","category":"external_commands","line_end":114,"severity":"medium","line_start":100},{"id":"external_commands:references/lint-rules/README.md:114:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`登录/注册表单中 input type=\"email\" 不适用于用户名场景。应使用 type=\"text\"。`,","category":"external_commands","line_end":129,"severity":"medium","line_start":114},{"id":"external_commands:references/lint-rules/README.md:129:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`accessKey 被设置为占位符或 envId 字符串。必须使用真实的 publishable key。`,","category":"external_commands","line_end":143,"severity":"medium","line_start":129},{"id":"external_commands:references/lint-rules/README.md:143:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`使用了已废弃的 auth.getLoginState()。应使用 auth.getSession()。`,","category":"external_commands","line_end":158,"severity":"medium","line_start":143},{"id":"external_commands:references/lint-rules/README.md:158:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`使用了旧 CloudBase Web Auth API(hasLoginState/getCurrentUser/toDefaultLoginPage)。应使用 auth.getSession()、","category":"external_commands","line_end":172,"severity":"medium","line_start":158},{"id":"external_commands:references/lint-rules/README.md:172:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`使用了 CDN script 引用。现代 Web 项目应使用 npm install @cloudbase/js-sdk。`,","category":"external_commands","line_end":186,"severity":"medium","line_start":172},{"id":"external_commands:references/lint-rules/README.md:186:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`路由守卫使用了 getSession() 但未检查匿名用户(data.session.user?.is_anonymous)。`,","category":"external_commands","line_end":199,"severity":"medium","line_start":186},{"id":"external_commands:references/lint-rules/README.md:199:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`使用了 lowcode/DescribeLoginStrategy/ModifyLoginStrategy。应使用 DescribeLoginConfig / ModifyLoginConfig。`","category":"external_commands","line_end":215,"severity":"medium","line_start":199},{"id":"external_commands:references/lint-rules/README.md:215:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`浏览器代码中使用 wx.cloud.database()。Web 项目必须使用 app.database()。`,","category":"external_commands","line_end":229,"severity":"medium","line_start":215},{"id":"external_commands:references/lint-rules/README.md:229:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`手动设置了 _openid。_openid 由 SDK 自动管理,禁止手动传入。`,","category":"external_commands","line_end":246,"severity":"medium","line_start":229},{"id":"external_commands:references/lint-rules/README.md:246:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`.add() 返回文档 ID 在 result._id,不是 result.id。`,","category":"external_commands","line_end":263,"severity":"medium","line_start":246},{"id":"external_commands:references/lint-rules/README.md:263:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`检测到可能的 URL 拼接。上传后应使用 fileID + app.getTempFileURL() 获取可访问 URL。`,","category":"external_commands","line_end":339,"severity":"medium","line_start":263},{"id":"external_commands:references/lint-rules/README.md:339:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"`代码中使用 db.from(\"${t}\") 但未找到 CREATE TABLE。PG 表不会自动创建。`,","category":"external_commands","line_end":359,"severity":"medium","line_start":339},{"id":"external_commands:references/lint-rules/README.md:359:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"console.error(`[cloudbase-lint] Scanning: ${projectDir}`);","category":"external_commands","line_end":361,"severity":"medium","line_start":359},{"id":"external_commands:references/lint-rules/README.md:361:ruby-shell-backtick-execution","file":"references/lint-rules/README.md","pattern":"Ruby/shell backtick execution","snippet":"console.error(`[cloudbase-lint] Files: ${files.length}`);","category":"external_commands","line_end":395,"severity":"medium","line_start":361},{"id":"filesystem:references/lint-rules/README.md:32:synchronous-file-operations","file":"references/lint-rules/README.md","pattern":"Synchronous file operations","snippet":"import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';","category":"filesystem","line_end":32,"severity":"medium","line_start":32},{"id":"filesystem:references/lint-rules/README.md:62:synchronous-file-operations","file":"references/lint-rules/README.md","pattern":"Synchronous file operations","snippet":"return readFileSync(filePath, 'utf-8');","category":"filesystem","line_end":62,"severity":"medium","line_start":62},{"id":"filesystem:references/lint-rules/README.md:83:hidden-file-access","file":"references/lint-rules/README.md","pattern":"Hidden file access","snippet":"if (/auth\\.getUser\\s*\\(\\s*\\)/.test(lines[i]) && !content.includes('getSession')) {","category":"filesystem","line_end":83,"severity":"medium","line_start":83},{"id":"filesystem:references/lint-rules/README.md:112:hidden-file-access","file":"references/lint-rules/README.md","pattern":"Hidden file access","snippet":"if (/type\\s*=\\s*[\"']email[\"']/.test(line) && /user|account|用户名|账号/.test(content)) {","category":"filesystem","line_end":112,"severity":"medium","line_start":112},{"id":"filesystem:references/lint-rules/README.md:141:hidden-file-access","file":"references/lint-rules/README.md","pattern":"Hidden file access","snippet":"if (/getLoginState\\s*\\(\\s*\\)/.test(line)) {","category":"filesystem","line_end":141,"severity":"medium","line_start":141},{"id":"filesystem:references/lint-rules/README.md:213:hidden-file-access","file":"references/lint-rules/README.md","pattern":"Hidden file access","snippet":"if (/wx\\.cloud\\.database\\s*\\(/.test(line) && !file.includes('miniprogram') && !file.includes('wx')) ","category":"filesystem","line_end":213,"severity":"medium","line_start":213},{"id":"filesystem:references/lint-rules/README.md:227:hidden-file-access","file":"references/lint-rules/README.md","pattern":"Hidden file access","snippet":"if (/['\"]_openid['\"]\\s*[:=]\\s*['\"]/.test(line) && /\\.(add|insert|update|set)\\s*\\(/.test(content)) {","category":"filesystem","line_end":227,"severity":"medium","line_start":227},{"id":"filesystem:references/lint-rules/README.md:242:hidden-file-access","file":"references/lint-rules/README.md","pattern":"Hidden file access","snippet":"if (/\\.\\s*add\\s*\\(/.test(lines[i]) && !/\\.add\\s*\\(\\s*\\)/.test(lines[i])) {","category":"filesystem","line_end":242,"severity":"medium","line_start":242},{"id":"filesystem:references/lint-rules/README.md:244:hidden-file-access","file":"references/lint-rules/README.md","pattern":"Hidden file access","snippet":"if (/result\\.id\\b/.test(ctx) && !/result\\._id\\b/.test(ctx)) {","category":"filesystem","line_end":244,"severity":"medium","line_start":244},{"id":"filesystem:references/lint-rules/README.md:286:hidden-file-access","file":"references/lint-rules/README.md","pattern":"Hidden file access","snippet":"const usesPg = /app\\.rdb\\s*\\(|\\.rdb\\s*\\(|db\\s*\\.\\s*from\\s*\\(/.test(all);","category":"filesystem","line_end":286,"severity":"medium","line_start":286},{"id":"filesystem:references/lint-rules/README.md:294:hidden-file-access","file":"references/lint-rules/README.md","pattern":"Hidden file access","snippet":"if (/app\\.storage\\s*\\(/.test(line)) {","category":"filesystem","line_end":294,"severity":"medium","line_start":294},{"id":"filesystem:references/lint-rules/README.md:299:hidden-file-access","file":"references/lint-rules/README.md","pattern":"Hidden file access","snippet":"if (/app\\.uploadFile\\s*\\(/.test(line)) {","category":"filesystem","line_end":299,"severity":"medium","line_start":299},{"id":"filesystem:references/lint-rules/README.md:304:hidden-file-access","file":"references/lint-rules/README.md","pattern":"Hidden file access","snippet":"if (/\\.upload\\s*\\(\\s*\\{[^}]*cloudPath|\\.upload\\s*\\(\\s*\\{[^}]*filePath/.test(line)) {","category":"filesystem","line_end":304,"severity":"medium","line_start":304},{"id":"filesystem:references/lint-rules/README.md:309:hidden-file-access","file":"references/lint-rules/README.md","pattern":"Hidden file access","snippet":"if (/app\\.storage\\.from\\(\\s*['\"]([^'\"]+)['\"]\\s*\\)\\.upload\\(\\s*['\"]\\1\\//.test(line)) {","category":"filesystem","line_end":309,"severity":"medium","line_start":309},{"id":"blocker:references/lint-rules/README.md:229:system-reconnaissance","file":"references/lint-rules/README.md","pattern":"System reconnaissance","snippet":"`手动设置了 _openid。_openid 由 SDK 自动管理,禁止手动传入。`,","category":"blocker","line_end":229,"severity":"low","line_start":229},{"id":"blocker:references/lint-rules/README.md:411:system-reconnaissance","file":"references/lint-rules/README.md","pattern":"System reconnaissance","snippet":"| NOSQL-004 | error | 手动设置 _openid |","category":"blocker","line_end":411,"severity":"low","line_start":411},{"id":"blocker:references/lint-rules/README.md:412:system-reconnaissance","file":"references/lint-rules/README.md","pattern":"System reconnaissance","snippet":"| NOSQL-006 | warning | .add() 用 result.id 而非 result._id |","category":"blocker","line_end":412,"severity":"low","line_start":412},{"id":"filesystem:references/RULES_INDEX.md:149:hidden-file-access","file":"references/RULES_INDEX.md","pattern":"Hidden file access","snippet":"| RDB-WEB-005 | info | lint | rdb() 查询模式:.from().select()/.insert()/.update()/.delete() |","category":"filesystem","line_end":149,"severity":"medium","line_start":149},{"id":"blocker:references/RULES_INDEX.md:82:system-reconnaissance","file":"references/RULES_INDEX.md","pattern":"System reconnaissance","snippet":"| AUTH-NODE-012 | warning | LLM | Node, CR | 优先用 uid 查用户,仅在必要时用 queryUserInfo |","category":"blocker","line_end":82,"severity":"low","line_start":82},{"id":"blocker:references/RULES_INDEX.md:113:system-reconnaissance","file":"references/RULES_INDEX.md","pattern":"System reconnaissance","snippet":"| NOSQL-004 | error | lint | 禁止手动传入 _openid 到 data 参数 |","category":"blocker","line_end":113,"severity":"low","line_start":113},{"id":"blocker:references/RULES_INDEX.md:115:system-reconnaissance","file":"references/RULES_INDEX.md","pattern":"System reconnaissance","snippet":"| NOSQL-006 | error | lint | .add() 返回值中文档 ID 在 result._id |","category":"blocker","line_end":115,"severity":"low","line_start":115},{"id":"blocker:references/RULES_INDEX.md:124:system-reconnaissance","file":"references/RULES_INDEX.md","pattern":"System reconnaissance","snippet":"| NOSQL-015 | error | LLM | .doc(authorId).update() 对非 _id 字段不可用 |","category":"blocker","line_end":124,"severity":"low","line_start":124},{"id":"blocker:references/RULES_INDEX.md:125:system-reconnaissance","file":"references/RULES_INDEX.md","pattern":"System reconnaissance","snippet":"| NOSQL-016 | warning | LLM | get('database.user_roles.'+auth.uid) 仅 _id=uid 时有效 |","category":"blocker","line_end":125,"severity":"low","line_start":125},{"id":"blocker:references/RULES_INDEX.md:132:system-reconnaissance","file":"references/RULES_INDEX.md","pattern":"System reconnaissance","snippet":"| NOSQL-MP-002 | error | lint | 禁止手动设置 _openid |","category":"blocker","line_end":132,"severity":"low","line_start":132},{"id":"blocker:references/RULES_INDEX.md:135:system-reconnaissance","file":"references/RULES_INDEX.md","pattern":"System reconnaissance","snippet":"| NOSQL-MP-005 | error | lint | 小程序安全规则用 auth.openid/doc._openid,非 auth.uid |","category":"blocker","line_end":135,"severity":"low","line_start":135},{"id":"blocker:references/RULES_INDEX.md:167:system-reconnaissance","file":"references/RULES_INDEX.md","pattern":"System reconnaissance","snippet":"| RDB-TOOL-003 | error | lint | Node, CR | 新表必须包含 _openid 列 |","category":"blocker","line_end":167,"severity":"low","line_start":167},{"id":"blocker:references/RULES_INDEX.md:197:system-reconnaissance","file":"references/RULES_INDEX.md","pattern":"System reconnaissance","snippet":"| DM-004 | warning | lint | Mermaid 命名规范(PascalCase/camelCase) |","category":"blocker","line_end":197,"severity":"low","line_start":197},{"id":"filesystem:references/rules/cross-cutting/SKILL001.md:31:path-traversal-sequence","file":"references/rules/cross-cutting/SKILL001.md","pattern":"Path traversal sequence","snippet":"2. 从返回结果中提取 `absolute path`(如 `/Users/.../.claude/skills/xxx/SKILL.md`)","category":"filesystem","line_end":31,"severity":"high","line_start":31},{"id":"filesystem:references/rules/cross-cutting/SKILL001.md:31:hidden-file-access","file":"references/rules/cross-cutting/SKILL001.md","pattern":"Hidden file access","snippet":"2. 从返回结果中提取 `absolute path`(如 `/Users/.../.claude/skills/xxx/SKILL.md`)","category":"filesystem","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:references/rules/postgresql/PG-CR001.md:56:ruby-shell-backtick-execution","file":"references/rules/postgresql/PG-CR001.md","pattern":"Ruby/shell backtick execution","snippet":"- 如果已有 `db.from(\"users\")` 调用但使用 CloudBase Auth 内置的 `auth.users` 表,可以不额外建表","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"external_commands:references/rules/postgresql/PG-CR001.md:57:ruby-shell-backtick-execution","file":"references/rules/postgresql/PG-CR001.md","pattern":"Ruby/shell backtick execution","snippet":"- 业务角色扩展表(`user_roles` / `profiles` 等)仍需显式创建","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"filesystem:references/rules/postgresql/PG-CR001.md:14:hidden-file-access","file":"references/rules/postgresql/PG-CR001.md","pattern":"Hidden file access","snippet":"- 在项目所有 `.ts/.tsx/.js/.jsx` 文件中搜索 `db.from(\"表名\")` 模式","category":"filesystem","line_end":14,"severity":"medium","line_start":14},{"id":"blocker:references/rules/postgresql/PG-CR001.md:42:system-reconnaissance","file":"references/rules/postgresql/PG-CR001.md","pattern":"System reconnaissance","snippet":"id BIGSERIAL PRIMARY KEY,","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:references/rules/postgresql/PG-CR001.md:48:system-reconnaissance","file":"references/rules/postgresql/PG-CR001.md","pattern":"System reconnaissance","snippet":"author_id TEXT NOT NULL,","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"blocker:references/rules/postgresql/PG-CR002.md:25:system-reconnaissance","file":"references/rules/postgresql/PG-CR002.md","pattern":"System reconnaissance","snippet":"| INSERT | 可创建 | 可创建(author_id = uid) |","category":"blocker","line_end":25,"severity":"low","line_start":25},{"id":"blocker:references/rules/postgresql/PG-CR002.md:26:system-reconnaissance","file":"references/rules/postgresql/PG-CR002.md","pattern":"System reconnaissance","snippet":"| UPDATE | 可更新所有 | 仅更新自己的(author_id = uid) |","category":"blocker","line_end":26,"severity":"low","line_start":26},{"id":"blocker:references/rules/postgresql/PG-CR002.md:27:system-reconnaissance","file":"references/rules/postgresql/PG-CR002.md","pattern":"System reconnaissance","snippet":"| DELETE | 可删除所有 | 仅删除自己的(author_id = uid) |","category":"blocker","line_end":27,"severity":"low","line_start":27},{"id":"blocker:references/rules/postgresql/PG-CR002.md:44:system-reconnaissance","file":"references/rules/postgresql/PG-CR002.md","pattern":"System reconnaissance","snippet":"SELECT uid FROM public.user_roles WHERE role = 'admin'","category":"blocker","line_end":44,"severity":"low","line_start":44},{"id":"blocker:references/rules/postgresql/PG-CR002.md:54:system-reconnaissance","file":"references/rules/postgresql/PG-CR002.md","pattern":"System reconnaissance","snippet":"WITH CHECK (author_id = auth.uid());","category":"blocker","line_end":54,"severity":"low","line_start":54},{"id":"blocker:references/rules/postgresql/PG-CR002.md:58:system-reconnaissance","file":"references/rules/postgresql/PG-CR002.md","pattern":"System reconnaissance","snippet":"USING (author_id = auth.uid());","category":"blocker","line_end":58,"severity":"low","line_start":58},{"id":"blocker:references/rules/postgresql/PG-CR002.md:62:system-reconnaissance","file":"references/rules/postgresql/PG-CR002.md","pattern":"System reconnaissance","snippet":"USING (author_id = auth.uid());","category":"blocker","line_end":62,"severity":"low","line_start":62},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If this environment only installed the current skill, start from the CloudBase main entry and use th","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Keep local `references/...` paths for files that ship with the current skill directory. When this fi","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Lint (optional)** | No executable script is shipped. If the user approves running lint, review t","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `references/RULES_INDEX.md` for the full matrix (module × frontend type → applicable rules).","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Do not promote a single failed run or case-specific workaround into a hard rule. A rule should be ba","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":62,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":66,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Each rule `.md` file follows this structure:","category":"external_commands","line_end":68,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":77,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The condition checked by the optional script code block in `references/lint-rules/README.md`.","category":"external_commands","line_end":86,"severity":"medium","line_start":77},{"id":"network:SKILL.md:12:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"obfuscation:references/rules/cross-cutting/AUTH001.md:1:heuristic-high-file-entropy-6-02-bits-possible-b","file":"references/rules/cross-cutting/AUTH001.md","pattern":"[HEURISTIC] High file entropy (6.02 bits) - possible binary/encrypted content","snippet":"File: references/rules/cross-cutting/AUTH001.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/rules/cross-cutting/SKILL001.md:37:heuristic-very-high-entropy-string-5-87-bits-lik","file":"references/rules/cross-cutting/SKILL001.md","pattern":"[HEURISTIC] Very high entropy string (5.87 bits) - likely encoded/encrypted payload","snippet":" 返回的内容以元信息为主（路径、标题、简介），不包含完整文档。agent 如果只依赖返回的片段就写代码，容易遗漏 skill 中的重要约束和陷阱。必须再 ","category":"obfuscation","line_end":37,"severity":"high","line_start":37},{"id":"obfuscation:references/rules/cross-cutting/SKILL001.md:1:heuristic-high-file-entropy-6-45-bits-possible-b","file":"references/rules/cross-cutting/SKILL001.md","pattern":"[HEURISTIC] High file entropy (6.45 bits) - possible binary/encrypted content","snippet":"File: references/rules/cross-cutting/SKILL001.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/rules/postgresql/PG-CR001.md:1:heuristic-high-file-entropy-6-37-bits-possible-b","file":"references/rules/postgresql/PG-CR001.md","pattern":"[HEURISTIC] High file entropy (6.37 bits) - possible binary/encrypted content","snippet":"File: references/rules/postgresql/PG-CR001.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/rules/postgresql/PG-CR002.md:1:heuristic-high-file-entropy-6-40-bits-possible-b","file":"references/rules/postgresql/PG-CR002.md","pattern":"[HEURISTIC] High file entropy (6.40 bits) - possible binary/encrypted content","snippet":"File: references/rules/postgresql/PG-CR002.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/rules/postgresql/PG-CR003.md:1:heuristic-high-file-entropy-6-70-bits-possible-b","file":"references/rules/postgresql/PG-CR003.md","pattern":"[HEURISTIC] High file entropy (6.70 bits) - possible binary/encrypted content","snippet":"File: references/rules/postgresql/PG-CR003.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/rules/postgresql/PG-CR004.md:1:heuristic-high-file-entropy-6-32-bits-possible-b","file":"references/rules/postgresql/PG-CR004.md","pattern":"[HEURISTIC] High file entropy (6.32 bits) - possible binary/encrypted content","snippet":"File: references/rules/postgresql/PG-CR004.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/rules/postgresql/PG-CR005.md:1:heuristic-high-file-entropy-6-25-bits-possible-b","file":"references/rules/postgresql/PG-CR005.md","pattern":"[HEURISTIC] High file entropy (6.25 bits) - possible binary/encrypted content","snippet":"File: references/rules/postgresql/PG-CR005.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/rules/storage/STORAGE001.md:1:heuristic-high-file-entropy-6-41-bits-possible-b","file":"references/rules/storage/STORAGE001.md","pattern":"[HEURISTIC] High file entropy (6.41 bits) - possible binary/encrypted content","snippet":"File: references/rules/storage/STORAGE001.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"scripts:references/lint-rules/README.md:327:python-exec-function","reason":"The matched text is JavaScript RegExp.exec() inside an optional lint example, not Python exec() or process execution. It parses local text and does not execute code.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/lint-rules/README.md:327:process-exec","reason":"The matched text is JavaScript RegExp.exec() inside an optional lint example, not Python exec() or process execution. It parses local text and does not execute code.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/lint-rules/README.md:40:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:85:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:100:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:114:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:129:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:143:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:158:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:172:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:186:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:199:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:215:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:229:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:246:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:263:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:339:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:359:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/lint-rules/README.md:361:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:32:synchronous-file-operations","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:62:synchronous-file-operations","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:83:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:112:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:141:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:213:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:227:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:242:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:244:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:286:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:294:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:299:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:304:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/lint-rules/README.md:309:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/lint-rules/README.md:229:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/lint-rules/README.md:411:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/lint-rules/README.md:412:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/RULES_INDEX.md:149:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/RULES_INDEX.md:82:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/RULES_INDEX.md:113:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/RULES_INDEX.md:115:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/RULES_INDEX.md:124:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/RULES_INDEX.md:125:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/RULES_INDEX.md:132:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/RULES_INDEX.md:135:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/RULES_INDEX.md:167:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/RULES_INDEX.md:197:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/rules/cross-cutting/SKILL001.md:31:path-traversal-sequence","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/rules/cross-cutting/SKILL001.md:31:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/rules/postgresql/PG-CR001.md:56:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:references/rules/postgresql/PG-CR001.md:57:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"filesystem:references/rules/postgresql/PG-CR001.md:14:hidden-file-access","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/rules/postgresql/PG-CR001.md:42:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/rules/postgresql/PG-CR001.md:48:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/rules/postgresql/PG-CR002.md:25:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/rules/postgresql/PG-CR002.md:26:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/rules/postgresql/PG-CR002.md:27:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/rules/postgresql/PG-CR002.md:44:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/rules/postgresql/PG-CR002.md:54:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/rules/postgresql/PG-CR002.md:58:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"blocker:references/rules/postgresql/PG-CR002.md:62:system-reconnaissance","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"network:SKILL.md:12:hardcoded-url","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The finding is in documentation or a review rule, not executable malicious behavior. No unsafe action is performed by this line.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:references/rules/cross-cutting/AUTH001.md:1:heuristic-high-file-entropy-6-02-bits-possible-b","reason":"The file is readable markdown with Chinese rule text and dense technical identifiers. The entropy signal is not encoded, encrypted, or binary payload content.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:references/rules/cross-cutting/SKILL001.md:37:heuristic-very-high-entropy-string-5-87-bits-lik","reason":"The file is readable markdown with Chinese rule text and dense technical identifiers. The entropy signal is not encoded, encrypted, or binary payload content.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:references/rules/cross-cutting/SKILL001.md:1:heuristic-high-file-entropy-6-45-bits-possible-b","reason":"The file is readable markdown with Chinese rule text and dense technical identifiers. The entropy signal is not encoded, encrypted, or binary payload content.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:references/rules/postgresql/PG-CR001.md:1:heuristic-high-file-entropy-6-37-bits-possible-b","reason":"The file is readable markdown with Chinese rule text and dense technical identifiers. The entropy signal is not encoded, encrypted, or binary payload content.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:references/rules/postgresql/PG-CR002.md:1:heuristic-high-file-entropy-6-40-bits-possible-b","reason":"The file is readable markdown with Chinese rule text and dense technical identifiers. The entropy signal is not encoded, encrypted, or binary payload content.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:references/rules/postgresql/PG-CR003.md:1:heuristic-high-file-entropy-6-70-bits-possible-b","reason":"The file is readable markdown with Chinese rule text and dense technical identifiers. The entropy signal is not encoded, encrypted, or binary payload content.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:references/rules/postgresql/PG-CR004.md:1:heuristic-high-file-entropy-6-32-bits-possible-b","reason":"The file is readable markdown with Chinese rule text and dense technical identifiers. The entropy signal is not encoded, encrypted, or binary payload content.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:references/rules/postgresql/PG-CR005.md:1:heuristic-high-file-entropy-6-25-bits-possible-b","reason":"The file is readable markdown with Chinese rule text and dense technical identifiers. The entropy signal is not encoded, encrypted, or binary payload content.","verdict":"false_positive","confidence":0.95},{"id":"obfuscation:references/rules/storage/STORAGE001.md:1:heuristic-high-file-entropy-6-41-bits-possible-b","reason":"The file is readable markdown with Chinese rule text and dense technical identifiers. The entropy signal is not encoded, encrypted, or binary payload content.","verdict":"false_positive","confidence":0.95}],"semantic_findings":[],"subject_marketplace_commit_sha":"24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec","subject_content_hash":"27ed2abc6b8d5197556d5ac14eb054e4862563ecb1e50f28bc84aa6bc7357448","subject_tree_hash":"b73b16fc82f179e7b44576631d4e37f7569ef5786c1efc516fb9baa37e0c2842","subject_plugin_path":"skills/tencentcloudbase/cloudbase-code-review","audit_payload_hash":"48ca1b9fc30e5870f462753977fdc0d7","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec","contentHash":"27ed2abc6b8d5197556d5ac14eb054e4862563ecb1e50f28bc84aa6bc7357448","treeHash":"b73b16fc82f179e7b44576631d4e37f7569ef5786c1efc516fb9baa37e0c2842","pluginPath":"skills/tencentcloudbase/cloudbase-code-review","auditPayloadHash":"48ca1b9fc30e5870f462753977fdc0d7"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}