{"data":{"skill":{"slug":"tencentcloudbase-cloudbase-document-database-in-wechat-miniprogram","name":"cloudbase-document-database-in-wechat-miniprogram","icon":"📦","repo":"https://github.com/tencentcloudbase/skills/tree/main/skills/no-sql-wx-mp-sdk","status":"approved","author":"tencentcloudbase","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"6891432c-fa86-4c27-88be-0155047ef73e","skill_id":"24183efe-6edb-47aa-a44a-d156f4f64455","version":1,"content_hash":"v2:24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec:e130bb573f3dcaec49dd60870da5f8e83031b6dd5f2b7ece7f74abd522516650:e3ff4bd6f1367a894b98f4dc5156d06ed577e66458bdc2f425f6246d881aae15:6761fc5294483bc1a0527dd5bc5bf1e3","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"No confirmed malicious behavior was found in the reviewed skill files. The static findings are Markdown examples, JavaScript template strings, fixed documentation links, and CloudBase identity references, not command execution, filesystem abuse, or secret exposure.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"geolocation.md","line_end":315,"line_start":314},{"file":"pagination.md","line_end":141,"line_start":140},{"file":"pagination.md","line_end":142,"line_start":141},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":54,"line_start":54},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":75,"line_start":72},{"file":"SKILL.md","line_end":79,"line_start":75},{"file":"SKILL.md","line_end":83,"line_start":79},{"file":"SKILL.md","line_end":88,"line_start":83},{"file":"SKILL.md","line_end":89,"line_start":88},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":94,"line_start":93},{"file":"SKILL.md","line_end":95,"line_start":94},{"file":"SKILL.md","line_end":96,"line_start":95},{"file":"SKILL.md","line_end":97,"line_start":96},{"file":"SKILL.md","line_end":98,"line_start":97},{"file":"SKILL.md","line_end":103,"line_start":98},{"file":"SKILL.md","line_end":107,"line_start":103},{"file":"SKILL.md","line_end":108,"line_start":107},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":124,"line_start":121},{"file":"SKILL.md","line_end":128,"line_start":124},{"file":"SKILL.md","line_end":131,"line_start":128}]},{"factor":"filesystem","evidence":[{"file":"security-rules.md","line_end":62,"line_start":62},{"file":"security-rules.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":7,"total_lines":2129,"audit_model":"codex","audited_at":"2026-07-09T16:03:01.364+00:00","created_at":"2026-07-09T17:30:23.161933+00:00","static_findings":[{"id":"blocker:aggregation.md:212:system-reconnaissance","file":"aggregation.md","pattern":"System reconnaissance","snippet":"_id: 0  // Exclude _id from output","category":"blocker","line_end":212,"severity":"low","line_start":212},{"id":"blocker:aggregation.md:313:system-reconnaissance","file":"aggregation.md","pattern":"System reconnaissance","snippet":"4. **Avoid large groups**: Very large groups can impact performance","category":"blocker","line_end":313,"severity":"low","line_start":313},{"id":"blocker:complex-queries.md:96:system-reconnaissance","file":"complex-queries.md","pattern":"System reconnaissance","snippet":"_id: false          // Exclude _id","category":"blocker","line_end":97,"severity":"low","line_start":96},{"id":"sensitive:crud-operations.md:403:sqlite-database-file","file":"crud-operations.md","pattern":"SQLite database file","snippet":"this.db = db;","category":"sensitive","line_end":403,"severity":"medium","line_start":403},{"id":"blocker:crud-operations.md:509:system-reconnaissance","file":"crud-operations.md","pattern":"System reconnaissance","snippet":"console.error('Invalid data provided');","category":"blocker","line_end":509,"severity":"low","line_start":509},{"id":"external_commands:geolocation.md:314:ruby-shell-backtick-execution","file":"geolocation.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Distance: ${delivery.distance}m, Fee: $${delivery.fee}`);","category":"external_commands","line_end":315,"severity":"medium","line_start":314},{"id":"external_commands:pagination.md:140:ruby-shell-backtick-execution","file":"pagination.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Page ${result.pagination.currentPage} of ${result.pagination.totalPages}`);","category":"external_commands","line_end":141,"severity":"medium","line_start":140},{"id":"external_commands:pagination.md:141:ruby-shell-backtick-execution","file":"pagination.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Total items: ${result.pagination.totalCount}`);","category":"external_commands","line_end":142,"severity":"medium","line_start":141},{"id":"sensitive:pagination.md:67:certificate-key-files","file":"pagination.md","pattern":"Certificate/key files","snippet":"if (Object.keys(whereConditions).length > 0) {","category":"sensitive","line_end":67,"severity":"high","line_start":67},{"id":"sensitive:pagination.md:107:certificate-key-files","file":"pagination.md","pattern":"Certificate/key files","snippet":"if (Object.keys(whereConditions).length > 0) {","category":"sensitive","line_end":107,"severity":"high","line_start":107},{"id":"filesystem:security-rules.md:62:path-traversal-sequence","file":"security-rules.md","pattern":"Path traversal sequence","snippet":"- For the full rule system and examples, also read `../no-sql-web-sdk/security-rules.md`.","category":"filesystem","line_end":62,"severity":"high","line_start":62},{"id":"filesystem:security-rules.md:63:path-traversal-sequence","file":"security-rules.md","pattern":"Path traversal sequence","snippet":"- For Mini Program identity flow, read `../auth-wechat/SKILL.md`.","category":"filesystem","line_end":63,"severity":"high","line_start":63},{"id":"blocker:security-rules.md:18:system-reconnaissance","file":"security-rules.md","pattern":"System reconnaissance","snippet":"\"read\": \"doc._openid == auth.openid\",","category":"blocker","line_end":18,"severity":"low","line_start":18},{"id":"blocker:security-rules.md:19:system-reconnaissance","file":"security-rules.md","pattern":"System reconnaissance","snippet":"\"write\": \"doc._openid == auth.openid\"","category":"blocker","line_end":19,"severity":"low","line_start":19},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If this environment only installed the current skill, start from the CloudBase main entry and use th","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Keep local `references/...` paths for files that ship with the current skill directory. When this fi","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- A WeChat Mini Program must access CloudBase document database through `wx.cloud.database()`.","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- The request depends on built-in user identity, `_openid`, or Mini Program-side permissions.","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Mini Program project rules and CloudBase integration -> `../miniprogram-development/SKILL.md` (sta","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Mini Program auth and identity flow -> `../auth-wechat/SKILL.md` (standalone fallback: `https://cn","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Browser-side document database code -> `../no-sql-web-sdk/SKILL.md` (standalone fallback: `https:/","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Browser/Web code using `@cloudbase/js-sdk`.","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Manually writing `_openid` during create or update operations.","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Initialize `wx.cloud` correctly before database calls.","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Verify whether the collection rules rely on `auth.openid` / `_openid`.","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"This skill covers **Mini Program-side document database access** through `wx.cloud.database()`.","category":"external_commands","line_end":59,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":75,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":79,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":83,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":88,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- In cloud functions, caller identity is available through `wxContext.OPENID`.","category":"external_commands","line_end":89,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- In client-side collection rules, ownership checks usually use `auth.openid` / `doc._openid`.","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- CRUD -> `./crud-operations.md`","category":"external_commands","line_end":94,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Complex queries -> `./complex-queries.md`","category":"external_commands","line_end":95,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Pagination -> `./pagination.md`","category":"external_commands","line_end":96,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Aggregation -> `./aggregation.md`","category":"external_commands","line_end":97,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Geolocation -> `./geolocation.md`","category":"external_commands","line_end":98,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Security rules -> `./security-rules.md`","category":"external_commands","line_end":103,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `wx.cloud.database()`.","category":"external_commands","line_end":107,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `_openid` is system-managed for SDK writes.","category":"external_commands","line_end":108,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Never set or override `_openid` manually in `.add()`, `.set()`, or `.update()` payloads.","category":"external_commands","line_end":108,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":124,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":128,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```javascript","category":"external_commands","line_end":131,"severity":"medium","line_start":128},{"id":"network:SKILL.md:12:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:33:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Mini Program project rules and CloudBase integration -> `../miniprogram-development/SKILL.md` (sta","category":"network","line_end":33,"severity":"low","line_start":33},{"id":"network:SKILL.md:34:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Mini Program auth and identity flow -> `../auth-wechat/SKILL.md` (standalone fallback: `https://cn","category":"network","line_end":34,"severity":"low","line_start":34},{"id":"network:SKILL.md:35:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Browser-side document database code -> `../no-sql-web-sdk/SKILL.md` (standalone fallback: `https:/","category":"network","line_end":35,"severity":"low","line_start":35},{"id":"filesystem:SKILL.md:33:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Mini Program project rules and CloudBase integration -> `../miniprogram-development/SKILL.md` (sta","category":"filesystem","line_end":33,"severity":"high","line_start":33},{"id":"filesystem:SKILL.md:34:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Mini Program auth and identity flow -> `../auth-wechat/SKILL.md` (standalone fallback: `https://cn","category":"filesystem","line_end":34,"severity":"high","line_start":34},{"id":"filesystem:SKILL.md:35:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Browser-side document database code -> `../no-sql-web-sdk/SKILL.md` (standalone fallback: `https:/","category":"filesystem","line_end":35,"severity":"high","line_start":35}],"finding_verdicts":[{"id":"blocker:aggregation.md:212:system-reconnaissance","reason":"The snippet is an aggregation projection that excludes the document id from output. It is not collecting system information or probing the host.","verdict":"false_positive","confidence":0.96},{"id":"blocker:aggregation.md:313:system-reconnaissance","reason":"The line is a performance tip about avoiding oversized aggregation groups. It does not request host, network, process, or filesystem reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:complex-queries.md:96:system-reconnaissance","reason":"The snippet is a field selection example that excludes the document id. It does not perform system reconnaissance or expose environment details.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:crud-operations.md:403:sqlite-database-file","reason":"This line stores a passed CloudBase database handle on a tutorial class. It does not reference SQLite files, local database paths, or sensitive file contents.","verdict":"false_positive","confidence":0.96},{"id":"blocker:crud-operations.md:509:system-reconnaissance","reason":"The line logs a generic invalid-data error in an example handler. It does not enumerate system details or reveal sensitive diagnostics.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:geolocation.md:314:ruby-shell-backtick-execution","reason":"This is a JavaScript template string inside a console.log example. It is not a Ruby shell backtick and does not execute an external command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:pagination.md:140:ruby-shell-backtick-execution","reason":"This is a JavaScript template string used to print pagination status. It is not shell execution and contains no command invocation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:pagination.md:141:ruby-shell-backtick-execution","reason":"This is a JavaScript template string used to print a count value. It is not shell execution and contains no command invocation.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:pagination.md:67:certificate-key-files","reason":"Object.keys is used to test whether query filters exist before applying them. The snippet does not access certificate, key, or credential files.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:pagination.md:107:certificate-key-files","reason":"Object.keys is used to test whether query filters exist before count queries. The snippet does not access certificate, key, or credential files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:security-rules.md:62:path-traversal-sequence","reason":"The ../ segment is a fixed documentation reference to a sibling CloudBase skill. There is no user-controlled path construction or arbitrary file read.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:security-rules.md:63:path-traversal-sequence","reason":"The ../ segment is a fixed documentation reference to a sibling CloudBase skill. There is no user-controlled path construction or arbitrary file read.","verdict":"false_positive","confidence":0.86},{"id":"blocker:security-rules.md:18:system-reconnaissance","reason":"The line is an example CloudBase security rule that compares document ownership to auth.openid. It is authorization guidance, not system reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:security-rules.md:19:system-reconnaissance","reason":"The line is an example CloudBase security rule that compares document ownership to auth.openid. It is authorization guidance, not system reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The backticks delimit a Markdown JavaScript code block in documentation. They do not invoke a shell or run an external command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The backticks delimit a Markdown JavaScript code block in documentation. They do not invoke a shell or run an external command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The backticks delimit a Markdown JavaScript code block in documentation. They do not invoke a shell or run an external command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The backticks delimit a Markdown JavaScript code block in documentation. They do not invoke a shell or run an external command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline code around CloudBase terms, paths, or references. They are not Ruby shell backticks and do not execute commands.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The backticks delimit a Markdown JavaScript code block in documentation. They do not invoke a shell or run an external command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The backticks delimit a Markdown JavaScript code block in documentation. They do not invoke a shell or run an external command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"The backticks delimit a Markdown JavaScript code block in documentation. They do not invoke a shell or run an external command.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:12:hardcoded-url","reason":"The URL is a published documentation fallback for the same CloudBase skill set. It does not send data, collect secrets, or contact an unknown endpoint.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL is a published documentation fallback for the current skill source. It does not send data, collect secrets, or contact an unknown endpoint.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:33:hardcoded-url","reason":"The URL appears as a fallback documentation link beside a fixed sibling reference. It is not used for exfiltration or hidden network access.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:34:hardcoded-url","reason":"The URL appears as a fallback documentation link beside a fixed sibling reference. It is not used for exfiltration or hidden network access.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:35:hardcoded-url","reason":"The URL appears as a fallback documentation link beside a fixed sibling reference. It is not used for exfiltration or hidden network access.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:SKILL.md:33:path-traversal-sequence","reason":"The ../ segment is a fixed reference to a sibling Mini Program skill document. It does not construct paths from user input or access arbitrary files.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:SKILL.md:34:path-traversal-sequence","reason":"The ../ segment is a fixed reference to a sibling authentication skill document. It does not construct paths from user input or access arbitrary files.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:SKILL.md:35:path-traversal-sequence","reason":"The ../ segment is a fixed reference to a sibling Web SDK skill document. It does not construct paths from user input or access arbitrary files.","verdict":"false_positive","confidence":0.86}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}