{"data":{"skill":{"slug":"tencentcloudbase-web-development","name":"web-development","icon":"📦","repo":"https://github.com/tencentcloudbase/skills/tree/main/skills/web-development","status":"approved","author":"tencentcloudbase","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"293f646b-51c7-4c3d-a7a5-7e475291c794","skill_id":"da97f8cb-52ae-4749-83ec-3cf0528a4a30","version":1,"content_hash":"v2:24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec:fd7068081285b85507fa891b3fcd48bbe9143603de59a4fc2c426e2f0e28f745:8b453fba180a5590ced3aeb4347a28704fecd7b130f98410d973e55aa20c2eb5:c6929d705021c6497606bda9fe809b28","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most static findings are false positives caused by Markdown inline code, documentation URLs, and fixed sibling-skill paths. Confirmed risks involve unpinned remote instruction URLs and a public frontend access-key example. Semantic findings also identify unsafe token-cookie and credentialed CORS guidance.","remediation":[{"issue":"Public access key example","severity":"high","suggestion":"Remove NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY from browser samples or label it only as a publishable key. Keep secret access keys server-side."},{"issue":"Client-side session token cookie","severity":"high","suggestion":"Do not store access tokens with document.cookie. Use HttpOnly, Secure, SameSite cookies set server-side or a documented SDK session mechanism."},{"issue":"Credentialed wildcard CORS guidance","severity":"medium","suggestion":"Replace wildcard fallback with an explicit allowlist and disable credentials unless origin validation is strict."},{"issue":"Unpinned remote instruction references","severity":"medium","suggestion":"Bundle referenced protocols or pin remote URLs to immutable commit hashes and verify content before use."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"frameworks.md","line_end":56,"line_start":46},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":66,"line_start":66},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":72,"line_start":72},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":74,"line_start":74},{"file":"SKILL.md","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":86,"line_start":86},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":100,"line_start":100},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":116,"line_start":116},{"file":"SKILL.md","line_end":117,"line_start":117},{"file":"SKILL.md","line_end":129,"line_start":129},{"file":"SKILL.md","line_end":130,"line_start":130},{"file":"SKILL.md","line_end":133,"line_start":133},{"file":"SKILL.md","line_end":138,"line_start":138},{"file":"SKILL.md","line_end":158,"line_start":158},{"file":"SKILL.md","line_end":159,"line_start":159},{"file":"SKILL.md","line_end":171,"line_start":171},{"file":"SKILL.md","line_end":172,"line_start":172},{"file":"SKILL.md","line_end":178,"line_start":178},{"file":"SKILL.md","line_end":186,"line_start":186},{"file":"SKILL.md","line_end":191,"line_start":189},{"file":"SKILL.md","line_end":194,"line_start":191},{"file":"SKILL.md","line_end":196,"line_start":194},{"file":"SKILL.md","line_end":200,"line_start":196},{"file":"SKILL.md","line_end":209,"line_start":200}]},{"factor":"env_access","evidence":[{"file":"frameworks.md","line_end":30,"line_start":30},{"file":"frameworks.md","line_end":31,"line_start":31},{"file":"frameworks.md","line_end":32,"line_start":32},{"file":"frameworks.md","line_end":105,"line_start":105},{"file":"frameworks.md","line_end":163,"line_start":163},{"file":"frameworks.md","line_end":30,"line_start":30},{"file":"frameworks.md","line_end":31,"line_start":31},{"file":"frameworks.md","line_end":32,"line_start":32},{"file":"frameworks.md","line_end":105,"line_start":105},{"file":"frameworks.md","line_end":163,"line_start":163}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":42,"line_start":42}]}],"critical_findings":[],"high_findings":[{"title":"Environment variable access (dot notation)","locations":[{"file":"frameworks.md","line_end":32,"line_start":32}],"confidence":0.78,"description":"accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The example reads a variable named NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY in browser initialization. NEXT_PUBLIC values are exposed to the client, so a secret access key would leak."},{"title":"Environment variable object","locations":[{"file":"frameworks.md","line_end":32,"line_start":32}],"confidence":0.78,"description":"accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,","review_kind":"capability","source_category":"env_access","source_severity":"low","confidence_reasoning":"The example reads a variable named NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY in browser initialization. NEXT_PUBLIC values are exposed to the client, so a secret access key would leak."},{"title":"Environment file access","locations":[{"file":"frameworks.md","line_end":32,"line_start":32}],"confidence":0.82,"description":"accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The sample places CLOUDBASE_ACCESS_KEY in a NEXT_PUBLIC variable, which Next.js exposes to browser bundles. If the value is a secret key, users following the sample leak credentials."},{"title":"Client-Side Token Cookie Guidance","locations":[{"file":"frameworks.md","line_end":46,"line_start":45},{"file":"frameworks.md","line_end":66,"line_start":64}],"confidence":0.9,"description":"The Next.js example writes a session access token with document.cookie and later reads it from a request cookie. A JavaScript-readable token cookie is exposed to XSS and omits Secure, HttpOnly, and SameSite protections.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The example directly stores data.session.access_token in document.cookie and then reads cloudbase_token from request cookies. The security weakness follows from the documented flow."}],"medium_findings":[{"title":"Permissive Credentialed CORS Example","locations":[{"file":"frameworks.md","line_end":165,"line_start":162}],"confidence":0.82,"description":"The NestJS sample allows an origin fallback of * while credentials are enabled. This can teach deployments to combine credentialed requests with overly broad origins.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The CORS example shows a wildcard origin fallback and credentials enabled in the same configuration block. This is a clear unsafe deployment pattern."},{"title":"Mutable Remote Instruction Dependency","locations":[{"file":"SKILL.md","line_end":19,"line_start":12},{"file":"SKILL.md","line_end":42,"line_start":41}],"confidence":0.78,"description":"The standalone instructions tell agents to use raw main-branch URLs for protocols and sibling skills. Unpinned remote instructions can change after marketplace review and alter agent behavior.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The URLs are explicit raw references to main-branch skill and protocol content. The risk is mutable remote instruction loading, not a generic hardcoded URL."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":12,"line_start":12}],"confidence":0.78,"description":"- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":13,"line_start":13}],"confidence":0.78,"description":"- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.78,"description":"- Change Safety Protocol: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":19,"line_start":19}],"confidence":0.78,"description":"- Deployment Gate: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":41,"line_start":41}],"confidence":0.78,"description":"- Login flow -> `../auth-tool/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/cloudb","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":42,"line_start":42}],"confidence":0.78,"description":"- Official Account JSAPI Pay, Native QR-code Pay, or WeChat OAuth on CloudBase -> `../cloudbase-wech","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit."}],"dangerous_patterns":[],"files_scanned":3,"total_lines":471,"audit_model":"codex","audited_at":"2026-07-09T17:00:02.945+00:00","created_at":"2026-07-09T17:30:25.04879+00:00","static_findings":[{"id":"blocker:browser-testing.md:33:system-reconnaissance","file":"browser-testing.md","pattern":"System reconnaissance","snippet":"2. **Open the target route with `agent-browser`**, starting from the entry URL, not deep-linking int","category":"blocker","line_end":33,"severity":"low","line_start":33},{"id":"blocker:browser-testing.md:45:system-reconnaissance","file":"browser-testing.md","pattern":"System reconnaissance","snippet":"- **Action** — e.g. \"Submitted the phone+code form with a valid code\"","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"blocker:browser-testing.md:49:system-reconnaissance","file":"browser-testing.md","pattern":"System reconnaissance","snippet":"- **Gap (if any)** — e.g. \"Did not test WeChat login branch because no test account available\"","category":"blocker","line_end":49,"severity":"low","line_start":49},{"id":"blocker:browser-testing.md:56:system-reconnaissance","file":"browser-testing.md","pattern":"System reconnaissance","snippet":"- **AI model**: eligibility gate passes → `generateText` returns text → `streamText` incrementally u","category":"blocker","line_end":56,"severity":"low","line_start":56},{"id":"blocker:browser-testing.md:60:system-reconnaissance","file":"browser-testing.md","pattern":"System reconnaissance","snippet":"## Common mistakes to avoid","category":"blocker","line_end":62,"severity":"low","line_start":60},{"id":"blocker:browser-testing.md:71:system-reconnaissance","file":"browser-testing.md","pattern":"System reconnaissance","snippet":"If you cannot complete browser validation because of missing credentials, a missing backend, a paid ","category":"blocker","line_end":71,"severity":"low","line_start":71},{"id":"external_commands:frameworks.md:46:ruby-shell-backtick-execution","file":"frameworks.md","pattern":"Ruby/shell backtick execution","snippet":"document.cookie = `cloudbase_token=${data.session.access_token}; path=/; max-age=3600`","category":"external_commands","line_end":56,"severity":"medium","line_start":46},{"id":"env_access:frameworks.md:30:environment-variable-access-dot-notation","file":"frameworks.md","pattern":"Environment variable access (dot notation)","snippet":"env: process.env.NEXT_PUBLIC_CLOUDBASE_ENV_ID!,","category":"env_access","line_end":30,"severity":"low","line_start":30},{"id":"env_access:frameworks.md:31:environment-variable-access-dot-notation","file":"frameworks.md","pattern":"Environment variable access (dot notation)","snippet":"region: process.env.NEXT_PUBLIC_CLOUDBASE_REGION || \"ap-shanghai\",","category":"env_access","line_end":31,"severity":"low","line_start":31},{"id":"env_access:frameworks.md:32:environment-variable-access-dot-notation","file":"frameworks.md","pattern":"Environment variable access (dot notation)","snippet":"accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,","category":"env_access","line_end":32,"severity":"low","line_start":32},{"id":"env_access:frameworks.md:105:environment-variable-access-dot-notation","file":"frameworks.md","pattern":"Environment variable access (dot notation)","snippet":"env: process.env.CLOUDBASE_ENV_ID!,","category":"env_access","line_end":105,"severity":"low","line_start":105},{"id":"env_access:frameworks.md:163:environment-variable-access-dot-notation","file":"frameworks.md","pattern":"Environment variable access (dot notation)","snippet":"origin: process.env.CORS_ORIGIN || \"*\",","category":"env_access","line_end":163,"severity":"low","line_start":163},{"id":"env_access:frameworks.md:30:environment-variable-object","file":"frameworks.md","pattern":"Environment variable object","snippet":"env: process.env.NEXT_PUBLIC_CLOUDBASE_ENV_ID!,","category":"env_access","line_end":30,"severity":"low","line_start":30},{"id":"env_access:frameworks.md:31:environment-variable-object","file":"frameworks.md","pattern":"Environment variable object","snippet":"region: process.env.NEXT_PUBLIC_CLOUDBASE_REGION || \"ap-shanghai\",","category":"env_access","line_end":31,"severity":"low","line_start":31},{"id":"env_access:frameworks.md:32:environment-variable-object","file":"frameworks.md","pattern":"Environment variable object","snippet":"accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,","category":"env_access","line_end":32,"severity":"low","line_start":32},{"id":"env_access:frameworks.md:105:environment-variable-object","file":"frameworks.md","pattern":"Environment variable object","snippet":"env: process.env.CLOUDBASE_ENV_ID!,","category":"env_access","line_end":105,"severity":"low","line_start":105},{"id":"env_access:frameworks.md:163:environment-variable-object","file":"frameworks.md","pattern":"Environment variable object","snippet":"origin: process.env.CORS_ORIGIN || \"*\",","category":"env_access","line_end":163,"severity":"low","line_start":163},{"id":"sensitive:frameworks.md:30:environment-file-access","file":"frameworks.md","pattern":"Environment file access","snippet":"env: process.env.NEXT_PUBLIC_CLOUDBASE_ENV_ID!,","category":"sensitive","line_end":30,"severity":"high","line_start":30},{"id":"sensitive:frameworks.md:31:environment-file-access","file":"frameworks.md","pattern":"Environment file access","snippet":"region: process.env.NEXT_PUBLIC_CLOUDBASE_REGION || \"ap-shanghai\",","category":"sensitive","line_end":31,"severity":"high","line_start":31},{"id":"sensitive:frameworks.md:32:environment-file-access","file":"frameworks.md","pattern":"Environment file access","snippet":"accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,","category":"sensitive","line_end":32,"severity":"high","line_start":32},{"id":"sensitive:frameworks.md:105:environment-file-access","file":"frameworks.md","pattern":"Environment file access","snippet":"env: process.env.CLOUDBASE_ENV_ID!,","category":"sensitive","line_end":105,"severity":"high","line_start":105},{"id":"sensitive:frameworks.md:163:environment-file-access","file":"frameworks.md","pattern":"Environment file access","snippet":"origin: process.env.CORS_ORIGIN || \"*\",","category":"sensitive","line_end":163,"severity":"high","line_start":163},{"id":"sensitive:frameworks.md:181:environment-file-access","file":"frameworks.md","pattern":"Environment file access","snippet":"- Keep environment-specific values in `.env` or the project's existing config pattern instead of har","category":"sensitive","line_end":181,"severity":"high","line_start":181},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If this environment only installed the current skill, start from the CloudBase main entry and use th","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Keep local `references/...` paths for files that ship with the current skill directory. When this fi","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Change Safety Protocol: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Deployment Gate: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- The request includes UI implementation but the visual direction is already fixed; otherwise read `","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **⚠️ Any task involving interface styling, layout, color scheme, or font selection — before writin","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- General React / Vue / Vite guidance -> `frameworks.md`","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Browser flow checks or page validation -> `browser-testing.md`","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Login flow -> `../auth-tool/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/cloudb","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Official Account JSAPI Pay, Native QR-code Pay, or WeChat OAuth on CloudBase -> `../cloudbase-wech","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- WeChat payment or Official Account OAuth contract details; use `cloudbase-wechat-integration` afte","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **History mode SPA with CloudBase static hosting**: deploying a single-page app using History mode","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Do NOT use `any` to bypass type errors.** Not `: any`, not `as any`, not `@ts-ignore`, not `@ts-","category":"external_commands","line_end":66,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Missing / wrong library types → install `@types/...`, or narrow the import, or write a precise `in","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Shape is genuinely unknown at the boundary (JSON from an API, `postMessage` payload, `window.*` in","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Third-party type is wrong → augment via `declare module` in a local `.d.ts`, not `any`.","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Truly dynamic case (e.g. generic event bus) → use a generic `<T>` with a constraint, not `any`.","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `unknown` + narrowing is the acceptable escape hatch. `any` is not.","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If you genuinely cannot avoid `any` for a specific line (extremely rare), leave a one-line comment","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- The same spirit applies to ESLint: do not sprinkle `// eslint-disable` to mute the real signal. Fi","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Before making any non-trivial code or configuration change, you must first follow the Change Safety ","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Before any static hosting publish or custom domain work, complete the checks in `cloudbase-platform/","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `tsc --noEmit` (or `vue-tsc --noEmit`) passes cleanly — zero errors, zero suppressed diagnostics y","category":"external_commands","line_end":85,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `eslint` / project linter passes on changed files.","category":"external_commands","line_end":86,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- The project's build command (`npm run build` / `pnpm build` / `vite build`) completes without new ","category":"external_commands","line_end":87,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use the **`agent-browser`** tool to actually open the page and reproduce the user-visible flow. Fo","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Do not wrap broken logic in `try { ... } catch {}` to make the error go away.","category":"external_commands","line_end":100,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- UI direction or visual system design only; use `ui-design`","category":"external_commands","line_end":115,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Mini program development; use `miniprogram-development`","category":"external_commands","line_end":116,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Backend service implementation; use `cloudrun-development` or `cloud-functions`","category":"external_commands","line_end":117,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Put reusable app code under `src` and build output under `dist` unless the repo already uses a dif","category":"external_commands","line_end":129,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- In an existing application with fixed structure, inspect the files that already own the flow befor","category":"external_commands","line_end":130,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For interaction, routing, rendering, or regression checks, use `agent-browser` workflows from `bro","category":"external_commands","line_end":133,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Reuse `auth-tool` and `auth-web` for login or provider readiness instead of re-describing those fl","category":"external_commands","line_end":138,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Run the relevant local build / lint / typecheck / test command when available. A clean `tsc --noEm","category":"external_commands","line_end":158,"severity":"medium","line_start":158},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For anything user-visible (routing, forms, rendering, auth, async flows), open the affected page o","category":"external_commands","line_end":159,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Keep a shared `app` or `auth` instance instead of re-initializing on every call","category":"external_commands","line_end":171,"severity":"medium","line_start":171},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If the user only provides an environment alias, nickname, or other shorthand, resolve it to the ca","category":"external_commands","line_end":172,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For provider readiness, login method setup, or publishable key issues, route to `auth-tool` and `a","category":"external_commands","line_end":178,"severity":"medium","line_start":178},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **SPA routing (History mode)**: when using React Router / Vue Router in History mode (not hash mod","category":"external_commands","line_end":186,"severity":"medium","line_start":186},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":191,"severity":"medium","line_start":189},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":194,"severity":"medium","line_start":191},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":196,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":200,"severity":"medium","line_start":196},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```js","category":"external_commands","line_end":209,"severity":"medium","line_start":200},{"id":"network:SKILL.md:12:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:18:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Change Safety Protocol: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/","category":"network","line_end":18,"severity":"low","line_start":18},{"id":"network:SKILL.md:19:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Deployment Gate: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/","category":"network","line_end":19,"severity":"low","line_start":19},{"id":"network:SKILL.md:41:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Login flow -> `../auth-tool/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/cloudb","category":"network","line_end":41,"severity":"low","line_start":41},{"id":"network:SKILL.md:42:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Official Account JSAPI Pay, Native QR-code Pay, or WeChat OAuth on CloudBase -> `../cloudbase-wech","category":"network","line_end":42,"severity":"low","line_start":42},{"id":"filesystem:SKILL.md:41:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Login flow -> `../auth-tool/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/cloudb","category":"filesystem","line_end":41,"severity":"high","line_start":41},{"id":"filesystem:SKILL.md:42:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Official Account JSAPI Pay, Native QR-code Pay, or WeChat OAuth on CloudBase -> `../cloudbase-wech","category":"filesystem","line_end":42,"severity":"high","line_start":42},{"id":"blocker:SKILL.md:73:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- If you genuinely cannot avoid `any` for a specific line (extremely rare), leave a one-line comment","category":"blocker","line_end":73,"severity":"low","line_start":73},{"id":"blocker:SKILL.md:96:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"**Only after both layers pass** may you say the task is done. If either layer cannot be executed loc","category":"blocker","line_end":96,"severity":"low","line_start":96},{"id":"blocker:SKILL.md:152:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid framework rewrites unless the user explicitly asks for one","category":"blocker","line_end":152,"severity":"low","line_start":152},{"id":"blocker:SKILL.md:185:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- If the user does not specify a root path, avoid deploying directly to the site root by default","category":"blocker","line_end":185,"severity":"low","line_start":185}],"finding_verdicts":[{"id":"blocker:browser-testing.md:33:system-reconnaissance","reason":"The text describes validation workflow or reporting expectations. It does not request host reconnaissance, secret discovery, or unauthorized enumeration.","verdict":"false_positive","confidence":0.92},{"id":"blocker:browser-testing.md:45:system-reconnaissance","reason":"The text describes validation workflow or reporting expectations. It does not request host reconnaissance, secret discovery, or unauthorized enumeration.","verdict":"false_positive","confidence":0.92},{"id":"blocker:browser-testing.md:49:system-reconnaissance","reason":"The text describes validation workflow or reporting expectations. It does not request host reconnaissance, secret discovery, or unauthorized enumeration.","verdict":"false_positive","confidence":0.92},{"id":"blocker:browser-testing.md:56:system-reconnaissance","reason":"The text describes validation workflow or reporting expectations. It does not request host reconnaissance, secret discovery, or unauthorized enumeration.","verdict":"false_positive","confidence":0.92},{"id":"blocker:browser-testing.md:60:system-reconnaissance","reason":"The text describes validation workflow or reporting expectations. It does not request host reconnaissance, secret discovery, or unauthorized enumeration.","verdict":"false_positive","confidence":0.92},{"id":"blocker:browser-testing.md:71:system-reconnaissance","reason":"The text describes validation workflow or reporting expectations. It does not request host reconnaissance, secret discovery, or unauthorized enumeration.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:frameworks.md:46:ruby-shell-backtick-execution","reason":"The backticks are a JavaScript template literal inside a documented example, not shell or Ruby command execution. The token-handling concern is covered as a semantic finding.","verdict":"false_positive","confidence":0.96},{"id":"env_access:frameworks.md:30:environment-variable-access-dot-notation","reason":"The environment variable is used as configuration in a documentation example. It does not expose a secret or send environment values to an unauthorized destination.","verdict":"false_positive","confidence":0.86},{"id":"env_access:frameworks.md:31:environment-variable-access-dot-notation","reason":"The environment variable is used as configuration in a documentation example. It does not expose a secret or send environment values to an unauthorized destination.","verdict":"false_positive","confidence":0.86},{"id":"env_access:frameworks.md:32:environment-variable-access-dot-notation","reason":"The example reads a variable named NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY in browser initialization. NEXT_PUBLIC values are exposed to the client, so a secret access key would leak.","verdict":"confirmed","severity":"high","confidence":0.78},{"id":"env_access:frameworks.md:105:environment-variable-access-dot-notation","reason":"The environment variable is used as configuration in a documentation example. It does not expose a secret or send environment values to an unauthorized destination.","verdict":"false_positive","confidence":0.86},{"id":"env_access:frameworks.md:163:environment-variable-access-dot-notation","reason":"The environment variable is used as configuration in a documentation example. It does not expose a secret or send environment values to an unauthorized destination.","verdict":"false_positive","confidence":0.86},{"id":"env_access:frameworks.md:30:environment-variable-object","reason":"The environment variable is used as configuration in a documentation example. It does not expose a secret or send environment values to an unauthorized destination.","verdict":"false_positive","confidence":0.86},{"id":"env_access:frameworks.md:31:environment-variable-object","reason":"The environment variable is used as configuration in a documentation example. It does not expose a secret or send environment values to an unauthorized destination.","verdict":"false_positive","confidence":0.86},{"id":"env_access:frameworks.md:32:environment-variable-object","reason":"The example reads a variable named NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY in browser initialization. NEXT_PUBLIC values are exposed to the client, so a secret access key would leak.","verdict":"confirmed","severity":"high","confidence":0.78},{"id":"env_access:frameworks.md:105:environment-variable-object","reason":"The environment variable is used as configuration in a documentation example. It does not expose a secret or send environment values to an unauthorized destination.","verdict":"false_positive","confidence":0.86},{"id":"env_access:frameworks.md:163:environment-variable-object","reason":"The environment variable is used as configuration in a documentation example. It does not expose a secret or send environment values to an unauthorized destination.","verdict":"false_positive","confidence":0.86},{"id":"sensitive:frameworks.md:30:environment-file-access","reason":"The flagged text references environment configuration in examples or guidance. It does not access local .env files or reveal secret values.","verdict":"false_positive","confidence":0.87},{"id":"sensitive:frameworks.md:31:environment-file-access","reason":"The flagged text references environment configuration in examples or guidance. It does not access local .env files or reveal secret values.","verdict":"false_positive","confidence":0.87},{"id":"sensitive:frameworks.md:32:environment-file-access","reason":"The sample places CLOUDBASE_ACCESS_KEY in a NEXT_PUBLIC variable, which Next.js exposes to browser bundles. If the value is a secret key, users following the sample leak credentials.","verdict":"confirmed","severity":"high","confidence":0.82},{"id":"sensitive:frameworks.md:105:environment-file-access","reason":"The flagged text references environment configuration in examples or guidance. It does not access local .env files or reveal secret values.","verdict":"false_positive","confidence":0.87},{"id":"sensitive:frameworks.md:163:environment-file-access","reason":"The flagged text references environment configuration in examples or guidance. It does not access local .env files or reveal secret values.","verdict":"false_positive","confidence":0.87},{"id":"sensitive:frameworks.md:181:environment-file-access","reason":"The flagged text references environment configuration in examples or guidance. It does not access local .env files or reveal secret values.","verdict":"false_positive","confidence":0.87},{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"The flagged backticks are Markdown inline code, file names, commands, or fenced examples. The skill does not construct or execute shell commands from user input.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:12:hardcoded-url","reason":"The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.","verdict":"confirmed","severity":"low","confidence":0.78},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.","verdict":"confirmed","severity":"low","confidence":0.78},{"id":"network:SKILL.md:18:hardcoded-url","reason":"The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.","verdict":"confirmed","severity":"low","confidence":0.78},{"id":"network:SKILL.md:19:hardcoded-url","reason":"The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.","verdict":"confirmed","severity":"low","confidence":0.78},{"id":"network:SKILL.md:41:hardcoded-url","reason":"The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.","verdict":"confirmed","severity":"low","confidence":0.78},{"id":"network:SKILL.md:42:hardcoded-url","reason":"The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.","verdict":"confirmed","severity":"low","confidence":0.78},{"id":"filesystem:SKILL.md:41:path-traversal-sequence","reason":"The ../ path is a fixed sibling-skill reference in Markdown, not a user-controlled file access path. It does not traverse arbitrary filesystem locations.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:42:path-traversal-sequence","reason":"The ../ path is a fixed sibling-skill reference in Markdown, not a user-controlled file access path. It does not traverse arbitrary filesystem locations.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:73:system-reconnaissance","reason":"The text describes validation workflow or reporting expectations. It does not request host reconnaissance, secret discovery, or unauthorized enumeration.","verdict":"false_positive","confidence":0.92},{"id":"blocker:SKILL.md:96:system-reconnaissance","reason":"The text describes validation workflow or reporting expectations. It does not request host reconnaissance, secret discovery, or unauthorized enumeration.","verdict":"false_positive","confidence":0.92},{"id":"blocker:SKILL.md:152:system-reconnaissance","reason":"The text describes validation workflow or reporting expectations. It does not request host reconnaissance, secret discovery, or unauthorized enumeration.","verdict":"false_positive","confidence":0.92},{"id":"blocker:SKILL.md:185:system-reconnaissance","reason":"The text describes validation workflow or reporting expectations. It does not request host reconnaissance, secret discovery, or unauthorized enumeration.","verdict":"false_positive","confidence":0.92}],"semantic_findings":[{"title":"Client-Side Token Cookie Guidance","severity":"high","locations":[{"file":"frameworks.md","line_end":46,"line_start":45},{"file":"frameworks.md","line_end":66,"line_start":64}],"confidence":0.9,"description":"The Next.js example writes a session access token with document.cookie and later reads it from a request cookie. A JavaScript-readable token cookie is exposed to XSS and omits Secure, HttpOnly, and SameSite protections.","confidence_reasoning":"The example directly stores data.session.access_token in document.cookie and then reads cloudbase_token from request cookies. The security weakness follows from the documented flow."},{"title":"Permissive Credentialed CORS Example","severity":"medium","locations":[{"file":"frameworks.md","line_end":165,"line_start":162}],"confidence":0.82,"description":"The NestJS sample allows an origin fallback of * while credentials are enabled. This can teach deployments to combine credentialed requests with overly broad origins.","confidence_reasoning":"The CORS example shows a wildcard origin fallback and credentials enabled in the same configuration block. This is a clear unsafe deployment pattern."},{"title":"Mutable Remote Instruction Dependency","severity":"medium","locations":[{"file":"SKILL.md","line_end":19,"line_start":12},{"file":"SKILL.md","line_end":42,"line_start":41}],"confidence":0.78,"description":"The standalone instructions tell agents to use raw main-branch URLs for protocols and sibling skills. Unpinned remote instructions can change after marketplace review and alter agent behavior.","confidence_reasoning":"The URLs are explicit raw references to main-branch skill and protocol content. The risk is mutable remote instruction loading, not a generic hardcoded URL."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":4,"capabilityReviewCount":8,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}