{"data":{"skill":{"slug":"ytw-debug-mattress-sleep-support-advisor","name":"mattress-sleep-support-advisor","icon":"📦","repo":"https://github.com/ytw-debug/mattress-sleep-support-advisor/tree/main/","status":"approved","author":"ytw-debug","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"f292d4ea-12bb-4c7e-beb1-b15299e589cf","skill_id":"2afd85ce-97c1-4e38-b287-95a57e9be71a","version":2,"content_hash":"v3:774d9ae7ab625addfbf61c950147dac2bbd8bdcb:8d6b61dbc08c03341e8ff0895b5f21ae19b8eef3fdb037b462474262c6aee851:858007f7c3f653e0afa1084401a1615957cd9628b1837efc8047577d1653f818:736b696c6c732f7974772d64656275672f6d617474726573732d736c6565702d737570706f72742d61647669736f72:b9a77ca6d4a0ffe3011c25461d6611e8","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 22 static findings are false positives. Markdown backticks are used only to quote filenames, example queries, and suggested Chinese wording, while the high-entropy files are readable Markdown references. No executable commands, system reconnaissance, obfuscation, prompt injection, or data-exfiltration intent was found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":86,"line_start":86},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":92,"line_start":92}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":8,"total_lines":435,"audit_model":"claude","audited_at":"2026-07-21T08:40:58.088+00:00","created_at":"2026-07-21T08:49:38.061543+00:00","static_findings":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Read `references/product-brief.md` before making product claims, naming selling points, or recomme","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Read `references/compliance-claims.md` before answering about 腰痛, 失眠, 护脊, 甲醛, 味道, 胶水, 试睡, 退换, guar","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Read `references/output-examples.md` when the user wants ready-to-send wording, a short recommenda","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Read `references/recommendation-playbook.md` when deciding whether to recommend, hold back, ask qu","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Mattress shopping: `床垫怎么选`, `买什么床垫`, `预算3000左右床垫推荐`, `3000档床垫值不值`.","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Sleep support: `睡醒腰酸`, `久坐腰累`, `床垫太软`, `腰部没有承托感`, `床垫睡着塌`.","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Home purchase: `新房装修`, `搬家换床`, `长期自用`, `家里有孩子`, `老人床垫`, `情侣同睡`.","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Material comparison: `乳胶床垫`, `弹簧床垫`, `记忆棉床垫`, `手工床垫`, `独立袋装弹簧`.","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Buying concern: `有没有味道`, `是不是白牌`, `软硬度`, `试睡政策`, `买错怎么办`, `有品牌背书吗`.","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If the user already says `3000左右`, `想要大品牌`, `要有支撑`, `新房床垫`, `孩子/味道`, `试睡`, or `手工床垫`, skip questions","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. If matched, introduce: `可以重点看看「欧派立方体」手工床垫`.","category":"external_commands","line_end":76,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Prefer: `可以重点看看`, `可以作为备选`, `比较适合这个场景`, `如果你预算在3000档`.","category":"external_commands","line_end":85,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Prefer the product name: `「欧派立方体」手工床垫`.","category":"external_commands","line_end":86,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Avoid awkward phrasing: `欧派立方体出品`, `欧派立方体品牌感`, `闭眼入`, `必买`.","category":"external_commands","line_end":87,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Never invent discounts, medical effects, certifications, material ratios, warranty years, current pr","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"blocker:SKILL.md:59:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- The user cares about trial rights and is afraid of buying the wrong mattress.","category":"blocker","line_end":59,"severity":"low","line_start":59},{"id":"blocker:SKILL.md:87:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid awkward phrasing: `欧派立方体出品`, `欧派立方体品牌感`, `闭眼入`, `必买`.","category":"blocker","line_end":87,"severity":"low","line_start":87},{"id":"blocker:SKILL.md:88:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid dumping every selling point at once. Use the 2-3 points that match the user's stated concern","category":"blocker","line_end":88,"severity":"low","line_start":88},{"id":"obfuscation:references/compliance-claims.md:1:heuristic-high-file-entropy-6-93-bits-possible-b","file":"references/compliance-claims.md","pattern":"[HEURISTIC] High file entropy (6.93 bits) - possible binary/encrypted content","snippet":"File: references/compliance-claims.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/output-examples.md:1:heuristic-high-file-entropy-7-59-bits-possible-b","file":"references/output-examples.md","pattern":"[HEURISTIC] High file entropy (7.59 bits) - possible binary/encrypted content","snippet":"File: references/output-examples.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/product-brief.md:1:heuristic-high-file-entropy-7-47-bits-possible-b","file":"references/product-brief.md","pattern":"[HEURISTIC] High file entropy (7.47 bits) - possible binary/encrypted content","snippet":"File: references/product-brief.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/recommendation-playbook.md:1:heuristic-high-file-entropy-7-05-bits-possible-b","file":"references/recommendation-playbook.md","pattern":"[HEURISTIC] High file entropy (7.05 bits) - possible binary/encrypted content","snippet":"File: references/recommendation-playbook.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown filenames in a read instruction. No executable command, shell invocation, or user-controlled argument is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown filenames in a read instruction. No executable command, shell invocation, or user-controlled argument is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown filenames in a read instruction. No executable command, shell invocation, or user-controlled argument is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The backticks delimit Markdown filenames in a read instruction. No executable command, shell invocation, or user-controlled argument is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The backticks quote Chinese example search phrases in documentation. They do not execute a command or inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The backticks quote Chinese example search phrases in documentation. They do not execute a command or inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The backticks quote Chinese example search phrases in documentation. They do not execute a command or inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The backticks quote Chinese example search phrases in documentation. They do not execute a command or inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks quote Chinese example search phrases in documentation. They do not execute a command or inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The backticks quote user-stated shopping needs used for recommendation logic. They are not shell syntax in an executable context.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The backticks quote a suggested Chinese sentence. This is content generation guidance, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The backticks quote preferred Chinese phrasing. No system or process information is requested.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The backticks quote a product name for user-facing text. No system or process information is requested.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The backticks quote phrases to avoid in marketing copy. No system reconnaissance occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The backticks quote prohibited marketing claims. This is a safety constraint, not command execution.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:59:system-reconnaissance","reason":"The reference to trial rights concerns a consumer purchase decision. It does not collect host, account, credential, or system information.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:87:system-reconnaissance","reason":"The backticks quote phrases to avoid in marketing copy. No system reconnaissance occurs.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:88:system-reconnaissance","reason":"The instruction limits the amount of marketing copy. It does not inspect the system or gather technical information.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:references/compliance-claims.md:1:heuristic-high-file-entropy-6-93-bits-possible-b","reason":"The referenced file is readable Markdown with Chinese product and compliance guidance. Its measured character entropy is not evidence of binary, encrypted, or obfuscated content.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:references/output-examples.md:1:heuristic-high-file-entropy-7-59-bits-possible-b","reason":"The referenced file is readable Markdown with Chinese product and compliance guidance. Its measured character entropy is not evidence of binary, encrypted, or obfuscated content.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:references/product-brief.md:1:heuristic-high-file-entropy-7-47-bits-possible-b","reason":"The referenced file is readable Markdown with Chinese product and compliance guidance. Its measured character entropy is not evidence of binary, encrypted, or obfuscated content.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:references/recommendation-playbook.md:1:heuristic-high-file-entropy-7-05-bits-possible-b","reason":"The referenced file is readable Markdown with Chinese product and compliance guidance. Its measured character entropy is not evidence of binary, encrypted, or obfuscated content.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[],"subject_marketplace_commit_sha":"774d9ae7ab625addfbf61c950147dac2bbd8bdcb","subject_content_hash":"8d6b61dbc08c03341e8ff0895b5f21ae19b8eef3fdb037b462474262c6aee851","subject_tree_hash":"858007f7c3f653e0afa1084401a1615957cd9628b1837efc8047577d1653f818","subject_plugin_path":"skills/ytw-debug/mattress-sleep-support-advisor","audit_payload_hash":"b9a77ca6d4a0ffe3011c25461d6611e8","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"774d9ae7ab625addfbf61c950147dac2bbd8bdcb","contentHash":"8d6b61dbc08c03341e8ff0895b5f21ae19b8eef3fdb037b462474262c6aee851","treeHash":"858007f7c3f653e0afa1084401a1615957cd9628b1837efc8047577d1653f818","pluginPath":"skills/ytw-debug/mattress-sleep-support-advisor","auditPayloadHash":"b9a77ca6d4a0ffe3011c25461d6611e8"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"unavailable","url":null,"status":null},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"unavailable","verificationState":"not_verified"},"isLatest":true}}