{"data":{"skill":{"slug":"zhangchenlai-dev-lead-scraper","name":"lead-scraper","icon":"📦","repo":"https://github.com/zhangchenlai-dev/hermes-skill-store/tree/master/lead-scraper","status":"approved","author":"Hermes-Sedimentary","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"1df911e9-a543-4ff0-93e1-7deb328130e2","skill_id":"23ae5e4b-d443-44bc-add4-dde8c588b58d","version":2,"content_hash":"115396952301ee6e2745db0cefa708ab","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"The static weak cryptography and entropy findings appear to be false positives in a short markdown skill file. No cryptographic code, obfuscated payload, scripts, or executable behavior was found. The skill purpose involves collecting lead contact data, so publication should require clear privacy, consent, and source-compliance warnings.","remediation":[],"risk_factor_evidence":[],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Lead Contact Data Collection Requires Compliance Review","locations":[{"file":"SKILL.md","line_end":4,"line_start":4},{"file":"SKILL.md","line_end":16,"line_start":16}],"confidence":0.78,"description":"The skill describes collecting company names, contacts, phone numbers, and addresses into CSV output. This can be legitimate B2B research, but it may involve personal data or data-source terms that require consent, lawful basis, and careful handling.","confidence_reasoning":"The stated functionality explicitly includes contact, phone, and address collection. No malicious implementation is present, but the data-handling risk is clear from the skill description."}],"low_findings":[{"title":"False Positive: Weak Cryptographic Algorithm","locations":[{"file":"SKILL.md","line_end":4,"line_start":4}],"confidence":0.94,"description":"The static alert points to the description line, but that line only describes lead list output fields. No weak cryptographic algorithm, hash function, encryption code, or credential handling is present.","confidence_reasoning":"Line 4 contains descriptive front matter text, not executable code. I found no evidence of cryptographic usage in the reviewed file."},{"title":"False Positive: High File Entropy","locations":[{"file":"SKILL.md","line_end":1,"line_start":1}],"confidence":0.9,"description":"The high-entropy alert appears to be caused by front matter and multilingual text in a small markdown file. No binary content, encoded payload, or encrypted block is visible.","confidence_reasoning":"The file content is readable markdown with Chinese text and metadata. I found no evidence of obfuscation or hidden executable content."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":34,"audit_model":"codex","audited_at":"2026-07-01T02:52:19.386+00:00","created_at":"2026-07-01T04:01:00.867744+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":2,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}