{"data":{"skill":{"slug":"zhangchenlai-dev-lead-scraper","name":"lead-scraper","icon":"📦","repo":"https://github.com/zhangchenlai-dev/hermes-skill-store/tree/master/lead-scraper","status":"approved","author":"Hermes-Sedimentary","authorVersion":"1.0.0","skillstoreRevision":1},"audit":{"id":"351fa668-3494-4355-88bd-98e5ba36ea58","skill_id":"23ae5e4b-d443-44bc-add4-dde8c588b58d","version":4,"content_hash":"v3:64ca8af0f54a325752f08bd54e52151061ea659a:d5c8677a58538af85e7486d6fefbd0fc4a628c0fbcabbc723c28933583389363:511cf4c6124134d7ebdcb4132874ebd8c8fbd1df9c125275d4ec8abe6e959744:736b696c6c732f7a68616e676368656e6c61692d6465762f6c6561642d73637261706572:6a93d32d3da05180cfd845e27fa29f26","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The entropy finding is a false positive because SKILL.md is readable Markdown with Chinese text and front matter, not obfuscated content. I found one semantic risk: the skill targets scraping contacts, phone numbers, and addresses into lead CSV files without compliance guardrails.","remediation":[{"issue":"Unrestricted contact-data scraping","severity":"medium","suggestion":"Collect only lawful public business data. Respect website terms, cite sources, and avoid personal data without consent or another valid basis."},{"issue":"Broad automatic execution wording","severity":"low","suggestion":"Require user approval before browsing, scraping, exporting, or using contact details for outreach."}],"risk_factor_evidence":[],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Unrestricted Contact Data Scraping","locations":[{"file":"SKILL.md","line_end":4,"line_start":4},{"file":"SKILL.md","line_end":16,"line_start":16}],"confidence":0.86,"description":"The skill states it scrapes lead lists by region and industry into CSV fields for contact person, phone, and address. This can enable privacy-invasive collection or terms-of-service violations unless limited to lawful public business data.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The stated output fields include contact names, phone numbers, and addresses for scraped leads. No visible guardrails limit collection to compliant public business data."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":34,"audit_model":"codex","audited_at":"2026-07-08T10:58:00.353+00:00","created_at":"2026-07-20T22:07:17.385148+00:00","static_findings":[{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-21-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.21 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-21-bits-possible-b","reason":"SKILL.md is plain Markdown and YAML front matter with Chinese text and one emoji, not binary, encrypted, or encoded content. The entropy heuristic appears triggered by non-ASCII content rather than obfuscation.","verdict":"false_positive","confidence":0.93}],"semantic_findings":[{"title":"Unrestricted Contact Data Scraping","severity":"medium","locations":[{"file":"SKILL.md","line_end":4,"line_start":4},{"file":"SKILL.md","line_end":16,"line_start":16}],"confidence":0.86,"description":"The skill states it scrapes lead lists by region and industry into CSV fields for contact person, phone, and address. This can enable privacy-invasive collection or terms-of-service violations unless limited to lawful public business data.","confidence_reasoning":"The stated output fields include contact names, phone numbers, and addresses for scraped leads. No visible guardrails limit collection to compliant public business data."}],"subject_marketplace_commit_sha":"64ca8af0f54a325752f08bd54e52151061ea659a","subject_content_hash":"d5c8677a58538af85e7486d6fefbd0fc4a628c0fbcabbc723c28933583389363","subject_tree_hash":"511cf4c6124134d7ebdcb4132874ebd8c8fbd1df9c125275d4ec8abe6e959744","subject_plugin_path":"skills/zhangchenlai-dev/lead-scraper","audit_payload_hash":"6a93d32d3da05180cfd845e27fa29f26","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"64ca8af0f54a325752f08bd54e52151061ea659a","contentHash":"d5c8677a58538af85e7486d6fefbd0fc4a628c0fbcabbc723c28933583389363","treeHash":"511cf4c6124134d7ebdcb4132874ebd8c8fbd1df9c125275d4ec8abe6e959744","pluginPath":"skills/zhangchenlai-dev/lead-scraper","auditPayloadHash":"6a93d32d3da05180cfd845e27fa29f26"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}