{"data":{"skill":{"slug":"zl2023github-backend-developer","name":"backend-developer","icon":"📦","repo":"https://github.com/zl2023github/software-engineer-skills/tree/main/software-engineering/backend-developer","status":"approved","author":"zl2023github","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"eec0b78c-8853-4b2b-bd0f-f590a02b0936","skill_id":"0841edc7-bd86-4c8e-894e-02ba4c3521ad","version":4,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:315f6e5fcb9a63bc08af79bc5ed85286303b588555ba636295ba918f91df46b4:1bbbd9fa9b3b59f8e1ddb0ade74988e39ec5f35192d2d27b6416b0f1a6d7bb56:736b696c6c732f7a6c323032336769746875622f6261636b656e642d646576656c6f706572:e61c70e04740f29e05ff467f11c15440","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 33 static detections are false positives caused by Markdown formatting, local example URLs, safe device output, or ordinary technical prose. One semantic issue remains: the FastAPI example exposes raw exception details in client responses.","remediation":[{"issue":"The FastAPI error example exposes raw exception details to clients.","severity":"medium","suggestion":"Return a generic message, log details server-side with the trace identifier, and add handlers for expected errors."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":34,"line_start":32},{"file":"SKILL.md","line_end":37,"line_start":34},{"file":"SKILL.md","line_end":41,"line_start":37},{"file":"SKILL.md","line_end":43,"line_start":41},{"file":"SKILL.md","line_end":46,"line_start":43},{"file":"SKILL.md","line_end":54,"line_start":46},{"file":"SKILL.md","line_end":67,"line_start":54},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":116,"line_start":91},{"file":"SKILL.md","line_end":123,"line_start":116},{"file":"SKILL.md","line_end":130,"line_start":123},{"file":"SKILL.md","line_end":146,"line_start":130},{"file":"SKILL.md","line_end":151,"line_start":146},{"file":"SKILL.md","line_end":165,"line_start":151},{"file":"SKILL.md","line_end":168,"line_start":165},{"file":"SKILL.md","line_end":183,"line_start":168},{"file":"SKILL.md","line_end":199,"line_start":183},{"file":"SKILL.md","line_end":199,"line_start":199},{"file":"SKILL.md","line_end":210,"line_start":209},{"file":"SKILL.md","line_end":211,"line_start":210},{"file":"SKILL.md","line_end":212,"line_start":211},{"file":"SKILL.md","line_end":213,"line_start":212},{"file":"SKILL.md","line_end":214,"line_start":213}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":110,"line_start":110}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":108,"line_start":108}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Verbose Exception Disclosure","locations":[{"file":"SKILL.md","line_end":164,"line_start":159}],"confidence":0.96,"description":"The FastAPI example returns raw exception text to clients, which can expose internal details or sensitive values.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The response directly places str(exc) in the client-visible message. This is a clear information disclosure pattern in the supplied example."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":215,"audit_model":"codex","audited_at":"2026-07-24T02:13:07.299+00:00","created_at":"2026-07-26T15:26:33.54429+00:00","static_findings":[{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":34,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":37,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 输出:技术方案文档(ADR 格式,参考 `arch-adr` 技能)","category":"external_commands","line_end":41,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":43,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":46,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 统一错误响应格式:`{code, message, data, trace_id}`","category":"external_commands","line_end":54,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 索引命名规范:`idx_表名_字段名`","category":"external_commands","line_end":67,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [ ] 依赖漏洞扫描(`npm audit` / `snyk` / `trivy`)","category":"external_commands","line_end":67,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":116,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":123,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 内存泄漏 | `top` 看 RES → heap dump / pprof → 分析对象引用 |","category":"external_commands","line_end":130,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":146,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":151,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":165,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":168,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":183,"severity":"medium","line_start":168},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":199,"severity":"medium","line_start":183},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [ ] 健康检查端点(`/health`、`/ready`)","category":"external_commands","line_end":199,"severity":"medium","line_start":199},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `arch-adr` — 架构决策记录","category":"external_commands","line_end":210,"severity":"medium","line_start":209},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `arch-c4-diagram` — C4 架构图生成","category":"external_commands","line_end":211,"severity":"medium","line_start":210},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `arch-tech-evaluation` — 技术选型评估","category":"external_commands","line_end":212,"severity":"medium","line_start":211},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `arch-codebase-analysis` — 代码库架构分析","category":"external_commands","line_end":213,"severity":"medium","line_start":212},{"id":"external_commands:SKILL.md:213:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ops-engineer` — 运维工程师 Agent(部署、容器、CI/CD、监控等运维操作)","category":"external_commands","line_end":214,"severity":"medium","line_start":213},{"id":"network:SKILL.md:108:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -o /dev/null -s -w 'Total: %{time_total}s\\n' http://localhost:8080/api","category":"network","line_end":108,"severity":"low","line_start":108},{"id":"network:SKILL.md:109:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"ab -n 1000 -c 10 http://localhost:8080/api","category":"network","line_end":109,"severity":"low","line_start":109},{"id":"network:SKILL.md:110:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"pprof http://localhost:6060/debug/pprof/","category":"network","line_end":110,"severity":"low","line_start":110},{"id":"filesystem:SKILL.md:108:standard-device-file-access","file":"SKILL.md","pattern":"Standard device file access","snippet":"curl -o /dev/null -s -w 'Total: %{time_total}s\\n' http://localhost:8080/api","category":"filesystem","line_end":108,"severity":"low","line_start":108},{"id":"sensitive:SKILL.md:198:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"- [ ] 环境变量分离(.env / secrets manager)","category":"sensitive","line_end":198,"severity":"high","line_start":198},{"id":"blocker:SKILL.md:47:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- 所有 API 加 trace_id 用于链路追踪","category":"blocker","line_end":47,"severity":"low","line_start":47},{"id":"blocker:SKILL.md:122:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| 接口慢 | 看日志耗时 → 加 trace_id 追踪 → 查数据库慢查询 → 查外部调用耗时 |","category":"blocker","line_end":122,"severity":"low","line_start":122},{"id":"blocker:SKILL.md:177:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"last_id = decode_cursor(cursor)","category":"blocker","line_end":177,"severity":"low","line_start":177},{"id":"blocker:SKILL.md:178:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"query = query.where(Item.id > last_id)","category":"blocker","line_end":178,"severity":"low","line_start":178},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-73-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.73 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The match is an opening Markdown code fence around a workflow diagram. It does not execute Ruby or shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The match is a closing Markdown code fence. No executable expression or command invocation is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"Backticks format the name of a related skill in prose. They do not invoke that skill or execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The match is an opening Markdown code fence around an API workflow diagram. It contains no executable Ruby or shell logic.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The match is a closing Markdown code fence. It does not perform command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"Backticks display an example API response shape. The text is documentation, not executable command syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"Backticks format an index naming convention in documentation. No command or interpreter receives this value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"Backticks format dependency scanner names in a security checklist. The skill does not automatically run these commands.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The match is a Markdown fence declaring a bash example block. The block is a manual command reference without automatic execution logic.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"The match is the closing fence of a documented command block. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"Backticks format the top utility in a troubleshooting table. The prose suggests manual diagnosis and contains no execution mechanism.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The match is a Markdown fence starting an illustrative project tree. It does not contain Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The match is the closing Markdown fence for a project tree. It has no executable behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The match is a Markdown fence starting a Python example. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"The match is the closing Markdown fence for a Python example. It does not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","reason":"The match is a Markdown fence starting a Python pagination example. No shell execution primitive is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"The match is the closing Markdown fence for the pagination example. It has no external command behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","reason":"Backticks format two health endpoint paths in a deployment checklist. Endpoint notation does not execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","reason":"Backticks format a related skill name. The line is a reference and has no command execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","reason":"Backticks format a related skill name. The line does not invoke a process or interpreter.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","reason":"Backticks format a related skill name in documentation. No executable instruction is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","reason":"Backticks format a related skill name in a list. They are Markdown notation rather than shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:213:ruby-shell-backtick-execution","reason":"Backticks format a related skill name. The surrounding text only describes its scope.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:108:hardcoded-url","reason":"The URL targets localhost for an explicit curl timing example. It does not contact an external host or transmit credentials.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:109:hardcoded-url","reason":"The ApacheBench example targets a local service endpoint. It is a manual load-testing example without external data transfer.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:110:hardcoded-url","reason":"The profiling URL uses localhost and the standard pprof path. No external destination or sensitive payload is present.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:108:standard-device-file-access","reason":"The curl example discards its response through the standard null device. It neither reads sensitive files nor persists data.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:198:environment-file-access","reason":"The line recommends separating environment configuration and using a secrets manager. It does not read, display, or transmit any environment file.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:47:system-reconnaissance","reason":"The line recommends request trace identifiers for observability. It performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:122:system-reconnaissance","reason":"The line describes normal latency troubleshooting with logs and traces. It contains no host, account, or network enumeration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:177:system-reconnaissance","reason":"The code decodes an application pagination cursor. It does not inspect the system or collect environmental information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:178:system-reconnaissance","reason":"The code adds an identifier comparison to a database query for pagination. It has no reconnaissance purpose.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-73-bits-possible-b","reason":"SKILL.md is readable UTF-8 Markdown with Chinese prose, tables, and examples. There is no encoded, encrypted, or binary payload.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Verbose Exception Disclosure","severity":"medium","locations":[{"file":"SKILL.md","line_end":164,"line_start":159}],"confidence":0.96,"description":"The FastAPI example returns raw exception text to clients, which can expose internal details or sensitive values.","confidence_reasoning":"The response directly places str(exc) in the client-visible message. This is a clear information disclosure pattern in the supplied example."}],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"315f6e5fcb9a63bc08af79bc5ed85286303b588555ba636295ba918f91df46b4","subject_tree_hash":"1bbbd9fa9b3b59f8e1ddb0ade74988e39ec5f35192d2d27b6416b0f1a6d7bb56","subject_plugin_path":"skills/zl2023github/backend-developer","audit_payload_hash":"e61c70e04740f29e05ff467f11c15440","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"315f6e5fcb9a63bc08af79bc5ed85286303b588555ba636295ba918f91df46b4","treeHash":"1bbbd9fa9b3b59f8e1ddb0ade74988e39ec5f35192d2d27b6416b0f1a6d7bb56","pluginPath":"skills/zl2023github/backend-developer","auditPayloadHash":"e61c70e04740f29e05ff467f11c15440"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/zl2023github-backend-developer/audits/4/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}