{"data":{"skill":{"slug":"zl2023github-devops-sre-engineer","name":"devops-sre-engineer","icon":"📦","repo":"https://github.com/zl2023github/software-engineer-skills/tree/main/software-engineering/devops-sre-engineer","status":"approved","author":"zl2023github","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"090e4e40-8f1c-43a2-a909-75283d85b0df","skill_id":"913569ae-654a-4d5d-b41c-fe3b33d22b8a","version":4,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:c6fb0ebf4cddf2a0e033add0fd2956ed482f103237b4714cc170507b4f9bdd17:22b0c5053b472fdd39770716f309a07794476a856c78526728397b31cda0ce7d:736b696c6c732f7a6c323032336769746875622f6465766f70732d7372652d656e67696e656572:c459eda4c77679da1d6fe1927c3bfe65","risk_level":"critical","is_blocked":true,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"blocked","manual_install_policy":"allowed_with_warning","summary":"Most alerts are false positives caused by Markdown backticks, placeholders, standard device handling, readable Chinese text, and routine local diagnostics. The Docker Bench example grants a remote image Docker socket and host namespace access, creating critical host compromise risk. Unpinned cluster installation, ungated destructive commands, and unrestricted load testing require correction before publication.","remediation":[{"issue":"The Docker Bench command exposes the Docker socket, host namespaces, and host data to an unpinned image.","severity":"critical","suggestion":"Use a pinned, verified image in an isolated test host. Require explicit approval before any Docker socket or host namespace access."},{"issue":"Destructive infrastructure commands appear without mandatory confirmation, scope checks, previews, or rollback validation.","severity":"high","suggestion":"Require explicit approval, dry runs, target verification, backups, and rollback plans before prune, drain, apply, destroy, or rollback operations."},{"issue":"High-rate load testing examples lack ownership checks, rate ceilings, and production safeguards.","severity":"high","suggestion":"Require written authorization, approved targets, staged rate increases, stop conditions, monitoring, and a prohibition on unapproved production testing."},{"issue":"The kube-bench example applies a manifest from a mutable remote branch.","severity":"medium","suggestion":"Pin an immutable commit, inspect the manifest, verify its source, and obtain approval before applying it to a cluster."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":45,"line_start":43},{"file":"SKILL.md","line_end":48,"line_start":45},{"file":"SKILL.md","line_end":52,"line_start":48},{"file":"SKILL.md","line_end":78,"line_start":52},{"file":"SKILL.md","line_end":80,"line_start":78},{"file":"SKILL.md","line_end":88,"line_start":80},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":116,"line_start":116},{"file":"SKILL.md","line_end":136,"line_start":128},{"file":"SKILL.md","line_end":138,"line_start":136},{"file":"SKILL.md","line_end":146,"line_start":138},{"file":"SKILL.md","line_end":146,"line_start":146},{"file":"SKILL.md","line_end":192,"line_start":190},{"file":"SKILL.md","line_end":205,"line_start":192},{"file":"SKILL.md","line_end":207,"line_start":205},{"file":"SKILL.md","line_end":210,"line_start":207},{"file":"SKILL.md","line_end":217,"line_start":210},{"file":"SKILL.md","line_end":240,"line_start":217},{"file":"SKILL.md","line_end":240,"line_start":240},{"file":"SKILL.md","line_end":257,"line_start":255},{"file":"SKILL.md","line_end":266,"line_start":257},{"file":"SKILL.md","line_end":296,"line_start":266},{"file":"SKILL.md","line_end":299,"line_start":296},{"file":"SKILL.md","line_end":345,"line_start":299},{"file":"SKILL.md","line_end":352,"line_start":345},{"file":"SKILL.md","line_end":354,"line_start":352},{"file":"SKILL.md","line_end":366,"line_start":354},{"file":"SKILL.md","line_end":394,"line_start":366},{"file":"SKILL.md","line_end":396,"line_start":394},{"file":"SKILL.md","line_end":420,"line_start":396},{"file":"SKILL.md","line_end":420,"line_start":420},{"file":"SKILL.md","line_end":424,"line_start":422},{"file":"SKILL.md","line_end":425,"line_start":424},{"file":"SKILL.md","line_end":431,"line_start":425},{"file":"SKILL.md","line_end":433,"line_start":431},{"file":"SKILL.md","line_end":455,"line_start":433},{"file":"SKILL.md","line_end":538,"line_start":455},{"file":"SKILL.md","line_end":544,"line_start":538},{"file":"SKILL.md","line_end":575,"line_start":544},{"file":"SKILL.md","line_end":579,"line_start":575},{"file":"SKILL.md","line_end":613,"line_start":579},{"file":"SKILL.md","line_end":617,"line_start":613},{"file":"SKILL.md","line_end":649,"line_start":617},{"file":"SKILL.md","line_end":653,"line_start":649},{"file":"SKILL.md","line_end":687,"line_start":653},{"file":"SKILL.md","line_end":691,"line_start":687},{"file":"SKILL.md","line_end":726,"line_start":691},{"file":"SKILL.md","line_end":730,"line_start":726},{"file":"SKILL.md","line_end":760,"line_start":730},{"file":"SKILL.md","line_end":806,"line_start":760}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":217,"line_start":217},{"file":"SKILL.md","line_end":278,"line_start":278},{"file":"SKILL.md","line_end":425,"line_start":425},{"file":"SKILL.md","line_end":512,"line_start":512},{"file":"SKILL.md","line_end":513,"line_start":513},{"file":"SKILL.md","line_end":524,"line_start":524},{"file":"SKILL.md","line_end":525,"line_start":525}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":278,"line_start":278},{"file":"SKILL.md","line_end":513,"line_start":513},{"file":"SKILL.md","line_end":528,"line_start":528}]}],"critical_findings":[{"title":"Docker socket access","locations":[{"file":"SKILL.md","line_end":424,"line_start":424}],"confidence":0.99,"description":"- **Docker Bench Security**:`docker run --net host --pid host --userns host --cap-add audit_control ","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The command mounts `/var/run/docker.sock` into a remote image with host namespaces and host data. Docker socket control can provide effective root access."}],"high_findings":[{"title":"System reconnaissance","locations":[{"file":"SKILL.md","line_end":424,"line_start":424}],"confidence":0.97,"description":"- **Docker Bench Security**:`docker run --net host --pid host --userns host --cap-add audit_control ","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The container joins host network, PID, and user namespaces while inspecting `/var/lib`. This grants extensive host visibility beyond ordinary container isolation."},{"title":"Destructive Infrastructure Commands Lack Execution Gates","locations":[{"file":"SKILL.md","line_end":488,"line_start":455}],"confidence":0.97,"description":"The execution-oriented skill presents prune, drain, apply, destroy, and rollback commands without mandatory confirmation, scope validation, previews, backups, or rollback checks.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The command reference directly includes destructive operations, while the surrounding instructions provide no execution gate for this section."},{"title":"Unrestricted Load Testing Can Disrupt Services","locations":[{"file":"SKILL.md","line_end":217,"line_start":210},{"file":"SKILL.md","line_end":525,"line_start":521}],"confidence":0.97,"description":"The skill recommends high-rate tests against a target without requiring ownership, authorization, environment isolation, rate ceilings, monitoring, or stop conditions.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The examples specify 100 to 1,000 concurrent or per-second requests, and no nearby text limits them to authorized non-production targets."}],"medium_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":425,"line_start":425}],"confidence":0.98,"description":"- **kube-bench**:`kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/jo","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The command applies a Kubernetes manifest directly from a mutable GitHub `main` branch. Upstream changes could alter cluster resources without local review."}],"low_findings":[],"dangerous_patterns":[{"title":"Docker socket access","locations":[{"file":"SKILL.md","line_end":424,"line_start":424}],"confidence":0.99,"description":"- **Docker Bench Security**:`docker run --net host --pid host --userns host --cap-add audit_control ","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The command mounts `/var/run/docker.sock` into a remote image with host namespaces and host data. Docker socket control can provide effective root access."},{"title":"System reconnaissance","locations":[{"file":"SKILL.md","line_end":424,"line_start":424}],"confidence":0.97,"description":"- **Docker Bench Security**:`docker run --net host --pid host --userns host --cap-add audit_control ","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The container joins host network, PID, and user namespaces while inspecting `/var/lib`. This grants extensive host visibility beyond ordinary container isolation."}],"files_scanned":1,"total_lines":847,"audit_model":"codex","audited_at":"2026-07-23T23:32:07.738+00:00","created_at":"2026-07-26T17:16:32.11442+00:00","static_findings":[{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":45,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":48,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **GitHub Actions**:编写 `.github/workflows/*.yml`","category":"external_commands","line_end":52,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **GitLab CI**:编写 `.gitlab-ci.yml`","category":"external_commands","line_end":78,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":88,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Pod 排障:`kubectl describe`, `kubectl logs`, `kubectl exec`, `kubectl port-forward`","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `terraform plan` → `terraform apply` 工作流","category":"external_commands","line_end":116,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `terraform plan` 必须人工审查后再 apply","category":"external_commands","line_end":136,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":138,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":146,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- PromQL 查询:`rate(http_requests_total[5m])`, `histogram_quantile(0.99, ...)`","category":"external_commands","line_end":146,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":192,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":205,"severity":"medium","line_start":192},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":207,"severity":"medium","line_start":205},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":210,"severity":"medium","line_start":207},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **k6**:`k6 run --vus 100 --duration 60s script.js`","category":"external_commands","line_end":217,"severity":"medium","line_start":210},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Vegeta**:`echo \"GET http://target\" | vegeta attack -rate=1000 -duration=60s | vegeta report`","category":"external_commands","line_end":240,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **自建脚本**:`tc` 网络模拟、`stress` 压力工具","category":"external_commands","line_end":240,"severity":"medium","line_start":240},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":257,"severity":"medium","line_start":255},{"id":"external_commands:SKILL.md:257:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":266,"severity":"medium","line_start":257},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":296,"severity":"medium","line_start":266},{"id":"external_commands:SKILL.md:296:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":299,"severity":"medium","line_start":296},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":345,"severity":"medium","line_start":299},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":352,"severity":"medium","line_start":345},{"id":"external_commands:SKILL.md:352:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":354,"severity":"medium","line_start":352},{"id":"external_commands:SKILL.md:354:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":366,"severity":"medium","line_start":354},{"id":"external_commands:SKILL.md:366:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Infracost:`infracost breakdown --path .` Terraform 成本预估","category":"external_commands","line_end":394,"severity":"medium","line_start":366},{"id":"external_commands:SKILL.md:394:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":396,"severity":"medium","line_start":394},{"id":"external_commands:SKILL.md:396:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":420,"severity":"medium","line_start":396},{"id":"external_commands:SKILL.md:420:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Trivy**:`trivy image <image>` / `trivy fs --scanners vuln,secret,misconfig <path>` / `trivy repo","category":"external_commands","line_end":420,"severity":"medium","line_start":420},{"id":"external_commands:SKILL.md:422:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Semgrep**:`semgrep --config=auto --config=p/r2c-security-audit <path>`","category":"external_commands","line_end":424,"severity":"medium","line_start":422},{"id":"external_commands:SKILL.md:424:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Docker Bench Security**:`docker run --net host --pid host --userns host --cap-add audit_control ","category":"external_commands","line_end":425,"severity":"medium","line_start":424},{"id":"external_commands:SKILL.md:425:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **kube-bench**:`kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/jo","category":"external_commands","line_end":431,"severity":"medium","line_start":425},{"id":"external_commands:SKILL.md:431:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":433,"severity":"medium","line_start":431},{"id":"external_commands:SKILL.md:433:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":455,"severity":"medium","line_start":433},{"id":"external_commands:SKILL.md:455:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":538,"severity":"medium","line_start":455},{"id":"external_commands:SKILL.md:538:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":544,"severity":"medium","line_start":538},{"id":"external_commands:SKILL.md:544:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":575,"severity":"medium","line_start":544},{"id":"external_commands:SKILL.md:575:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":579,"severity":"medium","line_start":575},{"id":"external_commands:SKILL.md:579:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":613,"severity":"medium","line_start":579},{"id":"external_commands:SKILL.md:613:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":617,"severity":"medium","line_start":613},{"id":"external_commands:SKILL.md:617:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":649,"severity":"medium","line_start":617},{"id":"external_commands:SKILL.md:649:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":653,"severity":"medium","line_start":649},{"id":"external_commands:SKILL.md:653:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":687,"severity":"medium","line_start":653},{"id":"external_commands:SKILL.md:687:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":691,"severity":"medium","line_start":687},{"id":"external_commands:SKILL.md:691:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":726,"severity":"medium","line_start":691},{"id":"external_commands:SKILL.md:726:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":730,"severity":"medium","line_start":726},{"id":"external_commands:SKILL.md:730:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":760,"severity":"medium","line_start":730},{"id":"external_commands:SKILL.md:760:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":806,"severity":"medium","line_start":760},{"id":"external_commands:SKILL.md:806:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `ops-engineer` | 基础设施管理、容器与 K8s、监控告警、故障排查等运维操作 |","category":"external_commands","line_end":807,"severity":"medium","line_start":806},{"id":"external_commands:SKILL.md:807:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `security-engineer` | 安全扫描、DevSecOps 集成、安全加固 |","category":"external_commands","line_end":808,"severity":"medium","line_start":807},{"id":"external_commands:SKILL.md:808:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `backend-developer` | 应用层性能优化、代码审查、API 开发 |","category":"external_commands","line_end":809,"severity":"medium","line_start":808},{"id":"external_commands:SKILL.md:809:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `arch-c4-diagram` | 需要画部署架构图时加载 |","category":"external_commands","line_end":810,"severity":"medium","line_start":809},{"id":"external_commands:SKILL.md:810:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `arch-adr` | 需要记录架构/运维决策时加载 |","category":"external_commands","line_end":811,"severity":"medium","line_start":810},{"id":"external_commands:SKILL.md:811:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `arch-tech-evaluation` | 需要工具选型时加载 |","category":"external_commands","line_end":812,"severity":"medium","line_start":811},{"id":"external_commands:SKILL.md:812:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `chinese-pdf-generation` | 将报告/文档输出为 PDF |","category":"external_commands","line_end":838,"severity":"medium","line_start":812},{"id":"external_commands:SKILL.md:838:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":846,"severity":"medium","line_start":838},{"id":"network:SKILL.md:217:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Vegeta**:`echo \"GET http://target\" | vegeta attack -rate=1000 -duration=60s | vegeta report`","category":"network","line_end":217,"severity":"low","line_start":217},{"id":"network:SKILL.md:278:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -o /dev/null -s -w 'Total: %{time_total}s\\n' http://target","category":"network","line_end":278,"severity":"low","line_start":278},{"id":"network:SKILL.md:425:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **kube-bench**:`kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/jo","category":"network","line_end":425,"severity":"low","line_start":425},{"id":"network:SKILL.md:512:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -v http://target","category":"network","line_end":512,"severity":"low","line_start":512},{"id":"network:SKILL.md:513:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -o /dev/null -s -w 'Total: %{time_total}s\\n' http://target","category":"network","line_end":513,"severity":"low","line_start":513},{"id":"network:SKILL.md:524:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"hey -n 10000 -c 100 http://target","category":"network","line_end":524,"severity":"low","line_start":524},{"id":"network:SKILL.md:525:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"ab -n 10000 -c 100 http://target","category":"network","line_end":525,"severity":"low","line_start":525},{"id":"filesystem:SKILL.md:278:standard-device-file-access","file":"SKILL.md","pattern":"Standard device file access","snippet":"curl -o /dev/null -s -w 'Total: %{time_total}s\\n' http://target","category":"filesystem","line_end":278,"severity":"low","line_start":278},{"id":"filesystem:SKILL.md:513:standard-device-file-access","file":"SKILL.md","pattern":"Standard device file access","snippet":"curl -o /dev/null -s -w 'Total: %{time_total}s\\n' http://target","category":"filesystem","line_end":513,"severity":"low","line_start":513},{"id":"filesystem:SKILL.md:528:standard-device-file-access","file":"SKILL.md","pattern":"Standard device file access","snippet":"openssl s_client -connect <host>:443 -servername <host> 2>/dev/null | openssl x509 -noout -dates","category":"filesystem","line_end":528,"severity":"low","line_start":528},{"id":"blocker:SKILL.md:424:docker-socket-access","file":"SKILL.md","pattern":"Docker socket access","snippet":"- **Docker Bench Security**:`docker run --net host --pid host --userns host --cap-add audit_control ","category":"blocker","line_end":424,"severity":"critical","line_start":424},{"id":"blocker:SKILL.md:424:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Docker Bench Security**:`docker run --net host --pid host --userns host --cap-add audit_control ","category":"blocker","line_end":424,"severity":"low","line_start":424},{"id":"blocker:SKILL.md:799:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| 架构图 | Mermaid | 部署架构、网络拓扑、CI/CD 流程 |","category":"blocker","line_end":799,"severity":"low","line_start":799},{"id":"blocker:SKILL.md:273:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"ss -tlnp             # 监听端口","category":"blocker","line_end":273,"severity":"low","line_start":273},{"id":"blocker:SKILL.md:274:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"ss -s                # 连接统计","category":"blocker","line_end":274,"severity":"low","line_start":274},{"id":"blocker:SKILL.md:518:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"ss -tlnp","category":"blocker","line_end":518,"severity":"low","line_start":518},{"id":"blocker:SKILL.md:519:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"ss -s","category":"blocker","line_end":519,"severity":"low","line_start":519},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-74-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.74 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"Lines 43-45 are a Markdown workflow diagram inside a fenced block. They contain no Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The detected characters close a Markdown workflow block. No command substitution or executable Ruby expression is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"Backticks format the `.github/workflows/*.yml` path in prose. They do not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"Backticks format the `.gitlab-ci.yml` filename in a tool description. They are Markdown, not shell or Ruby execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"Lines 78-80 contain a fenced Markdown workflow diagram. The fence is not an executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The match is the closing fence for a Markdown diagram. No interpreter invocation or command substitution exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"Backticks format a list of kubectl troubleshooting commands. The Markdown file does not execute them through Ruby or shell substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"The Terraform workflow is inline Markdown documentation. No backtick execution mechanism is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"Backticks only format `terraform plan` in a human-review requirement. They are not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"The match opens a fenced Markdown workflow diagram. It contains no Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"The match closes a fenced Markdown workflow diagram. It is formatting rather than command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"Backticks format PromQL query examples. PromQL expressions are documented but not executed by the Markdown file.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"Lines 190-192 are a fenced SRE workflow diagram. The fence is not executable backtick syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","reason":"The detected characters close a Markdown workflow block. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"The match opens a fenced capacity-planning diagram. It is Markdown formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","reason":"The match closes a fenced Markdown diagram. It does not invoke a Ruby or shell runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","reason":"Backticks format a k6 command example in prose. The static pattern misidentifies inline Markdown as Ruby execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"Backticks format a Vegeta load-test example. The operational authorization risk is separate from the claimed backtick execution pattern.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","reason":"Backticks format the `tc` and `stress` tool names. They do not create command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","reason":"The match opens a fenced incident-response workflow. It is Markdown formatting, not executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:257:ruby-shell-backtick-execution","reason":"The match closes a fenced workflow block. No Ruby or shell backtick expression is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","reason":"Line 266 opens a labeled Bash example block. A Markdown code fence does not itself execute the documented commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:296:ruby-shell-backtick-execution","reason":"Line 296 closes a Bash example block. The backticks are Markdown delimiters without execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","reason":"Line 299 opens a labeled Markdown postmortem template. It is documentation rather than executable Ruby or shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","reason":"Line 345 closes the postmortem template block. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:352:ruby-shell-backtick-execution","reason":"The match opens a fenced cost-optimization workflow. The fence is Markdown formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:354:ruby-shell-backtick-execution","reason":"The match closes a fenced cost workflow. It has no execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:366:ruby-shell-backtick-execution","reason":"Backticks format an Infracost command example. The Markdown source does not execute it.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:394:ruby-shell-backtick-execution","reason":"The match opens a fenced GitOps workflow diagram. It is not Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:396:ruby-shell-backtick-execution","reason":"The match closes a fenced GitOps diagram. No executable expression exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:420:ruby-shell-backtick-execution","reason":"Backticks format Trivy examples in a security-tool list. They are inline documentation, not Ruby execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:422:ruby-shell-backtick-execution","reason":"Backticks format a Semgrep command example. The claimed backtick execution pattern is absent.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:424:ruby-shell-backtick-execution","reason":"Backticks delimit an inline Docker command, not Ruby execution. The dangerous Docker socket access is assessed by its dedicated finding.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:425:ruby-shell-backtick-execution","reason":"Backticks format a kubectl example. Its mutable remote manifest risk is assessed by the matching network finding.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:431:ruby-shell-backtick-execution","reason":"The match opens a fenced DevSecOps workflow diagram. It is Markdown formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:433:ruby-shell-backtick-execution","reason":"The match closes a fenced DevSecOps workflow. It does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:455:ruby-shell-backtick-execution","reason":"Line 455 opens a labeled Bash reference block. The fence is not Ruby backtick execution; command safety is assessed semantically.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:538:ruby-shell-backtick-execution","reason":"Line 538 closes the Bash reference block. The Markdown fence itself has no execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:544:ruby-shell-backtick-execution","reason":"The match opens a fenced CI/CD scenario diagram. It is not an executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:575:ruby-shell-backtick-execution","reason":"The match closes a fenced CI/CD scenario. No command execution is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:579:ruby-shell-backtick-execution","reason":"The match opens a fenced incident scenario diagram. It is Markdown formatting.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:613:ruby-shell-backtick-execution","reason":"The match closes a fenced incident scenario. No Ruby or shell backtick execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:617:ruby-shell-backtick-execution","reason":"The match opens a fenced observability scenario diagram. It is documentation only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:649:ruby-shell-backtick-execution","reason":"The match closes a fenced observability scenario. It has no execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:653:ruby-shell-backtick-execution","reason":"The match opens a fenced SLO scenario diagram. It is not Ruby or shell substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:687:ruby-shell-backtick-execution","reason":"The match closes a fenced SLO scenario. No interpreter executes this content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:691:ruby-shell-backtick-execution","reason":"The match opens a fenced Kubernetes troubleshooting diagram. It is Markdown formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:726:ruby-shell-backtick-execution","reason":"The match closes a fenced Kubernetes scenario. It does not execute the described operations.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:730:ruby-shell-backtick-execution","reason":"The match opens a fenced cost-analysis scenario. It is not executable backtick syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:760:ruby-shell-backtick-execution","reason":"The match closes a fenced cost-analysis scenario. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:806:ruby-shell-backtick-execution","reason":"Backticks format the `ops-engineer` skill name inside a Markdown table. They do not execute code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:807:ruby-shell-backtick-execution","reason":"Backticks format the `security-engineer` skill name in a table. No executable expression is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:808:ruby-shell-backtick-execution","reason":"Backticks format the `backend-developer` skill name. This is plain Markdown text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:809:ruby-shell-backtick-execution","reason":"Backticks format the `arch-c4-diagram` skill name in a reuse table. They have no execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:810:ruby-shell-backtick-execution","reason":"Backticks format the `arch-adr` skill name. They are not shell or Ruby syntax in this Markdown context.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:811:ruby-shell-backtick-execution","reason":"Backticks format the `arch-tech-evaluation` skill name. No command execution is possible from this table entry.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:812:ruby-shell-backtick-execution","reason":"Backticks format the `chinese-pdf-generation` skill name. The content is a Markdown table, not executable Ruby.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:838:ruby-shell-backtick-execution","reason":"Line 838 opens a fenced collaboration diagram. The backticks are Markdown delimiters without execution semantics.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:217:hardcoded-url","reason":"`http://target` is an explicit placeholder in a documented Vegeta example, not a fixed external endpoint.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:278:hardcoded-url","reason":"`http://target` is a placeholder for an operator-selected service. No real destination is hardcoded.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:425:hardcoded-url","reason":"The command applies a Kubernetes manifest directly from a mutable GitHub `main` branch. Upstream changes could alter cluster resources without local review.","verdict":"confirmed","severity":"medium","confidence":0.98},{"id":"network:SKILL.md:512:hardcoded-url","reason":"`http://target` is a generic troubleshooting placeholder rather than a hardcoded third-party destination.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:513:hardcoded-url","reason":"`http://target` is a placeholder used in a curl timing example. It does not identify an external service.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:524:hardcoded-url","reason":"`http://target` marks an operator-supplied load-test destination. The lack of authorization controls is captured separately.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:525:hardcoded-url","reason":"`http://target` is an example placeholder, not a real hardcoded endpoint. Load-test misuse is addressed by a semantic finding.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:278:standard-device-file-access","reason":"The curl example writes discarded response data to `/dev/null`. This standard device use does not read, alter, or expose user files.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:513:standard-device-file-access","reason":"Writing curl output to `/dev/null` safely discards response content for timing. It is not sensitive filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:528:standard-device-file-access","reason":"Redirecting OpenSSL diagnostic errors to `/dev/null` only suppresses stderr. It does not access ordinary files or sensitive data.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:424:docker-socket-access","reason":"The command mounts `/var/run/docker.sock` into a remote image with host namespaces and host data. Docker socket control can provide effective root access.","verdict":"confirmed","severity":"critical","confidence":0.99},{"id":"blocker:SKILL.md:424:system-reconnaissance","reason":"The container joins host network, PID, and user namespaces while inspecting `/var/lib`. This grants extensive host visibility beyond ordinary container isolation.","verdict":"confirmed","severity":"high","confidence":0.97},{"id":"blocker:SKILL.md:799:system-reconnaissance","reason":"Line 799 only lists network topology as a possible Mermaid diagram output. It performs no host or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:273:network-reconnaissance","reason":"`ss -tlnp` passively lists local listening sockets for incident diagnosis. It does not probe remote hosts or scan a network.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:274:network-reconnaissance","reason":"`ss -s` reports aggregate local socket statistics. It is routine host diagnostics, not active network reconnaissance.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:518:network-reconnaissance","reason":"The repeated `ss -tlnp` example passively inspects local listening sockets. It does not enumerate remote systems.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:519:network-reconnaissance","reason":"The repeated `ss -s` example displays local connection statistics only. No remote reconnaissance behavior is shown.","verdict":"false_positive","confidence":0.97},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-74-bits-possible-b","reason":"SKILL.md is readable Chinese and English Markdown with code examples and tables. It contains no encoded, encrypted, or binary payload.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Destructive Infrastructure Commands Lack Execution Gates","severity":"high","locations":[{"file":"SKILL.md","line_end":488,"line_start":455}],"confidence":0.97,"description":"The execution-oriented skill presents prune, drain, apply, destroy, and rollback commands without mandatory confirmation, scope validation, previews, backups, or rollback checks.","confidence_reasoning":"The command reference directly includes destructive operations, while the surrounding instructions provide no execution gate for this section."},{"title":"Unrestricted Load Testing Can Disrupt Services","severity":"high","locations":[{"file":"SKILL.md","line_end":217,"line_start":210},{"file":"SKILL.md","line_end":525,"line_start":521}],"confidence":0.97,"description":"The skill recommends high-rate tests against a target without requiring ownership, authorization, environment isolation, rate ceilings, monitoring, or stop conditions.","confidence_reasoning":"The examples specify 100 to 1,000 concurrent or per-second requests, and no nearby text limits them to authorized non-production targets."}],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"c6fb0ebf4cddf2a0e033add0fd2956ed482f103237b4714cc170507b4f9bdd17","subject_tree_hash":"22b0c5053b472fdd39770716f309a07794476a856c78526728397b31cda0ce7d","subject_plugin_path":"skills/zl2023github/devops-sre-engineer","audit_payload_hash":"c459eda4c77679da1d6fe1927c3bfe65","confirmed_risk_level":"critical","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"c6fb0ebf4cddf2a0e033add0fd2956ed482f103237b4714cc170507b4f9bdd17","treeHash":"22b0c5053b472fdd39770716f309a07794476a856c78526728397b31cda0ce7d","pluginPath":"skills/zl2023github/devops-sre-engineer","auditPayloadHash":"c459eda4c77679da1d6fe1927c3bfe65"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/zl2023github-devops-sre-engineer/audits/4/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"critical","confirmedFindingCount":4,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"blocked","manualInstallPolicy":"allowed_with_warning","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}