{"data":{"skill":{"slug":"zl2023github-mobile-engineer","name":"mobile-engineer","icon":"📦","repo":"https://github.com/zl2023github/software-engineer-skills/tree/main/software-engineering/mobile-engineer","status":"approved","author":"zl2023github","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"878da1a1-3f72-48ae-8048-71b3504df706","skill_id":"f2184825-a589-4109-9c76-38e50914fe94","version":4,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:255f67296ce187b1aab2dabdf3b860276ae5c23b5660b3721d50cacb10a8ba0f:5b62f7c97ac3cac238e33b793803bf8f7609e2f020e73f9aa1443e6cac05a4ab:736b696c6c732f7a6c323032336769746875622f6d6f62696c652d656e67696e656572:0096cecd24ae3f6144b180ac851663d3","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 55 static alerts are false positives caused by Markdown syntax, mobile tool names, explicit HTTPS examples, and a fixed Xcode cache path. No prompt injection, credential exposure, obfuscated payload, host reconnaissance, or unbounded root deletion appears in the reviewed files. Semantic review identified unpinned package execution and unconditional response-body logging as medium risks.","remediation":[{"issue":"Unpinned package bootstrapping","severity":"medium","suggestion":"Pin npx tools and dependencies to reviewed versions, commit lockfiles, and verify package integrity before execution."},{"issue":"API response logging","severity":"medium","suggestion":"Enable body logging only in debug builds, redact sensitive fields, and disable the interceptor in production."},{"issue":"Recursive cache deletion","severity":"low","suggestion":"Require confirmation before cleanup and verify the resolved path remains inside the Xcode DerivedData directory."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"references/tools-quickref.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":114,"line_start":114},{"file":"SKILL.md","line_end":212,"line_start":212},{"file":"SKILL.md","line_end":213,"line_start":213},{"file":"SKILL.md","line_end":217,"line_start":217},{"file":"SKILL.md","line_end":218,"line_start":218},{"file":"SKILL.md","line_end":223,"line_start":223}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":40,"line_start":35},{"file":"SKILL.md","line_end":43,"line_start":40},{"file":"SKILL.md","line_end":47,"line_start":43},{"file":"SKILL.md","line_end":79,"line_start":47},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":94,"line_start":83},{"file":"SKILL.md","line_end":97,"line_start":94},{"file":"SKILL.md","line_end":103,"line_start":97},{"file":"SKILL.md","line_end":107,"line_start":103},{"file":"SKILL.md","line_end":122,"line_start":107},{"file":"SKILL.md","line_end":145,"line_start":122},{"file":"SKILL.md","line_end":153,"line_start":145},{"file":"SKILL.md","line_end":157,"line_start":153},{"file":"SKILL.md","line_end":169,"line_start":157},{"file":"SKILL.md","line_end":173,"line_start":169},{"file":"SKILL.md","line_end":181,"line_start":173},{"file":"SKILL.md","line_end":198,"line_start":181},{"file":"SKILL.md","line_end":198,"line_start":198},{"file":"SKILL.md","line_end":210,"line_start":200},{"file":"SKILL.md","line_end":224,"line_start":210},{"file":"SKILL.md","line_end":228,"line_start":224},{"file":"SKILL.md","line_end":234,"line_start":228}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Unpinned Package Execution","locations":[{"file":"SKILL.md","line_end":46,"line_start":43},{"file":"references/tools-quickref.md","line_end":37,"line_start":35}],"confidence":0.92,"description":"Setup examples invoke react-native@latest, unversioned create-expo-app, and unpinned npm dependencies. A compromised future release could execute during project initialization or installation.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The commands directly resolve and execute packages without immutable versions or integrity controls. This is a recognized software supply-chain exposure."},{"title":"Unconditional API Response Logging","locations":[{"file":"SKILL.md","line_end":119,"line_start":118}],"confidence":0.94,"description":"The API example enables response-body logging without a release guard. Responses may contain tokens or personal data that can reach device or CI logs.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The interceptor is added unconditionally with responseBody enabled. The example shows no environment check, redaction, or production disablement."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":326,"audit_model":"codex","audited_at":"2026-07-23T23:41:42.171+00:00","created_at":"2026-07-26T17:16:51.147885+00:00","static_findings":[{"id":"network:references/tools-quickref.md:37:http-client-library","file":"references/tools-quickref.md","pattern":"HTTP client library","snippet":"npm install @react-navigation/native zustand axios","category":"network","line_end":37,"severity":"low","line_start":37},{"id":"sensitive:references/tools-quickref.md:77:npm-config-file-may-contain-tokens","file":"references/tools-quickref.md","pattern":"NPM config file (may contain tokens)","snippet":"| npm | `https://registry.npmmirror.com` | `.npmrc` registry |","category":"sensitive","line_end":77,"severity":"high","line_start":77},{"id":"blocker:references/tools-quickref.md:64:recursive-delete-on-root-home","file":"references/tools-quickref.md","pattern":"Recursive delete on root/home","snippet":"| 清理缓存 | `flutter clean` | `cd android && ./gradlew clean` | `./gradlew clean` | `rm -rf ~/Library/D","category":"blocker","line_end":64,"severity":"critical","line_start":64},{"id":"blocker:references/tools-quickref.md:5:system-reconnaissance","file":"references/tools-quickref.md","pattern":"System reconnaissance","snippet":"| 领域 | iOS 原生 | Android 原生 | Flutter | React Native |","category":"blocker","line_end":5,"severity":"low","line_start":5},{"id":"blocker:references/tools-quickref.md:7:system-reconnaissance","file":"references/tools-quickref.md","pattern":"System reconnaissance","snippet":"| IDE | Xcode | Android Studio | VS Code / Android Studio | VS Code / Flipper |","category":"blocker","line_end":7,"severity":"low","line_start":7},{"id":"blocker:references/tools-quickref.md:26:system-reconnaissance","file":"references/tools-quickref.md","pattern":"System reconnaissance","snippet":"flutter create --org com.example --project-name my_app --platforms ios,android .","category":"blocker","line_end":26,"severity":"low","line_start":26},{"id":"blocker:references/tools-quickref.md:38:system-reconnaissance","file":"references/tools-quickref.md","pattern":"System reconnaissance","snippet":"npx react-native run-android","category":"blocker","line_end":39,"severity":"low","line_start":38},{"id":"blocker:references/tools-quickref.md:42:system-reconnaissance","file":"references/tools-quickref.md","pattern":"System reconnaissance","snippet":"### Android 原生","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:references/tools-quickref.md:58:system-reconnaissance","file":"references/tools-quickref.md","pattern":"System reconnaissance","snippet":"| 操作 | Flutter | React Native | Android | iOS |","category":"blocker","line_end":58,"severity":"low","line_start":58},{"id":"blocker:references/tools-quickref.md:60:system-reconnaissance","file":"references/tools-quickref.md","pattern":"System reconnaissance","snippet":"| 创建项目 | `flutter create` | `npx react-native init` | Android Studio | Xcode |","category":"blocker","line_end":60,"severity":"low","line_start":60},{"id":"blocker:references/tools-quickref.md:62:system-reconnaissance","file":"references/tools-quickref.md","pattern":"System reconnaissance","snippet":"| 构建发布 | `flutter build apk/ios` | `cd android && ./gradlew assembleRelease` | `./gradlew assembleRe","category":"blocker","line_end":62,"severity":"low","line_start":62},{"id":"blocker:references/tools-quickref.md:64:system-reconnaissance","file":"references/tools-quickref.md","pattern":"System reconnaissance","snippet":"| 清理缓存 | `flutter clean` | `cd android && ./gradlew clean` | `./gradlew clean` | `rm -rf ~/Library/D","category":"blocker","line_end":64,"severity":"low","line_start":64},{"id":"blocker:references/tools-quickref.md:81:system-reconnaissance","file":"references/tools-quickref.md","pattern":"System reconnaissance","snippet":"| 操作 | Flutter | React Native | Android | iOS |","category":"blocker","line_end":81,"severity":"low","line_start":81},{"id":"blocker:references/tools-quickref.md:83:system-reconnaissance","file":"references/tools-quickref.md","pattern":"System reconnaissance","snippet":"| 创建项目 | `flutter create` | `npx react-native init` | Android Studio | Xcode |","category":"blocker","line_end":83,"severity":"low","line_start":83},{"id":"blocker:references/tools-quickref.md:85:system-reconnaissance","file":"references/tools-quickref.md","pattern":"System reconnaissance","snippet":"| 构建发布 | `flutter build apk/ios` | `cd android && ./gradlew assembleRelease` | `./gradlew assembleRe","category":"blocker","line_end":85,"severity":"low","line_start":85},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":40,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":43,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":47,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":79,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 支持深色模式:`ThemeMode.dark` / `@media (prefers-color-scheme: dark)`","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```dart","category":"external_commands","line_end":94,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":97,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":103,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":107,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```dart","category":"external_commands","line_end":122,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":145,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":153,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":157,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":169,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":173,"severity":"medium","line_start":169},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```ruby","category":"external_commands","line_end":181,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":198,"severity":"medium","line_start":181},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. 清理缓存:`flutter clean` / `./gradlew clean` / `rm -rf ~/Library/Developer/Xcode/DerivedData`","category":"external_commands","line_end":198,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. iOS CocoaPods:`pod deintegrate && pod install`","category":"external_commands","line_end":210,"severity":"medium","line_start":200},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":224,"severity":"medium","line_start":210},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":228,"severity":"medium","line_start":224},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `references/tools-quickref.md` — 各平台核心工具链速查表、关键命令、国内镜像源","category":"external_commands","line_end":234,"severity":"medium","line_start":228},{"id":"network:SKILL.md:37:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"export PUB_HOSTED_URL=https://mirrors.nju.edu.cn/dart-pub","category":"network","line_end":37,"severity":"low","line_start":37},{"id":"network:SKILL.md:38:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"export FLUTTER_STORAGE_BASE_URL=https://mirrors.nju.edu.cn/flutter","category":"network","line_end":38,"severity":"low","line_start":38},{"id":"network:SKILL.md:114:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"baseUrl: 'https://api.example.com',","category":"network","line_end":114,"severity":"low","line_start":114},{"id":"network:SKILL.md:212:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"export PUB_HOSTED_URL=https://mirrors.nju.edu.cn/dart-pub","category":"network","line_end":212,"severity":"low","line_start":212},{"id":"network:SKILL.md:213:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"export FLUTTER_STORAGE_BASE_URL=https://mirrors.nju.edu.cn/flutter","category":"network","line_end":213,"severity":"low","line_start":213},{"id":"network:SKILL.md:217:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"maven { url = uri(\"https://maven.aliyun.com/repository/public\") }","category":"network","line_end":217,"severity":"low","line_start":217},{"id":"network:SKILL.md:218:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"maven { url = uri(\"https://maven.aliyun.com/repository/google\") }","category":"network","line_end":218,"severity":"low","line_start":218},{"id":"network:SKILL.md:223:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"source 'https://cdn.cocoapods.org/'","category":"network","line_end":223,"severity":"low","line_start":223},{"id":"blocker:SKILL.md:198:recursive-delete-on-root-home","file":"SKILL.md","pattern":"Recursive delete on root/home","snippet":"2. 清理缓存:`flutter clean` / `./gradlew clean` / `rm -rf ~/Library/Developer/Xcode/DerivedData`","category":"blocker","line_end":198,"severity":"critical","line_start":198},{"id":"blocker:SKILL.md:39:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"flutter create --org com.example --project-name my_app --platforms ios,android .","category":"blocker","line_end":39,"severity":"low","line_start":39},{"id":"blocker:SKILL.md:49:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"#### Android 原生项目","category":"blocker","line_end":49,"severity":"low","line_start":49},{"id":"blocker:SKILL.md:50:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- 使用 Android Studio 创建,或从模板生成","category":"blocker","line_end":50,"severity":"low","line_start":50},{"id":"blocker:SKILL.md:70:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"**Android 推荐**:Jetpack Compose + Hilt + Room + Retrofit + Navigation Compose","category":"blocker","line_end":70,"severity":"low","line_start":70},{"id":"blocker:SKILL.md:129:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Android | Room | 关系型数据 |","category":"blocker","line_end":129,"severity":"low","line_start":129},{"id":"blocker:SKILL.md:146:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"# Android 混淆配置 (proguard-rules.pro)","category":"blocker","line_end":146,"severity":"low","line_start":146},{"id":"blocker:SKILL.md:163:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"# Android","category":"blocker","line_end":164,"severity":"low","line_start":163},{"id":"blocker:SKILL.md:215:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"# Android Gradle 镜像 (build.gradle.kts)","category":"blocker","line_end":215,"severity":"low","line_start":215},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-44-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.44 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"network:references/tools-quickref.md:37:http-client-library","reason":"This is a documented npm installation example. Axios is only named as a dependency; no request, destination, or data transfer appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:references/tools-quickref.md:77:npm-config-file-may-contain-tokens","reason":"The line names the .npmrc registry setting and an HTTPS mirror. It contains no token, credential, authentication field, or secret value.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tools-quickref.md:64:recursive-delete-on-root-home","reason":"The command targets the fixed Xcode DerivedData cache directory, not the filesystem root or the home directory itself. No user-controlled path is interpolated.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/tools-quickref.md:5:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tools-quickref.md:7:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tools-quickref.md:26:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tools-quickref.md:38:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tools-quickref.md:42:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tools-quickref.md:58:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tools-quickref.md:60:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tools-quickref.md:62:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tools-quickref.md:64:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tools-quickref.md:81:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tools-quickref.md:83:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/tools-quickref.md:85:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"The detector matched Markdown code fences or inline code in documentation, not Ruby shell backtick execution. The examples contain no dynamic command construction or untrusted interpolation.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:37:hardcoded-url","reason":"The URL is an explicit HTTPS package repository configuration in documentation. It neither conceals its destination nor sends credentials or user data.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:38:hardcoded-url","reason":"The URL is an explicit HTTPS package repository configuration in documentation. It neither conceals its destination nor sends credentials or user data.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:114:hardcoded-url","reason":"The URL uses the reserved example.com domain as an API placeholder. It is illustrative and does not identify an operational collection endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:212:hardcoded-url","reason":"The URL is an explicit HTTPS package repository configuration in documentation. It neither conceals its destination nor sends credentials or user data.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:213:hardcoded-url","reason":"The URL is an explicit HTTPS package repository configuration in documentation. It neither conceals its destination nor sends credentials or user data.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:217:hardcoded-url","reason":"The URL is an explicit HTTPS package repository configuration in documentation. It neither conceals its destination nor sends credentials or user data.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:218:hardcoded-url","reason":"The URL is an explicit HTTPS package repository configuration in documentation. It neither conceals its destination nor sends credentials or user data.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:223:hardcoded-url","reason":"The URL is an explicit HTTPS package repository configuration in documentation. It neither conceals its destination nor sends credentials or user data.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:198:recursive-delete-on-root-home","reason":"The command targets the fixed Xcode DerivedData cache directory, not the filesystem root or the home directory itself. No user-controlled path is interpolated.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:39:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:49:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:50:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:70:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:129:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:146:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:163:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:215:system-reconnaissance","reason":"The cited text is a mobile tooling label, heading, or ordinary project command. It does not inspect host users, processes, credentials, hardware, or network configuration.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-44-bits-possible-b","reason":"SKILL.md is readable UTF-8 Markdown containing Chinese prose and ordinary code examples. It contains no binary, encrypted, compressed, or encoded payload.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Unpinned Package Execution","severity":"medium","locations":[{"file":"SKILL.md","line_end":46,"line_start":43},{"file":"references/tools-quickref.md","line_end":37,"line_start":35}],"confidence":0.92,"description":"Setup examples invoke react-native@latest, unversioned create-expo-app, and unpinned npm dependencies. A compromised future release could execute during project initialization or installation.","confidence_reasoning":"The commands directly resolve and execute packages without immutable versions or integrity controls. This is a recognized software supply-chain exposure."},{"title":"Unconditional API Response Logging","severity":"medium","locations":[{"file":"SKILL.md","line_end":119,"line_start":118}],"confidence":0.94,"description":"The API example enables response-body logging without a release guard. Responses may contain tokens or personal data that can reach device or CI logs.","confidence_reasoning":"The interceptor is added unconditionally with responseBody enabled. The example shows no environment check, redaction, or production disablement."}],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"255f67296ce187b1aab2dabdf3b860276ae5c23b5660b3721d50cacb10a8ba0f","subject_tree_hash":"5b62f7c97ac3cac238e33b793803bf8f7609e2f020e73f9aa1443e6cac05a4ab","subject_plugin_path":"skills/zl2023github/mobile-engineer","audit_payload_hash":"0096cecd24ae3f6144b180ac851663d3","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"255f67296ce187b1aab2dabdf3b860276ae5c23b5660b3721d50cacb10a8ba0f","treeHash":"5b62f7c97ac3cac238e33b793803bf8f7609e2f020e73f9aa1443e6cac05a4ab","pluginPath":"skills/zl2023github/mobile-engineer","auditPayloadHash":"0096cecd24ae3f6144b180ac851663d3"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/zl2023github-mobile-engineer/audits/4/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}