{"data":{"skill":{"slug":"zx029w-zhuangxiu-gongsi-bilei-v2","name":"zhuangxiu-gongsi-bilei-v2","icon":"📦","repo":"https://github.com/zx029w/zhuangxiu-skills/tree/18c36d5fc1366ca675e72cac21be0fcfe09f41dd/zhuangxiu-gongsi-bilei-v2","status":"approved","author":"zx029w","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"944601cf-677c-4704-bfb2-0b9ca7bd35b1","skill_id":"fd228d1c-ad32-4a86-b779-ed41e8fd9551","version":1,"content_hash":"v3:f01ee12a3f467bba6bccb34fd6e876de28fd252a:4a5915940824ee007c194a8e711357839a907e31581fcee3e2cc57f711ce4bd6:8fee51bde1fcfc39b77c027dc02b95dbd517e4819ed77842c4c6537d170499e9:736b696c6c732f7a78303239772f7a6875616e677869752d676f6e6773692d62696c65692d7632:cdcde4e6334415de2de854467bf80ef7","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"9处外部命令告警实际对应 SKILL.md 中的 Markdown 反引号文件引用，不会执行命令。12处高熵告警对应中文标题和知识库正文，未发现编码载荷或提示注入；当前没有确认的安全风险。","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":74,"line_start":74}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":11,"total_lines":1165,"audit_model":"codex","audited_at":"2026-08-20T06:34:14.083+00:00","created_at":"2026-08-20T08:04:29.59382+00:00","static_findings":[{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"详见 `references/xuangongsi-jiqiao-1.md`","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"详见 `references/xuangongsi-jiqiao-2.md`","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"详见 `references/xuangongsi-jiqiao-3.md`","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"详见 `references/xuangongsi-jiqiao-4.md`","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"详见 `references/taotai-hongxian-1.md`","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"详见 `references/taotai-hongxian-2.md`","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"详见 `references/taotai-hongxian-3.md`","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 优先从知识库输出**筛选技巧**(详见`references/xuangongsi-jiqiao-1.md`)","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 输出**避坑红线和常见陷阱**(详见`references/taotai-hongxian-1.md`)","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"obfuscation:references/gongkai-xinxi-chaxun.md:1:heuristic-high-file-entropy-7-17-bits-possible-b","file":"references/gongkai-xinxi-chaxun.md","pattern":"[HEURISTIC] High file entropy (7.17 bits) - possible binary/encrypted content","snippet":"File: references/gongkai-xinxi-chaxun.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/taotai-hongxian-1.md:1:heuristic-high-file-entropy-7-71-bits-possible-b","file":"references/taotai-hongxian-1.md","pattern":"[HEURISTIC] High file entropy (7.71 bits) - possible binary/encrypted content","snippet":"File: references/taotai-hongxian-1.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/taotai-hongxian-2.md:1:heuristic-high-file-entropy-7-74-bits-possible-b","file":"references/taotai-hongxian-2.md","pattern":"[HEURISTIC] High file entropy (7.74 bits) - possible binary/encrypted content","snippet":"File: references/taotai-hongxian-2.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/taotai-hongxian-3.md:1:heuristic-high-file-entropy-7-47-bits-possible-b","file":"references/taotai-hongxian-3.md","pattern":"[HEURISTIC] High file entropy (7.47 bits) - possible binary/encrypted content","snippet":"File: references/taotai-hongxian-3.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/xin-qushi-2025-2026.md:1:heuristic-high-file-entropy-7-48-bits-possible-b","file":"references/xin-qushi-2025-2026.md","pattern":"[HEURISTIC] High file entropy (7.48 bits) - possible binary/encrypted content","snippet":"File: references/xin-qushi-2025-2026.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/xuangongsi-jiqiao-1.md:1:heuristic-high-file-entropy-7-55-bits-possible-b","file":"references/xuangongsi-jiqiao-1.md","pattern":"[HEURISTIC] High file entropy (7.55 bits) - possible binary/encrypted content","snippet":"File: references/xuangongsi-jiqiao-1.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/xuangongsi-jiqiao-2.md:1:heuristic-high-file-entropy-7-36-bits-possible-b","file":"references/xuangongsi-jiqiao-2.md","pattern":"[HEURISTIC] High file entropy (7.36 bits) - possible binary/encrypted content","snippet":"File: references/xuangongsi-jiqiao-2.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/xuangongsi-jiqiao-3.md:1:heuristic-high-file-entropy-7-79-bits-possible-b","file":"references/xuangongsi-jiqiao-3.md","pattern":"[HEURISTIC] High file entropy (7.79 bits) - possible binary/encrypted content","snippet":"File: references/xuangongsi-jiqiao-3.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/xuangongsi-jiqiao-4.md:1:heuristic-high-file-entropy-7-47-bits-possible-b","file":"references/xuangongsi-jiqiao-4.md","pattern":"[HEURISTIC] High file entropy (7.47 bits) - possible binary/encrypted content","snippet":"File: references/xuangongsi-jiqiao-4.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/zhishiku-jigou-cankao.md:1:heuristic-high-file-entropy-6-93-bits-possible-b","file":"references/zhishiku-jigou-cankao.md","pattern":"[HEURISTIC] High file entropy (6.93 bits) - possible binary/encrypted content","snippet":"File: references/zhishiku-jigou-cankao.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:SKILL.md:3:heuristic-very-high-entropy-string-6-12-bits-lik","file":"SKILL.md","pattern":"[HEURISTIC] Very high entropy string (6.12 bits) - likely encoded/encrypted payload","snippet":"【选装修公司必看】你正在找装修公司吗？不知道怎么选、怕被坑、担心中途加钱、想提前排查风险？这个Skill内置专业装修知识体系（5篇核心参考文献），直接教你筛选方...","category":"obfuscation","line_end":3,"severity":"high","line_start":3},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-31-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (7.31 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"该行仅以内联 Markdown 反引号引用 references/xuangongsi-jiqiao-1.md，未出现 Ruby 表达式或可执行命令。","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"该行仅以内联 Markdown 反引号引用 references/xuangongsi-jiqiao-2.md，未出现 Ruby 表达式或可执行命令。","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"该行仅以内联 Markdown 反引号引用 references/xuangongsi-jiqiao-3.md，未出现 Ruby 表达式或可执行命令。","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"该行仅以内联 Markdown 反引号引用 references/xuangongsi-jiqiao-4.md，未出现 Ruby 表达式或可执行命令。","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"该行仅以内联 Markdown 反引号引用 references/taotai-hongxian-1.md，未出现 Ruby 表达式或可执行命令。","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"该行仅以内联 Markdown 反引号引用 references/taotai-hongxian-2.md，未出现 Ruby 表达式或可执行命令。","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"该行仅以内联 Markdown 反引号引用 references/taotai-hongxian-3.md，未出现 Ruby 表达式或可执行命令。","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"该行将参考文献路径放在 Markdown 反引号中，作为阅读指引，不包含命令或动态执行输入。","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"该行将参考文献路径放在 Markdown 反引号中，作为阅读指引，不包含命令或动态执行输入。","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/gongkai-xinxi-chaxun.md:1:heuristic-high-file-entropy-7-17-bits-possible-b","reason":"文件首行是可读的中文 Markdown 标题，内容属于公开信息查询方法。未发现编码数据、加密载荷或隐藏指令。","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:references/taotai-hongxian-1.md:1:heuristic-high-file-entropy-7-71-bits-possible-b","reason":"文件首行是可读的中文 Markdown 标题，内容属于装修风险清单。未发现编码数据、加密载荷或隐藏指令。","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:references/taotai-hongxian-2.md:1:heuristic-high-file-entropy-7-74-bits-possible-b","reason":"文件首行是可读的中文 Markdown 标题，内容属于装修避坑法则。未发现编码数据、加密载荷或隐藏指令。","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:references/taotai-hongxian-3.md:1:heuristic-high-file-entropy-7-47-bits-possible-b","reason":"文件首行是可读的中文 Markdown 标题，内容属于报价陷阱说明。未发现编码数据、加密载荷或隐藏指令。","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:references/xin-qushi-2025-2026.md:1:heuristic-high-file-entropy-7-48-bits-possible-b","reason":"文件首行是可读的中文 Markdown 标题，内容属于装修行业趋势资料。未发现编码数据、加密载荷或隐藏指令。","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:references/xuangongsi-jiqiao-1.md:1:heuristic-high-file-entropy-7-55-bits-possible-b","reason":"文件首行是可读的中文 Markdown 标题，内容属于装修公司筛选原则。未发现编码数据、加密载荷或隐藏指令。","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:references/xuangongsi-jiqiao-2.md:1:heuristic-high-file-entropy-7-36-bits-possible-b","reason":"文件首行是可读的中文 Markdown 标题，内容属于装修公司寻找方法。未发现编码数据、加密载荷或隐藏指令。","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:references/xuangongsi-jiqiao-3.md:1:heuristic-high-file-entropy-7-79-bits-possible-b","reason":"文件首行是可读的中文 Markdown 标题，内容属于公司淘汰方法。未发现编码数据、加密载荷或隐藏指令。","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:references/xuangongsi-jiqiao-4.md:1:heuristic-high-file-entropy-7-47-bits-possible-b","reason":"文件首行是可读的中文 Markdown 标题，内容属于装修机构选择建议。未发现编码数据、加密载荷或隐藏指令。","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:references/zhishiku-jigou-cankao.md:1:heuristic-high-file-entropy-6-93-bits-possible-b","reason":"文件首行是可读的中文 Markdown 标题，内容属于知识库机构参考。未发现编码数据、加密载荷或隐藏指令。","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:SKILL.md:3:heuristic-very-high-entropy-string-6-12-bits-lik","reason":"SKILL.md line 3 is the YAML description field with ordinary Chinese marketing copy. High entropy comes from CJK characters, not an encoded payload.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-7-31-bits-possible-b","reason":"SKILL.md 首行是 YAML 文档分隔符，文件其余内容为可读的技能说明和 Markdown。高熵结果是文本启发式误报。","verdict":"false_positive","confidence":0.98}],"semantic_findings":[],"subject_marketplace_commit_sha":"f01ee12a3f467bba6bccb34fd6e876de28fd252a","subject_content_hash":"4a5915940824ee007c194a8e711357839a907e31581fcee3e2cc57f711ce4bd6","subject_tree_hash":"8fee51bde1fcfc39b77c027dc02b95dbd517e4819ed77842c4c6537d170499e9","subject_plugin_path":"skills/zx029w/zhuangxiu-gongsi-bilei-v2","audit_payload_hash":"cdcde4e6334415de2de854467bf80ef7","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f01ee12a3f467bba6bccb34fd6e876de28fd252a","contentHash":"4a5915940824ee007c194a8e711357839a907e31581fcee3e2cc57f711ce4bd6","treeHash":"8fee51bde1fcfc39b77c027dc02b95dbd517e4819ed77842c4c6537d170499e9","pluginPath":"skills/zx029w/zhuangxiu-gongsi-bilei-v2","auditPayloadHash":"cdcde4e6334415de2de854467bf80ef7"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/zx029w-zhuangxiu-gongsi-bilei-v2/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}