Skills alibaba-java-coding-guidelines-skill Audit History

📦

Audit History

alibaba-java-coding-guidelines-skill - 4 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v4 Latest	Jul 6, 2026, 08:11 PM	No confirmed findings	0	No capability change
v3	Jul 6, 2026, 08:11 PM	No confirmed findings	0	No capability change
v2	Jun 30, 2026, 10:44 AM	No confirmed findings	3	No capability change
v1	May 24, 2026, 03:17 PM	No confirmed findings	0	Baseline

Audit version 4 Latest

Jul 6, 2026, 08:11 PM

审计未发现恶意意图、提示注入、数据外泄或真实命令执行风险。静态告警主要来自 Markdown 反引号、Go 原始字符串、固定仓库文件读取、安装路径示例和中文文档高熵误报。

Files scanned

1,088

Lines analyzed

Review items

False positives ignored

Risk Factors

📁 Filesystem access (8)

README.md:26 README.md:29 README.md:26 README.md:29 scripts/validate_skill.mjs:3 scripts/validate_skill.mjs:28 scripts/validate_skill.mjs:62 scripts/validate_skill.mjs:70

⚡ Contains scripts (1)

scripts/validate_skill.go:3-10

⚙️ External commands (21)

🌐 Network access (2)

SKILL.md:12 skills/alibaba-java-coding-guidelines-skill/SKILL.md:12

Audited by: codex

Audit version 3

Jul 6, 2026, 08:11 PM

Files scanned

1,088

Lines analyzed

Review items

False positives ignored

Risk Factors

📁 Filesystem access (8)

README.md:26 README.md:29 README.md:26 README.md:29 scripts/validate_skill.mjs:3 scripts/validate_skill.mjs:28 scripts/validate_skill.mjs:62 scripts/validate_skill.mjs:70

⚡ Contains scripts (1)

scripts/validate_skill.go:3-10

⚙️ External commands (21)

🌐 Network access (2)

SKILL.md:12 skills/alibaba-java-coding-guidelines-skill/SKILL.md:12

Audited by: codex

Audit version 2

Jun 30, 2026, 10:44 AM

静态分析报告的高危项经人工语义核对后未确认恶意行为；多数来自 Markdown 反引号、Apache License 文本和 Java/SQL 术语误判。仓库包含本地校验脚本，会读取仓库文件并在测试脚本中运行本地验证器，因此保留低风险发布提示。未发现提示注入、凭据外发、远程下载执行或隐藏持久化证据。

Files scanned

1,088

Lines analyzed

Review items

False positives ignored

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

scripts/validate_skill.py:22-26 scripts/validate_skill.mjs:22-28 scripts/validate_skill.go:17-23

本地校验脚本读取仓库文件

Python、Node.js 和 Go 校验入口会读取 SKILL.md、references/alibaba-java-rules.md 和可选元数据文件，用于验证 skill 结构。读取范围由脚本路径推导到仓库根目录，未发现读取用户密钥、环境变量或任意输入路径的证据。

脚本中存在明确的本地文件读取，但目标文件固定在仓库结构内。未看到网络发送或敏感路径读取，因此风险较低。

Low

tests/test_validators.sh:23-25

测试脚本执行本地验证器

tests/test_validators.sh 运行 python3、node 和 go run 来验证三个校验入口。命令和参数是固定字符串，没有来自用户输入的拼接；风险主要来自用户主动执行测试脚本时会启动本地运行时。

命令执行位置清晰，命令参数固定且只指向仓库内验证器。该行为是真实执行面，但没有命令注入或外部下载迹象。

Low

README.md:24-30 SKILL.md:12 references/alibaba-java-rules.md:3 LICENSE.txt:3

文档中的用户目录示例和外部链接

README.md 给出 ~/.claude 和 ~/.codex 安装路径示例，SKILL.md 与规则摘要引用官方阿里巴巴规范页面，LICENSE.txt 引用 Apache License 页面。这些是文档文本，不是自动文件访问或网络请求。

相关位置是安装说明、官方文档链接和许可证链接。没有自动打开 URL 或访问隐藏目录的代码路径。

Risk Factors

⚡ Contains scripts (4)

scripts/validate_skill.py:1 scripts/validate_skill.mjs:1-3 scripts/validate_skill.go:1-10 tests/test_validators.sh:1-4

📁 Filesystem access (4)

scripts/validate_skill.py:22-26 scripts/validate_skill.mjs:22-28 scripts/validate_skill.go:17-23 README.md:24-30

⚙️ External commands (2)

tests/test_validators.sh:23-25 README.md:42-51

🌐 Network access (4)

SKILL.md:12 references/alibaba-java-rules.md:3 LICENSE.txt:3 LICENSE.txt:195

Detected Patterns

静态高危模式经核对为误报

Audited by: codex

Audit version 1

May 24, 2026, 03:17 PM

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

Files scanned

1,090

Lines analyzed

Review items

False positives ignored

Risk Factors

🌐 Network access (7)

LICENSE.txt:3 LICENSE.txt:195 README.md:7 references/alibaba-java-rules.md:3 SKILL.md:12 skills/alibaba-java-coding-guidelines-skill/references/alibaba-java-rules.md:3 skills/alibaba-java-coding-guidelines-skill/SKILL.md:12

⚙️ External commands (205)

📁 Filesystem access (8)

README.md:26 README.md:29 README.md:26 README.md:29 scripts/validate_skill.mjs:3 scripts/validate_skill.mjs:28 scripts/validate_skill.mjs:62 scripts/validate_skill.mjs:70

⚡ Contains scripts (1)

scripts/validate_skill.go:3-10

Detected Patterns

Weak cryptographic algorithmHardcoded URLRuby/shell backtick executionHidden file in home directoryHidden file accessDynamic import() expressionSynchronous file operationsShell command substitution[HEURISTIC] High file entropy (6.14 bits) - possible binary/encrypted content[HEURISTIC] High file entropy (7.70 bits) - possible binary/encrypted content[HEURISTIC] High file entropy (7.46 bits) - possible binary/encrypted content

Audited by: claude

← Back to Skill