[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KS8DG69PJPT7CSNPK26J6J":3,"skill-same:01M6KS8DG69PJPT7CSNPK26J6J":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":55,"updatedAt":56,"install":57,"resources":70},"01M6KS8DG69PJPT7CSNPK26J6J","explain-report",null,"Explain a SkillGuard security audit report — analyze findings, assess real risk vs false positives, and provide context","openmaster-ai\u002Fskillguard-cli","openmaster-ai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F269944371?v=4","01M6KS862ZX1BTMRHNSRN9AV4R","OpenMaster","01M6KS867SMAHB6VS0RKYAZ8ND",1,"MIT","https:\u002F\u002Fgithub.com\u002Fopenmaster-ai\u002Fskillguard-cli\u002Fblob\u002Fmaster\u002Fskills\u002Fexplain-report\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"report","explain","explain report","security","audit","audit report","risk","security audit","Bash","analyze","grep","read","context","skillguard","false","assess","2026-11-10 10:12:30",false,"---\ndescription: Explain a SkillGuard security audit report — analyze findings, assess real risk vs false positives, and provide context\nallowed-tools:\n  - Bash\n  - Read\n  - Glob\n  - Grep\n---\n\n# Explain SkillGuard Report\n\nReads a SkillGuard JSON report and explains each finding in context, helping users understand what the risks actually mean and which findings need attention vs which are false positives.\n\n## Usage\n\n1. First generate a JSON report:\n   ```bash\n   npx skillguard \u003Ctarget> --json report.json\n   ```\n\n2. Then ask to explain the report — read `report.json` and analyze each finding.\n\n## How to Analyze\n\nFor each finding, evaluate:\n\n1. **Context** — Is this pattern in actual executable code, or in documentation\u002Fcomments?\n2. **Intent** — Is the pattern used for a legitimate purpose (e.g., `eval()` in a build tool)?\n3. **Scope** — Is the finding isolated or part of a broader pattern (e.g., multiple exfiltration signals)?\n4. **Severity** — Does the assigned severity match the actual risk given the context?\n\n### Common False Positives\n\n- `eval()` in documentation explaining what NOT to do\n- API key patterns in `.env.example` with placeholder values\n- `rm -rf` in cleanup scripts with proper path validation\n- `sudo` in installation instructions (README)\n- `shell=True` with hardcoded safe commands (no user input)\n\n### Red Flags That Need Attention\n\n- Combined signals: env var reading + outbound HTTP in same skill\n- `dangerouslyDisableSandbox` — almost always a real risk\n- Base64-encoded strings in markdown files (possible payload hiding)\n- Missing `allowed-tools` with shell access patterns in code\n\n## Output Format\n\nFor each finding group by dimension, explain:\n- What was detected and why it matters\n- Whether it's likely a real risk or false positive\n- What action (if any) the user should take\n","# Explain SkillGuard Report\n\nReads a SkillGuard JSON report and explains each finding in context, helping users understand what the risks actually mean and which findings need attention vs which are false positives.\n\n## Usage\n\n1. First generate a JSON report:\n   ```bash\n   npx skillguard \u003Ctarget> --json report.json\n   ```\n\n2. Then ask to explain the report — read `report.json` and analyze each finding.\n\n## How to Analyze\n\nFor each finding, evaluate:\n\n1. **Context** — Is this pattern in actual executable code, or in documentation\u002Fcomments?\n2. **Intent** — Is the pattern used for a legitimate purpose (e.g., `eval()` in a build tool)?\n3. **Scope** — Is the finding isolated or part of a broader pattern (e.g., multiple exfiltration signals)?\n4. **Severity** — Does the assigned severity match the actual risk given the context?\n\n### Common False Positives\n\n- `eval()` in documentation explaining what NOT to do\n- API key patterns in `.env.example` with placeholder values\n- `rm -rf` in cleanup scripts with proper path validation\n- `sudo` in installation instructions (README)\n- `shell=True` with hardcoded safe commands (no user input)\n\n### Red Flags That Need Attention\n\n- Combined signals: env var reading + outbound HTTP in same skill\n- `dangerouslyDisableSandbox` — almost always a real risk\n- Base64-encoded strings in markdown files (possible payload hiding)\n- Missing `allowed-tools` with shell access patterns in code\n\n## Output Format\n\nFor each finding group by dimension, explain:\n- What was detected and why it matters\n- Whether it's likely a real risk or false positive\n- What action (if any) the user should take\n",{"description":7,"allowed-tools":45},[32,46,47,48],"Read","Glob","Grep","master","9fd25469bd9024221a0dad7180338fc69731525c","skills\u002Fexplain-report",0,"https:\u002F\u002Fgithub.com\u002Fopenmaster-ai\u002Fskillguard-cli","https:\u002F\u002Fgithub.com\u002Fopenmaster-ai","One Platform. Every Master.","2026-04-04 14:32:39",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add openmaster-ai\u002Fskillguard-cli --skill explain-report",{"tool":63,"command":64},"bunx","bunx skills add openmaster-ai\u002Fskillguard-cli --skill explain-report",{"tool":66,"command":67},"pnpm","pnpm dlx skills add openmaster-ai\u002Fskillguard-cli --skill explain-report","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fopenmaster-ai\u002Fskillguard-cli\u002Fblob\u002Fmaster\u002Fskills\u002Fexplain-report\u002FSKILL.md",true,[],[72,89,103],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":83,"publishedAt":40},"01M6KS8M67XTSF6T078R7NBKCC","sample-skill","Test skill for SkillGuard","https:\u002F\u002Fgithub.com\u002Fopenmaster-ai\u002Fskillguard-cli\u002Fblob\u002Fmaster\u002Ftests\u002Ffixtures\u002Fsample-skill\u002FSKILL.md",[78],{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[84,85,86,87,32,35,37,88],"sample","sample skill","test","Test Skill","for",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":40},"01M6KS8GZK4RSM25NEVE78MMSE","suggest-fixes","Suggest concrete code fixes for SkillGuard security findings — generate remediation patches","https:\u002F\u002Fgithub.com\u002Fopenmaster-ai\u002Fskillguard-cli\u002Fblob\u002Fmaster\u002Fskills\u002Fsuggest-fixes\u002FSKILL.md",[],[96,97,32,34,35,98,99,37,88,100,101,27,102],"suggest fixes","fixes","write","edit","code","remediation","generate",{"skillNo":104,"name":28,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":40},"01M6KS88MBRYZ2M8TZSYPVV8GQ","Run SkillGuard security audit on AI agent skills — scans 10 dimensions with 109 rules based on OWASP LLM Top 10, SLSA, and Google SAIF","https:\u002F\u002Fgithub.com\u002Fopenmaster-ai\u002Fskillguard-cli\u002Fblob\u002Fmaster\u002Fskills\u002Faudit\u002FSKILL.md",[],[28,109,27,110,111,112,113,114,31,32,35,37,115,116,117,118],"Rules","ai agent","owasp llm","run","owasp","slsa","dimensions","with","top","google"]