Domain name for API request: csip.intl.tencentcloudapi.com.
Queries the security detection result of a skill. After calling CreateSkillScan successfully, use the returned ContentHash + EngineVersion to poll this API to obtain the result. We recommend polling for the first time 5 minutes after a successful upload. If detection is not completed, poll once every 1 minute afterward. The response uses the Status field to distinguish four statuses: detection completed (SUCCESS), detecting (SCANNING), no record (NOT_FOUND), and detection failed (FAILED). Note: Detection results are retained for 90 days. NOT_FOUND will be returned after they expire.
A maximum of 100 requests can be initiated per second for this API.
The following request parameter list only provides API request parameters and some common parameters. For the complete common parameter list, see Common Request Parameters.
| Parameter Name | Required | Type | Description |
|---|---|---|---|
| Action | Yes | String | Common Params. The value used for this API: DescribeSkillScanResult. |
| Version | Yes | String | Common Params. The value used for this API: 2022-11-21. |
| Region | No | String | Common Params. This parameter is not required. |
| ContentHash | Yes | String | SHA256 Hash of the ZIP file Parameter format: sha256:<64-bit hex> |
| EngineVersion | Yes | Integer | Specify the engine version number. Parameter value for reference: returned by the CreateSkillScan API. |
| ReportURLExpireHours | No | Integer | Address validity period of the report signature Unit: hr Default value: 8760 (1 year) Supplementary description: It takes effect on the returned ReportURL. |
| Parameter Name | Type | Description |
|---|---|---|
| Status | String | Detection status Enumeration value: SUCCESS: Detection complete, results returned SCANNING: detection in progress NOT_FOUND: No detection record FAILED: Detection failed |
| Data | SkillScanItem | Detection result details. When Status=SUCCESS, most fields have values. When Status=SCANNING, it contains only ContentHash and CreatedAt. When Status=FAILED, it contains only ContentHash, FailedAt, and Message. When Status=NOT_FOUND, it contains only ContentHash. |
| RequestId | String | The unique request ID, generated by the server, will be returned for every request (if the request fails to reach the server for other reasons, the request will not obtain a RequestId). RequestId is required for locating a problem. |
POST / HTTP/1.1
Host: csip.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeSkillScanResult
<Common request parameters>
{
"ContentHash": "sha256:93329ab36e34abf927eb029bc27db54e0041d7905c1f80a222998d88d62dd4c5",
"EngineVersion": 20200
}{
"Response": {
"Status": "SUCCESS",
"Data": {
"SkillName": "git-helper",
"SkillDescription": "Skill for executing Git repository initialization, configuration sync, and auxiliary operations in batches."
"ContentHash": "sha256:93329ab36e34abf927eb029bc27db54e0041d7905c1f80a222998d88d62dd4c5",
"UploadFileCount": 37,
"RiskLevel": "malicious",
"PrimaryRuleID": "90002",
"Mitigation": "It is advisable to stop using this Skill immediately, clean up malicious persistence and outbound logic, rotate suspected leaked credentials, and resubmit for detection after repair is completed.",
"RiskDescription": "The Skill exhibits multiple high-risk behaviors such as command injection, credential theft, and data exfiltration. Comprehensive assessment: malicious."
"SecurityScore": 0,
"EngineVersion": 20200,
"CapabilityTags": [
{
"ID": "file_read",
"Name": "File reading"
},
{
"ID": "file_write",
"Name": "File Modification"
}
],
"RuleCatalog": [
{
"RuleID": "90001",
"RuleName": "Supply chain risk"
},
{
"RuleID": "90002",
"RuleName": "Command execution risk"
},
{
"RuleID": "90003",
"RuleName": "Network request and data exfiltration"
},
{
"RuleID": "90004",
"RuleName": "File operations and sensitive path access"
},
{
"RuleID": "90005",
"RuleName": "Prompt injection risk"
},
{
"RuleID": "90006",
"RuleName": "Remote script download and execute"
},
{
"RuleID": "90007",
"RuleName": "Suspicious code/obfuscation"
},
{
"RuleID": "90008",
"RuleName": "Other security risks"
}
],
"ScanItems": [
{
"ScanType": "AI",
"RuleList": [
{
"RuleID": "90002",
"Description": "In git_helper/run.py line 16, a subprocess.run(f\"git {cmd}\", shell=True) call was found. User parameters are directly concatenated into the shell command, leading to command injection"
},
{
"RuleID": "90003",
"Description": "In git_helper/init_config.py line 91, urllib.request.urlopen was found sending stolen credentials and system information to an external domain name via POST"
}
]
},
{
"ScanType": "STATIC",
"RuleList": [
{
"RuleID": "90001",
"Description": "The Python package 'reqeusts' differs from the popular package 'requests' by only 2 characters (edit distance); requirements.txt uses >= but lacks == for exact lock"
}
]
}
],
"ReportURL": "https://skill-scan-1258344699.cos.ap-guangzhou.myqcloud.com/html-reports/2026/04/02/42_a1b2c3d4e5f6g7h8.html",
"ScannedAt": "2026-04-02T09:13:23+08:00"
},
"RequestId": "e4f8c3a2-9b7d-4e6f-a1c5-d8b2e7f3a9c4"
}
}POST / HTTP/1.1
Host: csip.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeSkillScanResult
<Common request parameters>
{
"ContentHash": "sha256:93329ab36e34abf927eb029bc27db54e0041d7905c1f80a222998d88d62dd4c5",
"EngineVersion": 20200
}{
"Response": {
"Status": "SCANNING",
"Data": {
"ContentHash": "sha256:93329ab36e34abf927eb029bc27db54e0041d7905c1f80a222998d88d62dd4c5",
"CreatedAt": "2026-04-02T09:08:00+08:00"
},
"RequestId": "f5a9d2b1-8c6e-4d3f-b7a2-e1c8f4d6a3b5"
}
}POST / HTTP/1.1
Host: csip.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeSkillScanResult
<Common request parameters>
{
"ContentHash": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
"EngineVersion": 20200
}{
"Response": {
"Status": "NOT_FOUND",
"Data": {
"ContentHash": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
},
"RequestId": "a1b2c3d4-5e6f-7a8b-9c0d-e1f2a3b4c5d6"
}
}POST / HTTP/1.1
Host: csip.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeSkillScanResult
<Common request parameters>
{
"ContentHash": "sha256:93329ab36e34abf927eb029bc27db54e0041d7905c1f80a222998d88d62dd4c5",
"EngineVersion": 20200
}{
"Response": {
"Status": "FAILED",
"Data": {
"ContentHash": "sha256:93329ab36e34abf927eb029bc27db54e0041d7905c1f80a222998d88d62dd4c5",
"FailedAt": "2026-04-02T09:13:00+08:00",
"Message": "Scan task execution failed, please resubmit"
},
"RequestId": "c7d8e9f0-1a2b-3c4d-5e6f-7a8b9c0d1e2f"
}
}TencentCloud API 3.0 integrates SDKs that support various programming languages to make it easier for you to call APIs.
There is no error code related to the API business logic. For other error codes, please see Common Error Codes.
文档反馈