سجل التدقيق

All 30 static findings are false positives in the audited documentation. The command, filesystem, network, screenshot, reconnaissance, and prompt-injection matches describe configuration, safe testing boundaries, or local verification steps rather than malicious behavior.

Most static alerts are false positives caused by Markdown backticks, local test examples, and explicit security safeguards. The installation example presents a real supply-chain risk because it uses npx with automatic confirmation and an unpinned latest package.