scanlume-ocr-api

The static analyzer reported 168 potential issues with a risk score of 100/100. After evaluation, the vast majority are false positives. The 116 'Ruby/shell backtick execution' findings result from the scanner confusing markdown code fences (```) in documentation files with actual shell execution. The 'Weak cryptographic algorithm' findings flag base64 encoding used for API data URL construction, which is not cryptographic. 'Hardcoded URL' findings reference the skill's own documented API endpoints (api.scanlume.com, www.scanlume.com). The critical heuristic flag for 'Code execution + Network + Credential access' describes expected behavior for a legitimate API client skill. Real risk factors are limited to standard API client patterns: network requests to the Scanlume API, environment variable access for the SCANLUME_API_KEY, and execution of a bundled Python helper script. No malicious intent, credential exfiltration, or prompt injection attempts were detected.