سجل التدقيق

All static findings are false positives caused by Markdown code formatting, metadata, or descriptive paths. Semantic review found mutable dependency installation and authenticated physical-device changes.

All 14 static findings are false positives caused by Markdown code spans, metadata, configuration documentation, or a rate-limit note. A medium-risk semantic finding remains because the skill directs an agent to run state-changing commands against a physical sleep device through an authenticated unofficial API.

The skill intentionally directs the assistant to use the eightctl CLI for Eight Sleep pod operations, including temperature, alarms, schedules, audio, and base controls. Static findings for Markdown command examples are partly valid because they describe external command use, while the system reconnaissance and homepage URL findings are false positives. No prompt injection attempt was found, but the install metadata uses a mutable Go module target.

The skill intentionally invokes the eightctl CLI to control Eight Sleep hardware and uses local or environment-based credentials. No prompt injection or malicious instructions were found, but device-control actions and credential handling require confirmation and user care.

The static Ruby backtick and system reconnaissance findings are false positives from Markdown examples. The audit confirms sensitive hidden config usage and adds semantic findings for mutable remote installation, credential environment variables, and physical device control side effects.

The skill relies on the external eightctl CLI, which can control an Eight Sleep device after authentication. Markdown-only detections for config paths, homepage metadata, and rate-limit notes were false positives, but mutable installation, credential handling, and device-changing commands require clear safeguards.

Official skill with simple instructions for the eightctl command-line tool. The skill references external commands, network API use, a local config file, and environment variables, but no malicious behavior or prompt injection was found.

Official skill from Anthropic/skills repository. Static analysis shows standard CLI integration for smart home device control. No malicious patterns detected. Risk factors reflect legitimate device control operations (external commands, network API calls, config file access). Rate limiting notice present for API usage.

Official skill from anthropics/skills repository. The skill executes the eightctl CLI tool to control Eight Sleep pods. Requires authentication via config file or environment variables. No prompt injection attempts detected. Safe to publish.