open-show

The static analyzer reported 214 findings with a risk score of 100/100, but most are false positives. The 119 'Ruby/shell backtick execution' detections in README.md and SKILL.md are Markdown code block examples showing bash commands, not actual Ruby code execution. The 9 'weak cryptographic algorithm' findings in README.md, SKILL.md, and scripts/openshow.py are false positives matching CSS template strings and embedded JavaScript, not cryptography. The critical heuristic findings about 'code execution + network + credential access' are false positives built on incorrect credential file detections that matched SVG attributes and CSS values in the HTML template. All documentation URL detections are expected for a project README. Real concerns: the script disables SSL certificate verification as a fallback (scripts/openshow.py:286), invokes subprocess to launch an external browser (scripts/openshow.py:936), and makes HTTP requests to user-supplied URLs. These are legitimate for the tool purpose but warrant user awareness.