share

All 51 static findings are false positives. The 4 'Weak cryptographic algorithm' alerts target YAML description strings and a React component name (DefinitionDescription) containing the substring 'DES'. The 47 'Ruby/shell backtick execution' alerts are markdown code formatting backticks, not shell operators. The skill does legitimately invoke CLI commands (p11, npm) as part of its document publishing workflow, which is the basis for the external_commands risk factor. No malicious intent, data exfiltration, or prompt injection detected.