سجل التدقيق

The static matches are Markdown examples, metadata, or diagnostic addresses, not executable backticks or hidden network calls. The mutable @latest installer remains a medium supply-chain risk; no prompt injection or credential exfiltration was found.

The skill legitimately requires an external sonos CLI and local-network access to discover and control speakers. Most scanner hits are Markdown examples or troubleshooting strings, but the unpinned Go installer adds supply-chain risk.

The skill intentionally uses the external sonos CLI to discover and control Sonos speakers on the local network. Most static command findings are benign markdown examples, but the core external-command behavior is real and should be treated as a controlled local-device action. No prompt injection attempt was found in the skill text.

This official skill provides usage guidance for the external Sonos CLI and targets local network speaker control. Static findings are expected for command execution and local network access, and no malicious behavior or prompt injection was found.

This is an official skill from the Anthropic skills repository. The skill provides CLI-based control of Sonos speakers on the local network. The skill uses the sonos CLI binary which must be installed separately. Network access is required for speaker discovery and control. No security concerns identified.