amazon-product-api-skill

Static analyzer flagged 63 patterns including network calls, environment variable access, and markdown backtick formatting misinterpreted as shell commands. After evaluation, all findings are false positives: network calls target only the legitimate BrowserAct API service (api.browseract.com), env var access reads only BROWSERACT_API_KEY using standard os.getenv(), and backtick detections are markdown code formatting in SKILL.md, not shell execution. The CRITICAL heuristic was tripped by the standard combination of network + credential + command patterns expected in any API integration skill. No malicious intent, obfuscation, data exfiltration, or unauthorized endpoints found.