Audit-Verlauf

Two command examples automatically execute an unpinned npm package, creating a supply-chain risk in an environment configured with an API key. The remaining 38 findings concern Markdown formatting, ordinary Chinese text, creator identifiers, service links, or documented authentication. No evidence found of prompt injection, credential exfiltration, or destructive intent in the supplied files; external package behavior was not reviewed.

Of 40 static findings, 38 are false positives involving Markdown, Chinese text, official links, credential configuration, or creator identifiers. Two command examples execute an unpinned npm package with automatic installation, creating dependency risk in an environment containing the API key. No evidence found of prompt injection, credential exfiltration, or concealed payloads in the two reviewed files; external package implementation was not reviewed.

All 39 static matches are false positives involving Markdown, legitimate authentication documentation, creator identifiers, and readable Chinese text. Separate semantic risks concern automatic execution of an unpinned npm package and forwarding payment links without destination validation. No evidence found of embedded malware, credential exfiltration, or prompt injection in the two supplied files; external package behavior was not reviewed.