Historial de auditorías

angular-component - 2 auditorías

Versión de auditoría 2

Más reciente Seguro

Jun 28, 2026, 08:10 AM

Static analysis reported many high and medium indicators, but review found they are false positives in Markdown documentation and TypeScript examples. The files do not define executable scripts, shell commands, credential access, data exfiltration, or prompt injection attempts, so the skill is safe to publish.

Archivos escaneados

648

Líneas analizadas

hallazgos

codex

Auditado por

Problemas de riesgo bajo (4)

External Command Detections Are Documentation False Positives

FALSE POSITIVE: The reported Ruby or shell backtick matches occur in Markdown code fences, Angular examples, and TypeScript template literals. They are instructional snippets, not commands executed by the skill.

SKILL.md:47

Hardcoded URL Is Example Component Data

FALSE POSITIVE: The URL at SKILL.md line 47 is an example avatar endpoint inside a computed Angular property. It does not perform a network request from the skill itself.

SKILL.md:3 SKILL.md:173 SKILL.md:175 SKILL.md:188

Weak Cryptography Alerts Are Token Matches

FALSE POSITIVE: The weak-cryptography alerts match ordinary Angular wording such as change detection and OnDestroy lifecycle examples. No cryptographic API or hash algorithm is used.

SKILL.md:32 references/component-patterns.md:244

System Reconnaissance Alerts Are Benign Examples

FALSE POSITIVE: The system reconnaissance alerts point to CSS/template and data-model examples, not host inspection commands. No file, process, network, or environment enumeration is present.

Versión de auditoría 1

Seguro

Feb 15, 2026, 08:42 AM

All static findings are false positives. The skill contains legitimate Angular v20+ component documentation with signal-based inputs, outputs, host bindings, content projection, and lifecycle hooks. The 91 flagged patterns are markdown code fences for TypeScript examples, not actual shell commands or security vulnerabilities.

Archivos escaneados

648

Líneas analizadas

hallazgos

claude

Auditado por

Problemas de riesgo bajo (4)

SKILL.md:8-286 references/component-patterns.md:13-358

External Commands False Positive

Static analyzer flagged markdown backticks as shell command execution. These are code fences for TypeScript/HTML examples in documentation, not actual command execution.

SKILL.md:47

Hardcoded URL False Positive

Example URL in documentation flagged as hardcoded URL. This is a legitimate example domain for avatar URL construction.

SKILL.md:3-188

Weak Cryptographic Algorithm False Positive

Analyzer incorrectly flagged lifecycle method names and import statements as weak crypto algorithms.

SKILL.md:32 references/component-patterns.md:244

System Reconnaissance False Positive

Analyzer incorrectly flagged Angular component patterns as system reconnaissance.

← Volver a Skill