Historial de auditorías

Most static findings are false positives caused by markdown fences, inline code, and visible bash examples in SKILL.md. The skill shows legitimate GitHub project-management intent, but it carries medium contextual risk from unpinned third-party npx commands, automated GitHub mutations, and external webhook sync.

Most static findings are false positives caused by markdown fences, inline code, and visible bash examples in SKILL.md. The skill shows legitimate GitHub project-management intent, but it carries medium contextual risk from unpinned third-party npx commands, automated GitHub mutations, and external webhook sync.

Static analysis reported many command execution and high-risk keyword patterns in SKILL.md. Review found no prompt injection, malware intent, or real weak cryptography, but confirmed extensive GitHub CLI, npx, and MCP examples that can mutate repositories and project boards. Publish with a clear warning that users must review commands and permissions before execution.

Documentation-only skill containing markdown guidance for GitHub project management workflows. Static findings are false positives triggered by documentation patterns showing example shell commands. No executable code, no network operations, no file system access. External tools (gh CLI, ruv-swarm) are invoked by the user, not by this skill.

Documentation-only skill containing markdown guidance for GitHub project management workflows. Static findings are false positives triggered by documentation patterns showing example shell commands. No executable code, no network operations, no file system access. External tools (gh CLI, ruv-swarm) are invoked by the user, not by this skill.

Pure documentation skill containing only markdown guidance for GitHub project management workflows. No executable code, no network operations, no file system access, no environment variable reading. External tools (gh CLI, ruv-swarm) are invoked by the user, not by this skill.

Pure documentation skill containing only markdown guidance for GitHub project management workflows. No executable code, no network operations, no file system access, no environment variable reading. External tools (gh CLI, ruv-swarm) are invoked by the user, not by this skill.

Pure documentation skill containing only markdown guidance for GitHub project management workflows. No executable code, no network operations, no file system access, no environment variable reading. External tools (gh CLI, ruv-swarm) are invoked by the user, not by this skill.