Historial de auditorías

Most static detections are Markdown backticks, fenced examples, or documentation links and are false positives. Unpinned skill installation commands and remote image loading remain real risks. The command templates also require safeguards against shell injection and disclosure of sensitive prompts or image URLs.

Most static external-command alerts were Markdown fences, model names, or option labels, and those were marked false positive. Confirmed issues are intentional infsh and npx command guidance, a remote embedded image, and third-party inference data transfer. No prompt injection attempt was found in SKILL.md.

Most static external-command alerts were Markdown fences, model names, or option labels, and those were marked false positive. Confirmed issues are intentional infsh and npx command guidance, a remote embedded image, and third-party inference data transfer. No prompt injection attempt was found in SKILL.md.

The static external command findings are confirmed as intentional CLI usage for the inference.sh service, not hidden malware. The network findings are expected for a cloud image-generation skill, while the weak cryptography findings appear to be false positives with no cryptographic operation shown.

Static analysis detected patterns in SKILL.md documentation file, but all findings are false positives. The file contains markdown documentation with code examples showing CLI usage for the inference.sh platform. Backtick characters are markdown formatting for code blocks, not actual shell execution. Hardcoded URLs are documentation links to inference.sh website. No executable code or malicious patterns exist in this skill.