All 34 static findings are false positives involving Markdown syntax, legitimate CLI operations, provider links, and documented authentication. The skill requires paid lookup approval and explicitly treats retrieved instructions as untrusted data. No evidence of malicious behavior was found in SKILL.md; external package implementation and runtime behavior were not inspected.
Most detections are Markdown formatting, documentation links, or keyword terminology rather than malicious commands. The workflow executes an external package with paid API credentials, but its implementation was not included in the review.
1
Fichiers analysés
69
Lignes analysées
11
Éléments à examiner
0
Faux positifs ignorés
Éléments d’évaluation des capacités (7)
Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.
All 29 static findings reflect Markdown formatting, documented provider authentication, relevant links, or ordinary keyword analysis rather than the alleged threats. No evidence found of credential exfiltration or prompt injection in SKILL.md; the external CLI implementation was not provided for review. Separate workflow risks include executing an unpinned repository and initiating paid lookups after cost disclosure without explicit approval.
Setup says to clone the repository 'if missing', then runs 'python -m radar keywords'. No reviewed commit or integrity check is required. This allows changing upstream code to execute with local credentials and filesystem access.
The instructions directly connect an unpinned clone with module execution. The external implementation is unavailable, so this identifies supply-chain exposure, not proven malicious code.
Every lookup is paid, but the workflow says 'State the estimate, then' run the command. It does not require approval or a budget ceiling. An agent following these instructions could spend existing account credit without a separate spending authorization.
The text explicitly describes paid calls and proceeds after disclosure, without an approval step. Existing user authorization could mitigate this workflow risk.