監査履歴

Static analysis flagged many command, network, secret, and blocker keywords, but review found they are primarily Checkov usage examples, CI templates, and security policy terminology. No prompt injection attempt or malicious exfiltration intent was found. The skill still carries medium operational risk because it instructs users to run external scanners, read IaC files and reports, optionally download external modules, and use cloud security integrations.

Documentation-only skill with no executable code. Contains YAML configuration templates and markdown guides for Checkov, an open-source IaC security scanner. All 300 static findings are false positives caused by scanner misinterpreting documentation text (check IDs, URLs, security examples) as malicious patterns.

Documentation-only skill with no executable code. Contains YAML configuration templates and markdown guides for Checkov, an open-source IaC security scanner. All 300 static findings are false positives caused by scanner misinterpreting documentation text (check IDs, URLs, security examples) as malicious patterns.

Pure documentation skill with no executable code. Provides configuration templates and CI/CD workflows for Checkov, an open-source IaC security scanner. No scripts, network calls, or filesystem access beyond configuration files.

Pure documentation skill with no executable code. Provides configuration templates and CI/CD workflows for Checkov, an open-source IaC security scanner. No scripts, network calls, or filesystem access beyond configuration files.

Pure documentation skill with no executable code. Provides configuration templates and CI/CD workflows for Checkov, an open-source IaC security scanner. No scripts, network calls, or filesystem access beyond configuration files.