История аудитов

Most static findings misclassify Markdown backticks, prose, and a public Schema.org URL as execution or reconnaissance. Eleven command ranges are confirmed, and semantic review found that untrusted issue text can drive authenticated repository mutations without required approval.

Most static backtick findings are Markdown formatting false positives. Several SKILL.md ranges do intentionally use gh, git, and grep, and the main risk is authenticated GitHub mutation driven by untrusted issue content.

All 148 static alerts were adjudicated as false positives. The flagged backticks are Markdown code fences or inline literals, and the hardcoded URL is a Schema.org reference. No prompt injection or hidden malicious intent was found in SKILL.md or examples.md.

Static analysis produced many high-risk pattern matches, but targeted review found Markdown examples and maintainer workflow guidance rather than hidden executable code or malicious intent. The skill is publishable with a medium warning because it guides state-changing gh and git commands and includes limited external documentation lookup.

This skill is pure documentation containing only markdown workflows, templates, and CLI command examples for GitHub issue management. All 262 static findings are FALSE POSITIVES. The flagged patterns are bash documentation examples (not executable Ruby/shell code), standard git/gh CLI commands for legitimate operations, and harmless documentation URLs. No executable code, scripts, or malicious operations exist.

This skill is pure documentation containing only markdown workflows, templates, and CLI command examples for GitHub issue management. All 262 static findings are FALSE POSITIVES. The flagged patterns are bash documentation examples (not executable Ruby/shell code), standard git/gh CLI commands for legitimate operations, and harmless documentation URLs. No executable code, scripts, or malicious operations exist.

Pure prompt-based skill containing only documentation and workflow instructions. No executable code, scripts, or network operations. Uses standard gh CLI commands documented in plain text. Capabilities directly match stated purpose of GitHub issues management.

Pure prompt-based skill containing only documentation and workflow instructions. No executable code, scripts, or network operations. Uses standard gh CLI commands documented in plain text. Capabilities directly match stated purpose of GitHub issues management.

Pure prompt-based skill containing only documentation and workflow instructions. No executable code, scripts, or network operations. Uses standard gh CLI commands documented in plain text. Capabilities directly match stated purpose of GitHub issues management.