監査履歴

Most static matches are benign OOXML namespaces, documentation, template literals, and ordinary local document-processing operations. Four archive extraction calls are confirmed high-risk because they use extractall() on supplied Office archives without member-path validation. No prompt-injection, credential-exfiltration, or unauthorized network intent was found in the reviewed context. Static review was capped at 400/508 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Most static findings are false positives from OOXML namespace URLs, Markdown inline code, CSS color values, and JavaScript template literals. Confirmed risks are unsafe ZIP extraction of Office archives, privileged dependency installation instructions, and external hosted service steering. Fixed-argument subprocess calls do not show shell injection, but document converters should still be isolated for untrusted files.

The audit confirms real risk in unsafe ZIP archive extraction, selected external converter execution, and privileged or environment-modifying install guidance. Most other static hits are false positives from OOXML namespace URLs, schema references, Markdown formatting, JavaScript template literals, or validation text. No prompt injection or data-exfiltration intent was found in the reviewed skill files.

The audit confirms real risk in unsafe ZIP archive extraction, selected external converter execution, and privileged or environment-modifying install guidance. Most other static hits are false positives from OOXML namespace URLs, schema references, Markdown formatting, JavaScript template literals, or validation text. No prompt injection or data-exfiltration intent was found in the reviewed skill files.