All 442 static findings are false positives. The skill is a legitimate MCP server builder framework (deprecated). Findings appear in documentation/reference files showing code examples. The 'weak crypto' alerts are triggered by `.describe()` method (Zod), 'external commands' by markdown code fences, 'env access' by example config patterns, and 'network' by API call examples. No malicious code detected.
Reference files contain example code showing environment variable access patterns (process.env). These are educational examples teaching proper configuration, not actual credential access.
Pattern matched in documentation examples showing proper config patterns - no actual credential exfiltration
Documentation files use backtick code fences which trigger static scanner 'external commands' detection. These are markdown documentation, not executable code.
Markdown documentation with code examples - no actual shell command execution
Code examples using Zod schema .describe() method trigger 'weak cryptographic algorithm' alerts (scanner matches 'des'). These are schema field descriptions, not crypto operations.
Zod schema .describe() method for field documentation - false positive from pattern matching