Static analysis reported many high and critical patterns, but review found they are mostly Markdown code examples, method names, license text, and documentation snippets rather than executable skill behavior. No prompt injection attempt or confirmed malicious intent was found. The skill still carries medium risk because copied examples include environment secrets, network calls, and file reads that need access controls in generated MCP servers.
The documentation shows an API key read from an environment variable and placed into a URL query string. If copied into a real MCP server, the key could be exposed through logs, caches, browser history, or upstream analytics.
The exact example reads WEATHER_API_KEY and interpolates it into a fetch URL. It is documentation rather than active code, so the risk depends on a user copying the pattern.
The resource template example maps a user-controlled path into a file read without showing allow-listing, path normalization, or workspace boundaries. If copied directly, a generated MCP server could expose unintended local files.
The example directly connects a URI path parameter to readFile(path). It is a sample snippet, but the missing boundary checks are a realistic implementation risk.
Static Weak Cryptography Matches Are False Positives
The weak cryptography alerts align with Markdown headings, prose, method names, or license text. No evidence found of cryptographic APIs, hash functions, password handling, or encryption code in the reviewed skill files.
Manual review found documentation text and no executable cryptographic logic. The repeated alerts are consistent with token-level matches in Markdown and license prose.
Static External Command Matches Are Mostly Markdown
Most command execution alerts come from code fences, inline method names, and eval instructions. The only direct shell command is a visible npx install command for the replacement skill, not hidden execution by this skill.
The referenced files are Markdown or JSON evaluation text. No script file, package hook, or automatic command execution path was found.
The scanner combined code examples for environment variables, network calls, and command-like text into a critical heuristic. Review found no data exfiltration flow, hidden network endpoint, or executable automation inside the skill itself.
The suspicious categories are present only as guidance for MCP apps. The skill content does not itself run code or transmit collected secrets.