История аудитов

All 47 static alerts are false positives caused by Markdown fences, TypeScript template literals, placeholder URLs, intended SDK networking, or named environment configuration. Semantic review found two high-risk documentation patterns: logging a bearer-token URL and showing a negotiation route without demonstrated authentication.

The static findings are false positives caused by Markdown code fences, TypeScript template literals, placeholder Azure endpoints, and documentation-only environment-variable examples. No prompt injection or malicious exfiltration intent was found. One medium semantic issue remains because the guide demonstrates logging a generated client access URL that can contain a bearer token.

The static findings are false positives caused by Markdown code fences, TypeScript template literals, placeholder Azure endpoints, and documentation-only environment-variable examples. No prompt injection or malicious exfiltration intent was found. One medium semantic issue remains because the guide demonstrates logging a generated client access URL that can contain a bearer token.

The static analyzer flagged many shell execution patterns, but these are Markdown code fences and TypeScript examples, not executable skill logic. The skill is generally publishable, but it includes examples that access environment secrets and log a client access token URL, so users need security warnings.

This skill contains legitimate Azure Web PubSub SDK documentation. Static analyzer produced 35 false positive external_commands findings by misinterpreting markdown code block backticks as shell execution. Network and environment variable patterns are standard Azure SDK usage. No malicious intent detected.