История аудитов

The skill is a GitHub pull request review workflow that intentionally uses gh, npx, shell commands, and GitHub tokens. Most Markdown backtick findings are false positives, but webhook-driven execSync, authenticated automation, external command execution, and automated approval or merge examples are real risks that require controls before publication.

The skill is a GitHub pull request review workflow that intentionally uses gh, npx, shell commands, and GitHub tokens. Most Markdown backtick findings are false positives, but webhook-driven execSync, authenticated automation, external command execution, and automated approval or merge examples are real risks that require controls before publication.

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

Most static backtick detections are false positives from Markdown code fences and inline formatting. Real risks remain in the webhook example that executes PR comment text, use of runtime npx commands, and handling of GitHub tokens for repository mutations.

The static scanner produced many false positives because most shell patterns are documentation examples, and the weak-crypto and Windows SAM detections do not match the cited text. However, the skill includes unsafe executable examples, including a webhook handler that passes PR comment text into execSync and GitHub automation that can push fixes or auto-merge PRs. No prompt injection attempt or confirmed malicious exfiltration was found, but publication should wait for safer examples and stronger warnings.

This skill contains ONLY markdown documentation. No executable code, no file system operations, no network operations, and no credential access. All external command references are within documentation examples only. The static scanner flagged pattern matches in bash examples and security documentation concepts, but these are illustrative examples for legitimate GitHub CLI and ruv-swarm tool usage. No malicious intent or actual security risk present.

This skill contains ONLY markdown documentation. No executable code, no file system operations, no network operations, and no credential access. All external command references are within documentation examples only. The static scanner flagged pattern matches in bash examples and security documentation concepts, but these are illustrative examples for legitimate GitHub CLI and ruv-swarm tool usage. No malicious intent or actual security risk present.

Pure documentation skill containing only markdown guidance. No executable code, file system access, or network operations. All external command references are within example documentation only.

Pure documentation skill containing only markdown guidance. No executable code, file system access, or network operations. All external command references are within example documentation only.

Pure documentation skill containing only markdown guidance. No executable code, file system access, or network operations. All external command references are within example documentation only.