История аудитов

Most static findings are false positives caused by Markdown code fences and illustrative TypeScript or SQL examples, not executable skill code. No prompt injection or credential exfiltration intent was found, but one example encourages unsafe SQL interpolation if copied into production.

Most static findings are false positives caused by Markdown code fences and illustrative TypeScript or SQL examples, not executable skill code. No prompt injection or credential exfiltration intent was found, but one example encourages unsafe SQL interpolation if copied into production.

The skill is a Markdown guide with SQL and TypeScript examples, not executable automation. Static command, filesystem, environment, weak-crypto, and reconnaissance alerts are mostly false positives from fenced examples, but one sample teaches unsafe SQL string construction with interpolated trade fields.

This skill contains documentation and code examples for ClickHouse database usage. Static analyzer flagged 86 patterns that are all false positives: backticks in markdown denote SQL code blocks (not shell execution), environment variable references are configuration examples, and system table queries are legitimate ClickHouse monitoring features. No executable code or security risks present.