История аудитов

The static analyzer flagged many Markdown backticks as Ruby or shell execution, and those are mostly false positives. Human review confirmed that the skill does instruct agents to run repository-local Python utilities and cleanup commands, so it carries a legitimate external-command risk but no evidence of malicious intent.

All static findings are false positives. The skill is a legitimate workflow orchestration system for document processing. Scanner flagged SHA256 hashes as C2/weak crypto (they are secure hashes for file integrity), and documentation code examples in SKILL.md as command execution (they are markdown references, not code). No malicious patterns confirmed.

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

Prompt-based orchestration skill with no executable code. References internal Python scripts for system health checks, but these are part of the managed system's own tooling. No network calls, credential access, or suspicious behavior detected. Legitimate agent coordination tool.

Prompt-based orchestration skill with no executable code. References internal Python scripts for system health checks, but these are part of the managed system's own tooling. No network calls, credential access, or suspicious behavior detected. Legitimate agent coordination tool.

Prompt-based orchestration skill with no executable code. References internal Python scripts for system health checks, but these are part of the managed system's own tooling. No network calls, credential access, or suspicious behavior detected. Legitimate agent coordination tool.