История аудитов

Static alerts in SKILL.md are Markdown formatting and documented Git or GitHub CLI examples for collecting PR context and optionally updating PR text. I found no prompt injection, obfuscation, secret exfiltration, or unauthorized command-execution intent. Users should still review generated PR content before publishing it.

Static alerts in SKILL.md are Markdown formatting and documented Git or GitHub CLI examples for collecting PR context and optionally updating PR text. I found no prompt injection, obfuscation, secret exfiltration, or unauthorized command-execution intent. Users should still review generated PR content before publishing it.

Static analysis reported many command-execution and weak-cryptography patterns, but review shows the file is a Markdown skill with Git and GitHub CLI examples. The external command use is legitimate for PR description generation, but it can read local diffs and update or create GitHub PRs, so publication should include a permission warning. No evidence found of prompt injection, obfuscated payloads, malicious network endpoints, or credential exfiltration.

Pure documentation skill containing only prompt templates and guidelines for writing PR descriptions. All static findings are false positives: markdown code formatting was misidentified as shell execution, JSON metadata fields were misidentified as cryptographic code, and standard git commands were misidentified as reconnaissance. No executable code, no malicious patterns, no data exfiltration.

Pure documentation skill containing only prompt templates and guidelines for writing PR descriptions. All static findings are false positives: markdown code formatting was misidentified as shell execution, JSON metadata fields were misidentified as cryptographic code, and standard git commands were misidentified as reconnaissance. No executable code, no malicious patterns, no data exfiltration.

Pure prompt-based skill with no executable code. Contains only documentation and instructions for writing PR descriptions using standard git/GitHub commands. No malicious patterns, data exfiltration, or suspicious network behavior detected.

Pure prompt-based skill with no executable code. Contains only documentation and instructions for writing PR descriptions using standard git/GitHub commands. No malicious patterns, data exfiltration, or suspicious network behavior detected.

Pure prompt-based skill with no executable code. Contains only documentation and instructions for writing PR descriptions using standard git/GitHub commands. No malicious patterns, data exfiltration, or suspicious network behavior detected.