История аудитов

Markdown formatting caused most command findings, and ordinary links or placeholder URLs caused most network findings. Two low-risk URLs remain confirmed, while contextual review found medium risks from unpinned installations and external media processing.

Static Ruby/shell backtick findings are false positives caused by Markdown inline code and fenced command examples. Hardcoded URL findings are documentation links or placeholder media URLs, not hidden network calls. The skill has medium contextual risk because it grants broad infsh CLI access and sends prompts or media URLs to external video services.

Static Ruby/shell backtick findings are false positives caused by Markdown inline code and fenced command examples. Hardcoded URL findings are documentation links or placeholder media URLs, not hidden network calls. The skill has medium contextual risk because it grants broad infsh CLI access and sends prompts or media URLs to external video services.

The static external command findings are true positives because the skill authorizes and documents repeated Bash calls to the infsh CLI. I found no evidence of malware or prompt injection, but the CLI sends prompts, image URLs, audio URLs, and video URLs to an external inference service, so publication should include a network data sharing warning.

The static external command findings are true positives because the skill authorizes and documents repeated Bash calls to the infsh CLI. I found no evidence of malware or prompt injection, but the CLI sends prompts, image URLs, audio URLs, and video URLs to an external inference service, so publication should include a network data sharing warning.

All 66 detected patterns are false positives from documentation code examples in SKILL.md. The file contains only Markdown documentation with bash code blocks showing users how to use the external inference.sh CLI tool. No executable code, command injection vectors, or active network requests exist in this skill.