Three command examples are confirmed medium-risk because they interpolate placeholders and invoke external Python scripts. The other 45 findings are documentation syntax, safe example domains, public links, or relative documentation references.
4
Files scanned
525
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The line explicitly directs execution of Python connector and ledger commands. Brand and domain placeholders may become user-controlled shell values without defined validation.
**Keyless upstream AI-citation spot-check (ai-referrals mode)**: referral logs only show clicks *aft
The line directs execution of Tavily and ledger Python commands using query and domain placeholders. Unsafe interpolation could permit command injection.
Three command examples are confirmed medium-risk because they interpolate placeholders and invoke external Python scripts. The other 45 findings are documentation syntax, safe example domains, public links, or relative documentation references.
4
Files scanned
525
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The line explicitly directs execution of Python connector and ledger commands. Brand and domain placeholders may become user-controlled shell values without defined validation.
**Keyless upstream AI-citation spot-check (ai-referrals mode)**: referral logs only show clicks *aft
The line directs execution of Tavily and ledger Python commands using query and domain placeholders. Unsafe interpolation could permit command injection.
Three findings are confirmed because SKILL.md directly recommends executing connector and ledger Python scripts with user-supplied placeholders. The other 45 detections are documentation syntax, example data, trusted informational links, or relative Markdown references; no prompt injection or malicious intent was found.
4
Files scanned
525
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The line directly instructs execution of Python connector and ledger scripts with brand and domain placeholders. Unvalidated interpolation can expose command and network risk.
**Keyless upstream AI-citation spot-check (ai-referrals mode)**: referral logs only show clicks *aft
The line directs execution of Tavily and ledger Python scripts using query and domain placeholders. These external operations require validation and consent.
Most static findings are false positives from Markdown code formatting, relative documentation links, metadata URLs, and SEO reference examples. I confirmed the three lines that explicitly tell the agent to run local Python connector or ledger commands; I found no prompt injection or malicious exfiltration intent.
4
Files scanned
525
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Line 69 explicitly suggests running python3 connector scripts with a brand argument and piping results into ledger.py. That is local command execution from skill instructions and needs user approval plus safe argument handling.
**Keyless upstream AI-citation spot-check (ai-referrals mode)**: referral logs only show clicks *aft
Line 73 explicitly suggests running tavily.py and ledger.py with a user-supplied query. This is local command execution plus network-backed connector activity from skill instructions.
**Zero-dependency measurement loop (ai-referrals)**: store each period's AI-channel KPIs and let the
Line 83 instructs the agent to run ledger.py record, diff, and trend commands with user-provided domain and KPI data. This is local command execution from skill instructions and should be gated.
Most static alerts are Markdown links, examples, metadata, or inline code and are false positives. Three optional connector commands in SKILL.md remain confirmed medium risks because they instruct local python command execution with user-provided inputs.
4
Files scanned
525
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
This line instructs running python3 connector scripts and piping results into a ledger. The command appears legitimate, but it is real external command execution with user-provided brand or domain input.
**Keyless upstream AI-citation spot-check (ai-referrals mode)**: referral logs only show clicks *aft
This line instructs running a Tavily connector command and piping output into a ledger. It is optional, but still executes local commands with user-supplied query or domain input.
**Zero-dependency measurement loop (ai-referrals)**: store each period's AI-channel KPIs and let the
This line instructs running ledger.py commands with supplied KPI data. It is local command execution with persistent measurement writes, so it should stay as a medium risk.
Most static alerts are Markdown links, examples, metadata, or inline code and are false positives. Three optional connector commands in SKILL.md remain confirmed medium risks because they instruct local python command execution with user-provided inputs.
4
Files scanned
525
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
This line instructs running python3 connector scripts and piping results into a ledger. The command appears legitimate, but it is real external command execution with user-provided brand or domain input.
**Keyless upstream AI-citation spot-check (ai-referrals mode)**: referral logs only show clicks *aft
This line instructs running a Tavily connector command and piping output into a ledger. It is optional, but still executes local commands with user-supplied query or domain input.
**Zero-dependency measurement loop (ai-referrals)**: store each period's AI-channel KPIs and let the
This line instructs running ledger.py commands with supplied KPI data. It is local command execution with persistent measurement writes, so it should stay as a medium risk.
The static findings are documentation artifacts: Markdown code spans, relative repository links, example URLs, and optional connector examples. I found no prompt injection, covert data exfiltration, arbitrary code execution, or unsafe filesystem access in the reviewed files.