Audit History

The static analyzer's Ruby backtick, weak cryptography, and system reconnaissance findings are false positives caused by Markdown code fences, filenames, and ordinary prose. The skill still has medium operational risk because its intended workflow reads local HTML and image files, renders screenshots with a headless browser, and sends visual content to Claude for analysis.

Pure prompt-based skill with no executable code. All 37 static findings are false positives: markdown backtick formatting was misidentified as shell execution, documentation references as file access, and API image attachment as malicious upload. This is a legitimate visual accuracy validation tool that sends images to Claude API for comparison.

Pure prompt-based skill with no executable code. All 37 static findings are false positives: markdown backtick formatting was misidentified as shell execution, documentation references as file access, and API image attachment as malicious upload. This is a legitimate visual accuracy validation tool that sends images to Claude API for comparison.

Pure prompt-based skill with no executable code. All described behaviors (image comparison, Claude API calls, file operations) are legitimate for visual accuracy validation. No obfuscation, no suspicious patterns, no credential theft or exfiltration.

Pure prompt-based skill with no executable code. All described behaviors (image comparison, Claude API calls, file operations) are legitimate for visual accuracy validation. No obfuscation, no suspicious patterns, no credential theft or exfiltration.

Pure prompt-based skill with no executable code. All described behaviors (image comparison, Claude API calls, file operations) are legitimate for visual accuracy validation. No obfuscation, no suspicious patterns, no credential theft or exfiltration.