Audit History

Most static hits are false positives from Markdown syntax, reference links, and labeled security examples. The CI template has a critical supply-chain risk because it pipes an unpinned remote script into Bash. The skill also provides high-impact credential fuzzing and reconnaissance workflows that require explicit authorization.

Most static alerts are Markdown examples, placeholder URLs, or reference text, but the review confirms a critical CI supply-chain issue and high-risk dual-use DAST guidance. The skill is useful for authorized application security testing, yet it can enable reconnaissance, credential enumeration, and sensitive file discovery if used outside scope.

I confirmed the remote pipe-to-shell CI installer and the intended active web-fuzzing workflows as security-relevant risks. Most static hits are false positives from Markdown code fences, placeholder URLs, security examples, and generic templates. No prompt injection attempt was found in the reviewed files.

Static analysis reported many command, network, environment, script, and filesystem patterns, but review shows most are documentation examples or security-rule templates. The skill is still medium risk because it provides real ffuf network fuzzing and credential-fuzzing workflows that require authorization and rate limits. No prompt injection or confirmed malicious intent was found.

Documentation-only skill providing guidance for ffuf, a legitimate open-source DAST tool. All static findings are in markdown files and YAML templates showing example commands. No executable code, network operations, or credential access present in the skill itself. Heuristic alerts trigger on expected DAST tool patterns (command execution, network requests, credential handling) which are legitimate functionality for web fuzzing.

Documentation-only skill providing guidance for ffuf, a legitimate open-source DAST tool. All static findings are in markdown files and YAML templates showing example commands. No executable code, network operations, or credential access present in the skill itself. Heuristic alerts trigger on expected DAST tool patterns (command execution, network requests, credential handling) which are legitimate functionality for web fuzzing.

Documentation-only skill containing no executable code. Provides guidance for using the legitimate open-source ffuf security tool. All files are template documentation with defensive security patterns. No network operations, file system access, or code execution paths present.

Documentation-only skill containing no executable code. Provides guidance for using the legitimate open-source ffuf security tool. All files are template documentation with defensive security patterns. No network operations, file system access, or code execution paths present.

Documentation-only skill containing no executable code. Provides guidance for using the legitimate open-source ffuf security tool. All files are template documentation with defensive security patterns. No network operations, file system access, or code execution paths present.