No prompt injection or malicious intent was found in SKILL.md. Most static findings are Markdown formatting, inline code, or reference URLs. A few command examples install packages, run local Python files, or use sudo, so agents should require explicit approval and a trusted environment.
1
Files scanned
575
Lines analyzed
8
Review items
0
False positives ignored
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The CI example uses sudo apt-get to install Graphviz with root privileges. Even in setup guidance, privileged commands should require explicit approval and isolated CI context.
The bash install block instructs package-manager commands for pytm and Graphviz. This is legitimate setup guidance, but installer commands can modify the host and need explicit approval.
The CI example runs dependency installation and local Python scripts. This is expected for CI, but it can execute project code and should be limited to trusted repositories.
No prompt injection or malicious intent was found in SKILL.md. Most static findings are Markdown formatting, inline code, or reference URLs. A few command examples install packages, run local Python files, or use sudo, so agents should require explicit approval and a trusted environment.
1
Files scanned
575
Lines analyzed
8
Review items
0
False positives ignored
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The CI example uses sudo apt-get to install Graphviz with root privileges. Even in setup guidance, privileged commands should require explicit approval and isolated CI context.
The bash install block instructs package-manager commands for pytm and Graphviz. This is legitimate setup guidance, but installer commands can modify the host and need explicit approval.
The CI example runs dependency installation and local Python scripts. This is expected for CI, but it can execute project code and should be limited to trusted repositories.
The audit found extensive Markdown examples and inline code that static analysis misclassified as shell backtick execution. Two sudo package installation examples are confirmed because they require elevated privileges, while the hardcoded URLs are documentation references.
1
Files scanned
575
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill instructs users or CI jobs to run a sudo apt-get install command. This is legitimate setup guidance, but it requires privileged package installation and should require explicit user approval.
The skill instructs users or CI jobs to run a sudo apt-get install command. This is legitimate setup guidance, but it requires privileged package installation and should require explicit user approval.
Most static findings are false positives caused by Markdown code fences, inline code formatting, and reference URLs. Two findings are confirmed because the skill recommends sudo apt-get installation for Graphviz, which is legitimate but privileged setup guidance that agents should not execute automatically.
1
Files scanned
575
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill instructs users or CI jobs to run sudo apt-get install for Graphviz. This is legitimate setup guidance, but it requests privileged package installation and should not be auto-run by an agent.
The skill instructs users or CI jobs to run sudo apt-get install for Graphviz. This is legitimate setup guidance, but it requests privileged package installation and should not be auto-run by an agent.
Most Ruby backtick findings are false positives from Markdown code fences and inline code in SKILL.md. The audit confirms package-installation and host-command examples, including two sudo commands, while reference URLs are documentation links only.
1
Files scanned
575
Lines analyzed
8
Review items
0
False positives ignored
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The GitHub Actions example runs sudo apt-get install -y graphviz. That is elevated package installation that can modify the host or CI image and should require approval.
The bash install block tells users to run pip and package-manager installs for pytm and Graphviz. The commands are legitimate, but they install external packages and can alter the environment.
The CI workflow example includes run steps for pip, apt-get, and local Python scripts. It is documentation, but copying it into CI performs package installation and script execution.
Most static external-command hits are Markdown code fences, inline code, or reference links rather than Ruby backtick execution. Confirmed risks remain for package manager commands, sudo-based Graphviz installation, and examples that run local Python helper scripts. No prompt injection or data exfiltration intent was found.
The skill claims bundled helper scripts under scripts, but the analyzed file tree only contains SKILL.md. Commands that run scripts/generate_report.py or scripts/check_mitigations.py could execute unrelated workspace files.
The SKILL.md text repeatedly references helper scripts, while the report file tree lists only SKILL.md. The risk depends on execution context, so confidence is high but not absolute.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The CI workflow uses sudo apt-get install -y graphviz, which changes the system with elevated privileges. It is a standard dependency step, but auto-running it bypasses host-change consent.
The troubleshooting guidance uses sudo apt-get install graphviz, which requires elevated privileges on the host. This should require explicit approval before execution.
The bash install block tells users or agents to run pip, brew, or apt-get to install dependencies. These commands are legitimate setup steps, but they modify the execution environment if run automatically.
The CI example runs package installation and local Python commands, including a mitigation-check script. This is intended automation, but it executes external commands during builds.
Most static external-command hits are Markdown code fences, inline code, or reference links rather than Ruby backtick execution. Confirmed risks remain for package manager commands, sudo-based Graphviz installation, and examples that run local Python helper scripts. No prompt injection or data exfiltration intent was found.
The skill claims bundled helper scripts under scripts, but the analyzed file tree only contains SKILL.md. Commands that run scripts/generate_report.py or scripts/check_mitigations.py could execute unrelated workspace files.
The SKILL.md text repeatedly references helper scripts, while the report file tree lists only SKILL.md. The risk depends on execution context, so confidence is high but not absolute.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The CI workflow uses sudo apt-get install -y graphviz, which changes the system with elevated privileges. It is a standard dependency step, but auto-running it bypasses host-change consent.
The troubleshooting guidance uses sudo apt-get install graphviz, which requires elevated privileges on the host. This should require explicit approval before execution.
The bash install block tells users or agents to run pip, brew, or apt-get to install dependencies. These commands are legitimate setup steps, but they modify the execution environment if run automatically.
The CI example runs package installation and local Python commands, including a mitigation-check script. This is intended automation, but it executes external commands during builds.
Static analysis reported many command, network, credential, C2, and weak-crypto patterns, but review shows most are markdown examples, security taxonomy terms, or reference links. No prompt injection or malicious intent was found in SKILL.md. The remaining risk is legitimate guidance that includes package installation and sudo commands, so publication should include a command-execution warning.
Security Terms Misclassified as Sensitive or Malicious Content
Static hits for Windows SAM, C2, and weak cryptography are false positives from security framework names and example threat descriptions. OWASP SAMM and SOC2 are compliance references, not credential access or command-and-control behavior.
The suspicious strings are used in threat modeling and compliance context. No evidence found of credential extraction, C2 infrastructure, or cryptographic implementation.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill includes package installation commands, including sudo apt-get for graphviz in CI and troubleshooting examples. This is legitimate setup guidance, but users should review privileged package manager commands before running them.
The sudo commands are explicit and would run with elevated privileges if copied by a user. Context shows dependency installation, not malicious escalation, so the risk is moderate.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Markdown Code Fences Misclassified as Command Execution
Many static external-command findings are caused by fenced markdown examples and inline command text. They document pytm usage and do not execute automatically when the skill is loaded.
The flagged backticks are markdown code block delimiters around Python, YAML, and shell examples. No executable script file or automatic invocation is present.
The hardcoded URLs are reference links to pytm, OWASP, Microsoft STRIDE, MITRE ATT&CK, and NIST material. No evidence found that the skill sends data to these URLs.
The URLs appear in metadata references and a References section. There are no HTTP client calls, webhooks, or data upload instructions in the reviewed file.
Pure documentation skill containing only YAML frontmatter and markdown documentation teaching threat modeling concepts with the pytm library. No executable code, scripts, network calls, filesystem access, environment variable reads, or command execution capabilities are present. All static findings are false positives triggered by documentation patterns, not actual security risks.
Pure documentation skill containing only YAML frontmatter and markdown documentation teaching threat modeling concepts with the pytm library. No executable code, scripts, network calls, filesystem access, environment variable reads, or command execution capabilities are present. All static findings are false positives triggered by documentation patterns, not actual security risks.
Pure documentation skill containing no executable code. Only contains YAML frontmatter and markdown documentation teaching threat modeling concepts with the pytm library. No scripts, network calls, filesystem access, environment variable reads, or command execution capabilities present.
1
Files scanned
575
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Pure documentation skill containing no executable code. Only contains YAML frontmatter and markdown documentation teaching threat modeling concepts with the pytm library. No scripts, network calls, filesystem access, environment variable reads, or command execution capabilities present.
1
Files scanned
575
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Pure documentation skill containing no executable code. Only contains YAML frontmatter and markdown documentation teaching threat modeling concepts with the pytm library. No scripts, network calls, filesystem access, environment variable reads, or command execution capabilities present.
1
Files scanned
575
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.