Audit History

The 45 external-command alerts are false positives caused by Markdown fences and inline option formatting; no backtick execution exists. Temporary socket usage, placeholder TLS paths, container binding, loopback documentation, and worker-option text are legitimate examples. Five examples bind to all interfaces without sufficient exposure warnings, and four also use development reload settings.

Most static findings are false positives from Markdown code fences or command examples, not executable skill code. No prompt injection or data exfiltration intent was found. A medium semantic issue remains because several examples combine public network binding with reload or development-oriented settings without a clear warning.

The static findings in SKILL.md and evaluation.json are false positives caused by documentation examples and inert JSON strings. A separate semantic issue remains because evaluation.json contains untrusted self-audit claims that label the package safe and all findings false positives.

Static analysis flagged command execution, network, filesystem, credential, and obfuscation patterns, but review found documentation examples rather than executable skill code. No malicious intent, prompt injection, credential exfiltration, or hidden runtime behavior was found. The remaining risk is low because examples bind Uvicorn to all interfaces and should be used with deployment context.

This is a documentation-only skill containing example commands and configurations for Uvicorn ASGI server. All 98 static findings are FALSE POSITIVES. The analyzer incorrectly flagged documentation examples as security issues. The skill has no executable code, no network connections, no credential handling, and no command injection vectors.

This is a documentation-only skill containing example commands and configurations for Uvicorn ASGI server. All 98 static findings are FALSE POSITIVES. The analyzer incorrectly flagged documentation examples as security issues. The skill has no executable code, no network connections, no credential handling, and no command injection vectors.

This is a legitimate documentation skill for Uvicorn ASGI server. All 'external_commands' findings are actually code examples showing how to run uvicorn commands. The 'network' findings are documentation examples using standard localhost addresses (0.0.0.0, 127.0.0.1). The 'sensitive' finding about certificates is documenting legitimate SSL configuration. No actual security risks detected.

This is a legitimate documentation skill for Uvicorn ASGI server. All 'external_commands' findings are actually code examples showing how to run uvicorn commands. The 'network' findings are documentation examples using standard localhost addresses (0.0.0.0, 127.0.0.1). The 'sensitive' finding about certificates is documenting legitimate SSL configuration. No actual security risks detected.