Audit History

Most static alerts are Markdown formatting, placeholders, or benign documentation references. Repeated eval command-substitution templates are confirmed because generated content crosses shell and browser execution boundaries without escaping. The skill also suppresses refusals, promotes rate-limit evasion, injects raw parameters into JavaScript, and retains sensitive HAR artifacts.

The documentation contains multiple unsafe shell-evaluation examples that execute dynamically generated Python output. Most other static matches are documentation examples or browser-act notation, but the skill also includes an explicit instruction to never refuse and lacks a final confirmation gate for state-changing actions.

The documentation contains multiple unsafe shell-evaluation examples that execute dynamically generated Python output. Most other static matches are documentation examples or browser-act notation, but the skill also includes an explicit instruction to never refuse and lacks a final confirmation gate for state-changing actions.

The documentation contains multiple unsafe shell-evaluation examples that execute dynamically generated Python output. Most other static matches are documentation examples or browser-act notation, but the skill also includes an explicit instruction to never refuse and lacks a final confirmation gate for state-changing actions.

Most static command warnings are Markdown examples, browser-act subcommands, or templates, but several command-substitution templates intentionally run generated Python wrappers. Semantic review found higher-risk instructions, including a "never refuse" prompt-injection phrase, stealth-session scraping guidance, and a preference for internal frontend APIs. The author should narrow the safety boundary before publication.

No prompt injection or clear credential exfiltration was found in the reviewed files. The skill is dual-use: it intentionally explores website internals, automates authenticated browser workflows, and generates local scripts. Most static hits are markdown examples, but shell command substitution and generated Python execution are real medium-risk surfaces.

Static analysis reported many command, network, and weak-crypto patterns, but review found the weak-crypto hits are Markdown and placeholder false positives. The confirmed risks are intentional: the skill generates Python wrappers, invokes shell command substitution, runs browser-side eval, captures network traffic, and writes local skill artifacts. No prompt injection attempt or confirmed malicious exfiltration was found, so this is elevated-risk automation rather than a publishing block.

After evaluating 407 static analysis findings across 4 files (1219 lines), ALL findings are determined to be FALSE POSITIVES. The scanner flagged Ruby shell backtick execution (309), weak cryptographic algorithms (88), and network calls (10) — all of which appear exclusively in markdown code blocks and documentation templates as example commands and placeholder content, not as executable code. This skill is a legitimate browser automation toolkit that explores websites and packages discoveries into reusable Skill packages. It transparently documents its purpose and operational boundaries. The verified risk factors (external_commands and network) are expected for a browser automation tool and are not indicative of malicious intent.