All 13 static findings are false positives caused by Markdown code spans, code fences, an informational URL, and a relative documentation link. The embedded example still presents two medium risks: unescaped user input in HTML email and a publicly callable email-sending flow without explicit abuse controls. These example patterns should be hardened before publication.
The registration example concatenates the caller-provided name into htmlBody without escaping. A crafted name could inject misleading HTML into the verification email.
The name parameter is accepted on line 112 and directly concatenated into HTML on line 130. No escaping or sanitization appears in the example.
The public registration example sends a verification message to a caller-supplied address without documented throttling. Attackers could use many identities to send unwanted email.
The public function accepts an email and immediately calls sendVerificationEmail. The shown flow has no rate limit, cooldown, or broader abuse control.
All static findings are false positives caused by Markdown backticks, code fences, a documentation URL, and a relative link. The example still permits unverified email reservation and inserts an unescaped name into HTML email content.
Registration binds a caller-supplied email before ownership proof. An attacker can reserve another person's address and block its legitimate registration.
The example checks uniqueness and writes emailToPrincipal before sending or completing verification. The ordering directly enables unverified address reservation.
The static findings are false positives caused by Markdown inline code, code fences, and a documentation link. No shell execution, network request, or filesystem access is present in the skill file. A semantic issue remains because the example email body concatenates a user-provided name into HTML without escaping.
The example registration flow accepts a user name and concatenates it into htmlBody for a verification email. If copied as production code, markup in the name could alter the email content.
The example directly joins name into an HTML string without showing escaping. It is documentation code, so confidence is high enough to flag but not critical.