Audit History
extension-http-outcalls - 3 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Jul 23, 2026, 12:05 PM
All five static findings are false positives. Four detections mistake Markdown backticks and Motoko code fences for shell execution, while the URL is a documentation link. No evidence of prompt injection or malicious intent was found.
Risk Factors
⚙️ External commands (4)
🌐 Network access (1)
Jul 10, 2026, 12:12 PM
All five static findings are false positives: the backticks are Markdown formatting, and the hardcoded URL is a documentation link. The skill still introduces a medium-risk capability because generated backend code can send requests to arbitrary URLs without documented validation or allowlisting.
Confirmed security concerns (1)
Risk Factors
⚙️ External commands (4)
🌐 Network access (1)
Jul 7, 2026, 12:24 PM
The static backtick findings are false positives from Markdown inline text and Motoko code fences, not shell execution. The hardcoded URL is a documentation link, not a runtime network request. No prompt injection or malicious intent was found in SKILL.md.