Audit History

All 29 static findings are false positives caused by Markdown formatting, fixed command substitution, intentional project paths, and Japanese text. A semantic review found a medium-severity data-loss risk because deletion and in-place truncation can run without a mandatory preview or confirmation.

All 29 static findings are false positives. Most detect Markdown inline-code formatting, while the timestamped backup example uses fixed local shell syntax. The two high-entropy alerts are explained by readable multilingual Markdown; no prompt injection, exfiltration intent, or hidden payload was found.

All 29 static findings are false positives. Most detect Markdown inline-code formatting, while the timestamped backup example uses fixed local shell syntax. The two high-entropy alerts are explained by readable multilingual Markdown; no prompt injection, exfiltration intent, or hidden payload was found.

All 29 static findings are false positives. Most detect Markdown inline-code formatting, while the timestamped backup example uses fixed local shell syntax. The two high-entropy alerts are explained by readable multilingual Markdown; no prompt injection, exfiltration intent, or hidden payload was found.

Most static findings are false positives from Markdown references or documented Bash examples for local cleanup checks. The obfuscation alerts are explained by readable Japanese prose and front matter, and no prompt injection or data exfiltration intent was found.

Most static findings are Markdown backtick formatting or false obfuscation heuristics after manual review. The real risk is semantic: the skill guides destructive cleanup of .claude logs and state files, with user-controlled thresholds that need strict confirmation.

Most static findings are false positives from Markdown references or documented Bash examples for local cleanup checks. The obfuscation alerts are explained by readable Japanese prose and front matter, and no prompt injection or data exfiltration intent was found.

Static analysis reported many command-execution, filesystem, weak-crypto, and entropy findings. Review found no malicious payload, network access, credential handling, or prompt-injection text, but the skill intentionally allows Bash and file editing for project cleanup, so it should publish with a medium-risk warning.

All 60 static findings are FALSE POSITIVES. The flagged code exists in documentation files (auto-cleanup/doc.md), not executable code. Bash command examples use hardcoded strings with no user input. The YAML frontmatter '---' was misidentified as weak cryptography. This is a benign file cleanup utility for managing Plans.md, session-log.md, and CLAUDE.md.

All 60 static findings are FALSE POSITIVES. The flagged code exists in documentation files (auto-cleanup/doc.md), not executable code. Bash command examples use hardcoded strings with no user input. The YAML frontmatter '---' was misidentified as weak cryptography. This is a benign file cleanup utility for managing Plans.md, session-log.md, and CLAUDE.md.

This is a file cleanup utility skill with minimal risk. It uses bash scripts for standard file operations (read, write, move) on project documentation files. No network access, no credential exposure, and no persistence mechanisms detected. The skill operates within its documented scope of cleaning Plans.md, session-log.md, and CLAUDE.md files.

This is a file cleanup utility skill with minimal risk. It uses bash scripts for standard file operations (read, write, move) on project documentation files. No network access, no credential exposure, and no persistence mechanisms detected. The skill operates within its documented scope of cleaning Plans.md, session-log.md, and CLAUDE.md files.

This is a file cleanup utility skill with minimal risk. It uses bash scripts for standard file operations (read, write, move) on project documentation files. No network access, no credential exposure, and no persistence mechanisms detected. The skill operates within its documented scope of cleaning Plans.md, session-log.md, and CLAUDE.md files.