Audit History

This skill is a static Markdown reference guide for designing REST and GraphQL APIs. All 36 static findings are false positives: the flagged patterns are Markdown code fences misread as shell/Ruby backtick execution, an example placeholder URL, and REST/OpenAPI documentation snippets misread as system reconnaissance. There is no executable code, no network activity, no filesystem or environment access, and no prompt-injection content. The skill is safe.

The static findings are false positives caused by Markdown examples, OpenAPI placeholders, and route identifiers. One contextual risk remains: the OpenAPI template recommends npx validation commands, which can execute third-party packages if run automatically.

The static findings are false positives caused by Markdown examples, OpenAPI placeholders, and route identifiers. One contextual risk remains: the OpenAPI template recommends npx validation commands, which can execute third-party packages if run automatically.

Static analysis reported many high-risk patterns, but review found they are markdown code fences, REST method examples, OpenAPI references, and authentication documentation. No prompt injection, credential access, data exfiltration, or executable malware behavior was found. The remaining concern is optional guidance to run external npx validation tools, which creates a moderate supply-chain risk if users execute it without pinning or review.

Pure documentation skill containing only markdown files with API design guidance, templates, and best practices. No executable code, scripts, network calls, or filesystem access beyond reading its own documentation files. All static findings are false positives: markdown code block delimiters were misidentified as shell backticks, example URLs flagged as hardcoded URLs are non-sensitive placeholders, JWT references flagged as weak cryptography are standard API authentication patterns, and HTTP method documentation was misidentified as system reconnaissance.

Pure documentation skill containing only markdown files with API design guidance, templates, and best practices. No executable code, scripts, network calls, or filesystem access beyond reading its own documentation files. All static findings are false positives: markdown code block delimiters were misidentified as shell backticks, example URLs flagged as hardcoded URLs are non-sensitive placeholders, JWT references flagged as weak cryptography are standard API authentication patterns, and HTTP method documentation was misidentified as system reconnaissance.

Pure prompt-based documentation skill. Contains no executable code, no scripts, no network calls, and no filesystem access beyond its own documentation files. All content is guidance, templates, and best practices for API design.

Pure prompt-based documentation skill. Contains no executable code, no scripts, no network calls, and no filesystem access beyond its own documentation files. All content is guidance, templates, and best practices for API design.

Pure prompt-based documentation skill. Contains no executable code, no scripts, no network calls, and no filesystem access beyond its own documentation files. All content is guidance, templates, and best practices for API design.