Audit History

Most static findings are false positives caused by Markdown code fences, mock HTTP examples, and ordinary test templates. The skill does instruct agents to run npm test commands, which can execute project-defined scripts and should require user approval in untrusted repositories. No prompt injection or data exfiltration intent was found.

Most static findings are false positives caused by Markdown code fences, mock HTTP examples, and ordinary test templates. The skill does instruct agents to run npm test commands, which can execute project-defined scripts and should require user approval in untrusted repositories. No prompt injection or data exfiltration intent was found.

Most static findings are Markdown fences, documentation examples, local test code, or mock handlers. The only confirmed risk is guidance to run npm test commands, because npm scripts can execute repository-defined code. No evidence found of prompt injection, data exfiltration, or malicious intent in SKILL.md.

Most static findings are Markdown fences, documentation examples, local test code, or mock handlers. The only confirmed risk is guidance to run npm test commands, because npm scripts can execute repository-defined code. No evidence found of prompt injection, data exfiltration, or malicious intent in SKILL.md.

Static analysis flagged many backticks, weak cryptography keywords, reconnaissance terms, and HTTP patterns. Manual review found Markdown test examples, local test commands, and mock HTTP handlers, with no malicious intent or prompt injection evidence.

This is a documentation-only skill containing testing guidance and templates. The static analyzer flagged 64 patterns as potentially malicious, but ALL findings are false positives caused by markdown documentation being misinterpreted as code. The skill contains no executable code, network calls, file system operations, or cryptographic implementations. All flagged patterns are legitimate documentation elements: code examples (``` fences), test data patterns, and testing terminology.

This is a documentation-only skill containing testing guidance and templates. The static analyzer flagged 64 patterns as potentially malicious, but ALL findings are false positives caused by markdown documentation being misinterpreted as code. The skill contains no executable code, network calls, file system operations, or cryptographic implementations. All flagged patterns are legitimate documentation elements: code examples (``` fences), test data patterns, and testing terminology.

This is a documentation-only skill that provides testing guidance and templates. It contains no executable code, network calls, or file system access. The skill is purely educational with code examples for test implementation.

This is a documentation-only skill that provides testing guidance and templates. It contains no executable code, network calls, or file system access. The skill is purely educational with code examples for test implementation.

This is a documentation-only skill that provides testing guidance and templates. It contains no executable code, network calls, or file system access. The skill is purely educational with code examples for test implementation.