Audit History

The static analyzer findings are false positives caused by Markdown code spans, fenced examples, placeholder paths, and an environment variable name used in documentation. Manual review found semantic risk from coercive prompt-language and mandatory reasoning/activity logging that can override user intent and collect sensitive details.

The static analyzer findings are false positives caused by Markdown code spans, fenced examples, placeholder paths, and an environment variable name used in documentation. Manual review found semantic risk from coercive prompt-language and mandatory reasoning/activity logging that can override user intent and collect sensitive details.

Static command, filesystem, and environment hits are mostly false positives caused by Markdown examples, placeholder paths, and variable names. The substantive risk is prompt-style authority language that tells agents to treat the skill as non-negotiable policy and to log broad work details. No evidence found of bundled executable code, network exfiltration, or confirmed malicious intent.

All static findings are false positives. The skill is documentation for the Scribe MCP tool which manages project documentation. Detected patterns are documentation references, markdown formatting, and metadata - not actual security vulnerabilities.

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

Pure documentation file (SKILL.md) providing guidance for AI agents. No executable code, no network calls, no file access, no credentials. Describes MCP tool usage but does not perform operations itself.

Pure documentation file (SKILL.md) providing guidance for AI agents. No executable code, no network calls, no file access, no credentials. Describes MCP tool usage but does not perform operations itself.

Pure documentation file (SKILL.md) providing guidance for AI agents. No executable code, no network calls, no file access, no credentials. Describes MCP tool usage but does not perform operations itself.