Two of 38 static findings are confirmed because the workflow runs project-controlled verification scripts that may execute arbitrary repository code. The remaining static findings are Markdown, safe examples, or explicit prohibitions. A separate medium-risk finding covers direct source edits and marker-based deletion.
The workflow inserts logs directly into source files, then removes each marker and its following line. A misplaced marker could delete unintended code.
The instructions explicitly require direct log insertion and pair-based deletion. The source mutation is intentional, while the unintended-deletion risk depends on marker integrity.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The workflow explicitly runs verify.sh, package scripts, builds, or tests. Repository-controlled scripts can execute arbitrary code without a stated confirmation step.
The Playwright workflow explicitly runs project verification scripts and package commands. Those repository-controlled commands can execute arbitrary code without a stated confirmation step.
All 38 static findings are false positives. The scanner interpreted Markdown code spans and fences as shell backtick execution, while the environment-file reference explicitly prohibits logging to sensitive files. The skill is readable workflow documentation and contains no prompt injection, exfiltration instruction, or executable payload.
All 38 static findings are false positives. The scanner interpreted Markdown code spans and fences as shell backtick execution, while the environment-file reference explicitly prohibits logging to sensitive files. The skill is readable workflow documentation and contains no prompt injection, exfiltration instruction, or executable payload.