Audit History

All 89 static findings are false positives caused by Markdown backticks, example.com documentation URLs, relative documentation links, or natural-language schedule text. The skill documents intentional Firecrawl CLI, email, and webhook operations, with no prompt injection, covert exfiltration, path traversal, or command substitution found.

Static findings primarily matched Markdown backticks, example URLs, relative links, and natural-language schedules, so they were marked false positive. Two contextual risks remain: the allowed npx command can execute an unpinned npm package, and monitor notifications can send page diffs to external destinations. Publish with clear install and notification warnings, or tighten the allowed tools.

Static findings primarily matched Markdown backticks, example URLs, relative links, and natural-language schedules, so they were marked false positive. Two contextual risks remain: the allowed npx command can execute an unpinned npm package, and monitor notifications can send page diffs to external destinations. Publish with clear install and notification warnings, or tighten the allowed tools.