All 19 static findings are false positives. Backticks are Markdown formatting rather than executable shell or Ruby code, and the relative paths are fixed documentation references. No prompt injection, credential exfiltration, or untrusted command construction was found in the reviewed files.
Most Ruby backtick detections are false positives caused by Markdown inline code, but the documented deployment command is real. The parent-directory references are confirmed because they direct the agent outside the reviewed skill package. Semantic review found cost-bearing deployment risk that requires explicit confirmation and careful secret handling.
The skill is designed to run a deployment command and notes that launches depend on credits, payments, quotas, and free slots. Without explicit confirmation, it could create resources or consume paid capacity.
The deployment command and payment or quota prerequisites are stated directly in SKILL.md. The risk is contextual because safe use depends on user confirmation.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill points to a parent-directory sibling repository outside the skill package. That breaks package boundaries and may depend on unreviewed local files.
The skill instructs the agent to read a parent-directory shared file outside this skill. That is real filesystem traversal beyond the reviewed package.
The skill instructs the agent to read a parent-directory shared file outside this skill. That is real filesystem traversal beyond the reviewed package.
The line explicitly instructs the agent to use the local altllm cloud-claw-deploy command. It is documented in Markdown, but following it can launch external deployment tooling.