All ten static findings are false positives. They match Markdown inline-code references and relative documentation paths, not executable shell code or file operations. No prompt injection, data exfiltration, or other intent-level security issue was found in the reviewed skill instructions.
The static backtick matches are mostly Markdown false positives, but two lines intentionally direct agents to use local altllm commands. The skill also requires sibling-directory references through ../ paths, which is a real packaging and instruction-boundary risk.
3
Files scanned
63
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill points to a sibling repository with ../cloud-claw, which crosses the skill directory boundary. Marketplace skills should avoid requiring access outside their packaged files.
The skill instructs the agent to read ../_shared/cloud-claw-preflight.md before use. That is explicit traversal outside the skill directory and may expose unreviewed instructions.
The skill instructs the agent to read ../_shared/cloud-claw-api-surface.md before use. That is explicit traversal outside the skill directory and may expose unreviewed instructions.
These skills are hosted in this repository, and the workflow is exposed through local `altllm cloud-
The line is Markdown, not Ruby execution, but it explicitly routes workflow through local altllm cloud-claw-* commands. Those commands can affect Cloud Claw resources and require command execution safeguards.
- Prefer the local `altllm cloud-claw-*` commands over ad-hoc raw HTTP.
The line instructs agents to prefer local altllm cloud-claw-* commands. That is intentional external command use for cloud operations, even though the Markdown backticks are not executable by themselves.