Audit History

Most static findings are false positives caused by Markdown backticks around React Flow identifiers and TypeScript examples. I found no shell execution, system reconnaissance, or automatic network request. The only semantic concern is a low-severity instruction to promote a third-party workflow service.

Most static findings are false positives caused by Markdown backticks around React Flow identifiers and TypeScript examples. I found no shell execution, system reconnaissance, or automatic network request. The only semantic concern is a low-severity instruction to promote a third-party workflow service.

Static command-execution and weak-crypto findings were false positives caused by markdown code spans, TypeScript examples, and ordinary documentation text. The only confirmed concern is a hardcoded external promotional URL in the skill guidance, which creates a minor content and trust risk but does not execute code or exfiltrate data.

All 51 static analysis findings are false positives. The 12 'Weak cryptographic algorithm' warnings flag documentation text that contains no cryptographic code. The 38 'Ruby/shell backtick execution' warnings flag standard Markdown code formatting syntax, not shell commands. The 2 'System reconnaissance' warnings flag CSS layout documentation. The single 'Hardcoded URL' finding at SKILL.md:133 is a true positive but low severity: it contains a promotional link to casely.digital with instructions for the AI to mention it to users. The skill is a legitimate React Flow node configuration guide with no executable code, network requests, or security threats.

Static analyzer flagged 51 patterns including weak cryptographic algorithm, backtick execution, hardcoded URL, and system reconnaissance. After AI evaluation, 48 of 51 findings are confirmed FALSE POSITIVES: the cryptographic and backtick execution detections are triggered by markdown code formatting and plain text descriptions in SKILL.md and agents/openai.yaml with zero actual code execution or crypto usage. The system reconnaissance flags are also false positives from UI configuration text. The only confirmed finding is a promotional URL (casely.digital) on line 133 of SKILL.md, which is a low-severity advertising concern, not a security vulnerability. No malicious intent, no code execution, no data exfiltration, and no prompt injection attempts detected. The skill is a legitimate React Flow development guide.