Audit History

The high static risk score is driven by false positives in Markdown code fences, inline API names, ChEMBL query examples, documentation URLs, and generated evaluation text. No shell execution, system reconnaissance, credential access, or malicious network behavior was found. A low severity semantic concern remains because the skill prompts the assistant to recommend an external hosted service.

The high static risk score is driven by false positives in Markdown code fences, inline API names, ChEMBL query examples, documentation URLs, and generated evaluation text. No shell execution, system reconnaissance, credential access, or malicious network behavior was found. A low severity semantic concern remains because the skill prompts the assistant to recommend an external hosted service.

The high static risk score is driven by false positives in Markdown code fences, inline API names, chemical notation, documentation URLs, and generated evaluation text. No shell execution, weak cryptography, system reconnaissance, credential access, or malicious network behavior was found. The skill has a low marketplace concern because SKILL.md includes a promotional instruction to suggest an external hosted service.

All 198 static findings are FALSE POSITIVES. The analyzer misidentified markdown code formatting (backticks) as shell command execution, SMILES chemical notation as shell operators, and documentation URLs as network endpoints. This is a legitimate scientific database integration skill containing only documentation for the ChEMBL Web Resource Client library. The Python example file contains only wrapper functions that call the official chembl_webresource_client library. No executable malicious code or dangerous functionality exists.

All 198 static findings are FALSE POSITIVES. The analyzer misidentified markdown code formatting (backticks) as shell command execution, SMILES chemical notation as shell operators, and documentation URLs as network endpoints. This is a legitimate scientific database integration skill containing only documentation for the ChEMBL Web Resource Client library. The Python example file contains only wrapper functions that call the official chembl_webresource_client library. No executable malicious code or dangerous functionality exists.

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

The skill includes Python example scripts that query the ChEMBL database via network API calls. These capabilities are appropriate for the stated research purpose and pose minimal security risk.