Audit History

Static findings are mostly false positives caused by markdown examples, scientific file outputs, legitimate Forge API documentation, and model method names. No prompt injection or malware-like code execution was found, but the skill contains promotional steering toward an external hosted platform.

Static findings are mostly false positives caused by markdown examples, scientific file outputs, legitimate Forge API documentation, and model method names. No prompt injection or malware-like code execution was found, but the skill contains promotional steering toward an external hosted platform.

The static findings are false positives caused by Markdown examples, scientific file outputs, documented Forge URLs, and protein-model terminology. I found no evidence of executable malware, credential exfiltration, or unauthorized host reconnaissance. However, the package includes self-authored safety verdicts and promotional steering that should be removed or clearly separated before marketplace publication.

Static analysis reported critical heuristic risk, but review found no malicious code execution, C2 behavior, credential exfiltration, or prompt-injection attempt. Most high-volume findings are Markdown examples, protein-model terminology, API documentation, or non-security cache hashing. The main publishable warning is unsafe pickle deserialization in cache examples and normal remote Forge API token usage.

All 368 static findings are false positives. The scanner incorrectly flagged markdown documentation patterns. The skill provides documentation for legitimate protein language models from EvolutionaryScale. All code examples are standard scientific workflows for protein engineering. Python f-strings with underscores (protein masks), MD5 for cache keys, and ML terminology were misclassified as security issues.

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

All 319 static findings are FALSE POSITIVES. The scanner misidentified markdown code formatting (backticks) as shell commands, HTTPS URLs as weak crypto, PyTorch's model.eval() as dynamic code execution, and standard file I/O as system reconnaissance. This is legitimate scientific documentation for a protein language model library.

This is a pure documentation skill containing only markdown files with API references and code examples for protein modeling. No executable code, scripts, file system access, or network calls are present in the skill itself. The network references in documentation describe how to use the Forge API, but the skill does not make network requests.