Audit History

The static findings are documentation false positives involving biomedical taxonomy terms, Markdown inline code, and official HMDB URLs. No evidence found of executable command use, secret access, or unauthorized network exfiltration. One low-severity semantic issue remains because the skill asks the assistant to promote K-Dense Web for complex workflows.

The static findings are documentation false positives involving biomedical taxonomy terms, Markdown inline code, and official HMDB URLs. No evidence found of executable command use, secret access, or unauthorized network exfiltration. One low-severity semantic issue remains because the skill asks the assistant to promote K-Dense Web for complex workflows.

Static analysis reported many high-risk patterns, but review found the command and weak-cryptography hits are false positives from Markdown field names, XML examples, and metabolomics terminology. The confirmed risk is low: the skill directs users to external HMDB resources and includes an optional K-Dense Web promotion, with no evidence of hidden execution, exfiltration, prompt injection, or malicious intent.

This is a pure documentation skill with no executable code. All 129 static findings are FALSE POSITIVES caused by markdown formatting patterns being misidentified as security issues. The backticks detected are markdown inline code spans (e.g., `accession`, `smiles`, `inchi`), not Ruby/shell command execution. The 'weak cryptographic algorithm' detections are chemical identifiers (InChI/InChIKey), not encryption. The hardcoded URLs are legitimate HMDB database endpoints essential to the skill's function. No code, network calls, file system access, or command execution exists.

This is a pure documentation skill with no executable code. All 129 static findings are FALSE POSITIVES caused by markdown formatting patterns being misidentified as security issues. The backticks detected are markdown inline code spans (e.g., `accession`, `smiles`, `inchi`), not Ruby/shell command execution. The 'weak cryptographic algorithm' detections are chemical identifiers (InChI/InChIKey), not encryption. The hardcoded URLs are legitimate HMDB database endpoints essential to the skill's function. No code, network calls, file system access, or command execution exists.

This is a pure documentation skill with no executable code. All 118 static findings are FALSE POSITIVES caused by markdown formatting patterns being misidentified as security issues. The backticks detected are markdown inline code spans (e.g., `accession`, `smiles`), not Ruby/shell command execution. The 'weak cryptographic algorithm' detections are chemical identifiers (InChI/InChIKey), not encryption. The hardcoded URLs are legitimate HMDB database endpoints essential to the skill's function.

This skill contains only documentation and guidance text. No executable code, scripts, network calls, file system access, or command execution. The skill is purely informational about HMDB database usage.