Audit History

Most static findings are false positives caused by Markdown code fences, inline API names, local cache examples, and documentation links. No prompt injection attempt, data exfiltration intent, or automatic command execution was found. The only semantic concern is unsafe pickle cache loading guidance without a trust warning.

Most static findings are false positives caused by Markdown code fences, inline API names, local cache examples, and documentation links. No prompt injection attempt, data exfiltration intent, or automatic command execution was found. The only semantic concern is unsafe pickle cache loading guidance without a trust warning.

Static analysis reported many high-risk patterns, but review found they are mostly false positives from markdown code formatting and chemistry terminology. No prompt injection, credential exfiltration, or malicious execution path was found; the main publishable warning is example code that loads pickle cache files.

The molfeat skill is a legitimate cheminformatics library for molecular feature extraction. All 397 static findings are false positives triggered by scientific terminology in documentation. The scanner misinterpreted markdown code fences as shell commands, chemistry terminology (ecfp, maccs, gin, c2) as security threats, and documentation URLs as network indicators.

The molfeat skill is a legitimate cheminformatics library for molecular feature extraction. All 397 static findings are false positives triggered by scientific terminology in documentation. The scanner misinterpreted markdown code fences as shell commands, chemistry terminology (ecfp, maccs, gin, c2) as security threats, and documentation URLs as network indicators.

The molfeat skill is a legitimate cheminformatics library for molecular feature extraction. All static analysis findings are false positives - the flagged patterns are documentation examples showing legitimate scientific computing commands, not security threats.

Pure documentation skill with no executable code. Contains only markdown documentation and JSON configuration files describing the molfeat Python library. No network calls, file system access beyond its own directory, environment variable access, or command execution capabilities detected.