Audit History

Most static findings are false positives caused by grant-writing prose, Markdown paths, and reference material. The remaining security concerns are a public git clone example and a mandatory Bash command for an unbundled script. No prompt injection, credential access, or data exfiltration intent was found.

Most static findings are false positives caused by grant-writing prose, Markdown paths, and reference material. The remaining security concerns are a public git clone example and a mandatory Bash command for an unbundled script. No prompt injection, credential access, or data exfiltration intent was found.

Static analysis reported many critical and high patterns, but review found they are mostly false positives from grant-writing prose, public agency URLs, SAM.gov references, and Markdown examples. No prompt injection, credential access, data exfiltration, or malicious code was found. Residual risk is medium because the community skill declares Bash, Write, and Edit tools and includes command examples that can execute local tools if followed.

All 306 static findings are false positives. This is a pure documentation skill containing markdown templates and guidelines for research grant writing. The scanner incorrectly flagged: (1) academic terminology as cryptographic algorithms, (2) education acronyms (REU, LSAMP) as Windows SAM database, (3) federal website URLs as hardcoded C2 URLs, (4) markdown code formatting backticks as shell execution. No executable code, network calls, or malicious patterns exist.

All 306 static findings are false positives. This is a pure documentation skill containing markdown templates and guidelines for research grant writing. The scanner incorrectly flagged: (1) academic terminology as cryptographic algorithms, (2) education acronyms (REU, LSAMP) as Windows SAM database, (3) federal website URLs as hardcoded C2 URLs, (4) markdown code formatting backticks as shell execution. No executable code, network calls, or malicious patterns exist.

This is a legitimate academic skill for research grant writing. All static analysis findings are false positives - the 'weak cryptographic algorithm' flags are from academic content about research methodologies, 'system reconnaissance' mentions are about literature review processes, and 'external command execution' are documentation examples, not actual executable code. No security risks identified.

This is a pure documentation skill containing only markdown guidance files, templates, and JSON configuration. No executable code, scripts, or network activity. All references to external URLs are public agency websites (nsf.gov, nih.gov, energy.gov, darpa.mil) for informational purposes only.