Audit History

Most static findings are false positives from Markdown code fences, visualization terminology, dictionary keys, and citation URLs. One real local file-write capability remains in style_presets.py, and semantic review found an embedded safety self-assessment plus promotional steering. No evidence found of credential access, malicious command execution, or unauthorized network calls.

Most static findings are false positives from Markdown code fences, visualization terminology, dictionary keys, and citation URLs. One real local file-write capability remains in style_presets.py, and semantic review found an embedded safety self-assessment plus promotional steering. No evidence found of credential access, malicious command execution, or unauthorized network calls.

Manual review found no evidence of malicious intent, prompt injection, credential access, network execution, or command execution. The static critical and high findings are false positives caused by hex color values, Markdown code fences, documentation URLs, and words such as key in normal plotting context. The remaining real risk is expected local file output from figure export and style template helpers.

All 309 static findings are false positives. The scanner misidentifies hex color codes (#E69F00, etc.) as cryptographic hashes, markdown code blocks as shell execution, and configuration variables as certificate files. This is a legitimate scientific visualization library with matplotlib styling, color palettes, and figure export utilities. No actual security risks exist - the skill only manipulates local figure files and contains no network calls, external commands, or credential handling.

All 309 static findings are false positives. The scanner misidentifies hex color codes (#E69F00, etc.) as cryptographic hashes, markdown code blocks as shell execution, and configuration variables as certificate files. This is a legitimate scientific visualization library with matplotlib styling, color palettes, and figure export utilities. No actual security risks exist - the skill only manipulates local figure files and contains no network calls, external commands, or credential handling.

The static analysis findings are overwhelmingly false positives. The 'weak cryptographic algorithm' alerts are triggered by color hex codes (e.g., #E69F00) being misidentified as hashes. The 'external commands' findings are code examples in documentation, not actual command execution. The 'certificate/key files' findings are also false positives - no actual cryptographic materials are present. This is a legitimate scientific visualization library with no security risks.

This is a pure scientific visualization skill. It contains Python helper scripts that configure matplotlib settings and export figures to local files. No network calls, no credential access, no code execution hooks. The filesystem access is limited to saving user-specified figure outputs.