Most static findings are false positives caused by Markdown backticks, conservative policy prose, or fixed shell wrapper operations. The bootstrapper performs real package installation, and SKILL.md references an instruction file outside the reviewed package boundary.
8
Files scanned
539
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
This call executes environment creation and package installation commands unless dry-run is selected. Installing dependencies or an editable target repository can execute untrusted package or build code.
`../../references/agent-operating-principles.md`; this skill should keep setup
The skill explicitly directs the agent through a parent-relative path to instructions outside the reviewed package. That crosses the package trust boundary and can import unreviewed directives.
Most static findings are markdown formatting or conservative policy text and are false positives. The Python bootstrapper does execute package manager commands, so users should treat non-dry-run installs on untrusted repositories as risky.
8
Files scanned
533
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The bootstrapper executes conda, mamba, venv, or pip commands against a target repository. Arguments are list-based, but package installation can run project build hooks.
Most static findings are markdown formatting or conservative policy text and are false positives. The Python bootstrapper does execute package manager commands, so users should treat non-dry-run installs on untrusted repositories as risky.
8
Files scanned
533
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The bootstrapper executes conda, mamba, venv, or pip commands against a target repository. Arguments are list-based, but package installation can run project build hooks.
Most static detections are false positives caused by markdown backticks, shell wrapper path discovery, and policy prose. The confirmed issue is scripts/bootstrap_env.py executing conda, mamba, virtualenv, and pip commands against a target repository. This behavior is expected for setup, but it is risky for untrusted repositories because package installation can run code.
8
Files scanned
533
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
subprocess.run executes package-manager, virtualenv, and pip commands built by the bootstrapper. This can modify the local environment and may execute install-time code from an untrusted target repository.
Most static detections are false positives caused by markdown backticks, shell wrapper path discovery, and policy prose. The confirmed issue is scripts/bootstrap_env.py executing conda, mamba, virtualenv, and pip commands against a target repository. This behavior is expected for setup, but it is risky for untrusted repositories because package installation can run code.
8
Files scanned
533
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
subprocess.run executes package-manager, virtualenv, and pip commands built by the bootstrapper. This can modify the local environment and may execute install-time code from an untrusted target repository.
Static analysis raised weak-crypto, reconnaissance, shell, and subprocess patterns. The weak-crypto and reconnaissance hits are false positives, but the bootstrap scripts intentionally run conda, mamba, pip, and venv commands and write asset manifests, so publication should include a clear execution warning.
8
Files scanned
533
Lines analyzed
4
Review items
4
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
TRUE POSITIVE for external command execution. The Python bootstrapper calls subprocess.run and constructs conda, mamba, pip, and venv commands for a user-selected repository. This is legitimate for the skill purpose, but it can execute dependency installation behavior from the target repository, including setup.py or pyproject installation hooks.
Direct subprocess execution is present and the commands can install dependencies from a target repository. The implementation uses argument lists and constrained manager choices, so this is an operational risk rather than confirmed malicious behavior.
TRUE POSITIVE for filesystem effects. The asset preparation script creates asset directories and writes a JSON manifest to a path controlled by command-line arguments. This is expected setup behavior, but users should review output paths before running it.
The script explicitly creates directories and writes a manifest file. No destructive file operations or hidden paths were found, which limits severity.
Static false positives ignored (4)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
FALSE POSITIVE. The reported weak-cryptography locations are descriptive metadata, argparse descriptions, or command construction lines. I found no hash algorithm, encryption code, password storage, or cryptographic verification logic at these locations.
The cited lines do not contain cryptographic APIs or weak hash names. The static matches appear to come from ordinary text and setup wording.
FALSE POSITIVE. The reported reconnaissance lines describe asset source tracking or environment guidance. They do not collect host inventory, enumerate secrets, inspect network interfaces, or transmit system data.
The lines are policy text about setup behavior, not active host inspection. No evidence of data exfiltration or sensitive inventory collection was found.
FALSE POSITIVE. The markdown and Python lines flagged as Ruby or shell backtick execution use markdown code spans or Python f-strings for readable setup notes. They do not execute shell backticks.
The cited content is markdown formatting or Python string output. There is no Ruby code and no shell command substitution at those locations.
FALSE POSITIVE for device-file and shell-substitution concerns. The shell wrapper resolves its own directory, selects a Python executable, and execs the Python bootstrapper. It does not read standard device files or perform hidden system probing.
The wrapper uses common POSIX startup patterns and forwards user arguments to a local script. The external execution is real, but the device-file finding itself is not supported by the cited line.
Static analyzer flagged 21 patterns but most are false positives. External command execution via subprocess.run is legitimate package management (conda, pip, venv) with hardcoded arguments. Shell constructs are standard POSIX patterns for environment detection. No malicious intent, credential exfiltration, or prompt injection detected.
8
Files scanned
533
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.