All 53 static alerts are false positives caused by Markdown formatting, official links, relative documentation links, and illustrative SDK authentication examples. The skill contains guidance only and shows no executable automation, credential exfiltration, reconnaissance, or prompt injection.
Reviewed all 53 static findings against the Markdown context. The flagged commands, environment variables, relative paths, URLs, and reconnaissance terms are documentation examples or links, not executable skill behavior. No prompt injection, credential exfiltration, or malicious intent was found.
The static findings are false positives caused by Markdown documentation, Azure SDK quick-start examples, and Microsoft Learn links. Environment variable examples show normal user credential configuration and are not executed by the skill. No prompt injection, malicious command execution, or data exfiltration intent was found.
Static analysis reported 195 potential issues, including a critical combined-risk heuristic. Manual review found documentation-only Markdown, SDK examples, and official Microsoft Learn links with no executable scripts, exfiltration behavior, or prompt injection.
15
Files scanned
519
Lines analyzed
3
Review items
5
False positives ignored
Static false positives ignored (5)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
False Positive: Credential Environment Variables in SDK Examples
The environment variable references show standard Azure SDK authentication examples. They do not read local secrets for hidden processing or network exfiltration.
The variables are named service endpoint and key values used directly in documented client constructors. No outbound collector or unrelated network destination appears.
The critical heuristic combines separate documentation signals. Review found no malicious intent, prompt injection, credential theft, or hidden execution path.
The combined signals are legitimate documentation examples and official links. No semantic evidence supports the scanner heuristic as a real threat.
All 195 static findings are false positives. The skill contains documentation with code examples for Azure AI SDK usage. Detected patterns (external_commands, env_access, network) are Markdown formatting artifacts and standard SDK documentation patterns, not security vulnerabilities.
15
Files scanned
519
Lines analyzed
0
Review items
4
False positives ignored
Static false positives ignored (4)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
False Positive: Shell Command Detection in Documentation
164 instances of 'external_commands' flagged backticks in Markdown code blocks. These are documentation examples (pip install, npm install), not executable code.
Backticks are Markdown formatting for code blocks showing SDK installation commands. No actual shell execution occurs in this documentation skill.
False Positive: Environment Variable Access in Documentation
8 instances flagged environment variable access (process.env.TRANSLATOR_SUBSCRIPTION_KEY). These are standard Azure SDK credential patterns shown in documentation.
Standard Azure SDK documentation showing authentication pattern. No credential exfiltration or actual execution.