Six external-command findings are false positives caused by Markdown inline-code and fenced-code syntax; the document contains no shell backtick execution. The GitHub clone instruction is a confirmed low-severity supply-chain risk because it fetches mutable, unverified external content. No prompt injection or data-exfiltration intent was found.
1
Files scanned
48
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The prerequisite clones a mutable external GitHub repository without pinning a commit or verifying integrity. Later documented commands depend on downloaded code, creating low supply-chain exposure.
Most external command alerts are false positives caused by Markdown inline code or fenced command examples, not executable Ruby backticks. The hardcoded GitHub clone URL is a real low-severity network and supply-chain dependency, and the install flow should be reviewed before use.
The install instructions clone a separate GitHub repository and later direct users to run its local Python commands. This creates a supply-chain trust boundary outside the reviewed skill file.
The file explicitly clones an external GitHub repository and shows commands that run scripts from the cloned agent manager. This is likely legitimate, but it requires trust in code outside the submitted skill file.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill tells users to clone code from a hardcoded GitHub repository. This is expected install documentation, but it creates a network and supply-chain dependency that should be reviewed before use.
Most static command findings are Markdown formatting false positives, but two ranges contain actual git and python command examples. The network finding is confirmed because the install step clones an external GitHub repository, and a semantic supply-chain concern exists because that URL points outside the audited skill source. No prompt-injection language or data-exfiltration intent was found in SKILL.md.
Installation Command Points to External Repository
The installation command clones https://github.com/fractalmind-ai/agent-manager-skill.git, while the audited package source is the marketplace skill at sickn33/antigravity-awesome-skills. Users may run code from a repository that was not part of the one-file audit.
The URL is explicit on line 22 and differs from the audited source URL in the report metadata. I did not inspect that external repository, so the risk is supply-chain exposure rather than proven malicious behavior.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Although the snippet is the opening fence, the finding range includes line 22, which asks the user to execute git clone against an external repository. This is real shell command guidance with supply-chain exposure.
Line 22 instructs cloning code from a GitHub URL, which creates a network dependency and pulls remote code. GitHub is not inherently malicious, but the network action is real.
The Ruby shell backtick and weak cryptography alerts are false positives caused by Markdown backticks and the word cron in SKILL.md. The meaningful risk is that the skill instructs users to clone an external GitHub repository and run Python scripts from it, which is legitimate for an agent manager but requires trust in unaudited external code.
1
Files scanned
41
Lines analyzed
4
Review items
2
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
SKILL.md instructs users to clone https://github.com/fractalmind-ai/agent-manager-skill.git and then run python3 agent-manager scripts. This is useful for the stated purpose, but the executable Python code is not included in the audited skill package, so users must trust external code before running agent management commands.
The commands are directly shown in SKILL.md and the workflow clearly depends on running external Python scripts. There is no evidence of malicious intent, but the unaudited execution path is a real supply chain risk.
The hardcoded URL is a public GitHub clone command, not evidence of data exfiltration. It still creates a dependency on an external repository that can change outside this audited package.
The network reference is visible and limited to a GitHub clone URL. The risk is supply chain exposure, not confirmed malicious network behavior.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
The reported Ruby shell backtick execution locations are Markdown inline code and fenced code blocks, not executable Ruby code. The code block contains shell commands, but the backticks themselves do not execute anything in this skill file.
The file content shows Markdown formatting around installation and command examples. No Ruby file or Ruby execution context is present.
The high-severity weak cryptographic algorithm alert points to the description line, which only says the skill is cron-friendly. No cryptographic algorithm or cryptographic API use appears at that location.
Line 3 contains descriptive metadata and no cryptographic operation. The finding appears to be a keyword collision rather than a security issue.
Security audit complete. All 9 static findings are false positives. The skill contains only documentation with markdown code examples - no actual shell execution, no suspicious network activity, and no cryptographic code. The backticks flagged are markdown formatting, and the URL is a legitimate GitHub repo reference.
1
Files scanned
43
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.