Audit History

All 39 static alerts are false positives caused by Markdown fences, TypeScript template literals, a normal namespace environment variable, and security guidance. No executable Ruby backticks, sensitive file access, system reconnaissance, prompt injection, or malicious intent were found.

No executable shell logic or prompt injection was found in the skill source. The static findings are Markdown fences, TypeScript examples, documented Azure SDK setup, or a non-secret namespace environment variable.

The static findings are false positives caused by Markdown fences, TypeScript template literals, inline code names, and one environment variable example. No prompt injection, credential exfiltration, destructive command execution, or malicious intent was found in SKILL.md.

Static analysis reported many command execution, weak cryptography, environment access, and reconnaissance patterns. Manual review found the command and weak-crypto detections are false positives from markdown fences, prose, and SDK examples; the only real risk factor is a normal process.env namespace lookup in sample TypeScript.

All 46 static findings are false positives. The skill is legitimate Azure Service Bus documentation containing code examples in markdown. The backtick patterns are from markdown code fences, not shell execution. Environment variable access is for Azure configuration (standard practice). No cryptographic algorithms or malicious patterns present.