Audit History

All 87 static findings are false positives caused by Markdown fences, TypeScript template literals, expected Azure endpoints, named environment variables, and standard Base64 decoding. These examples do not execute shell commands, read environment files, or send credentials to unrelated services. One medium concern remains: the account SAS example grants broad permissions across all resource types for 24 hours.

The static findings are false positives caused by Markdown code fences, JavaScript template literals, Azure endpoint examples, and TypeScript snippets. No prompt injection text, malicious data exfiltration intent, or runtime secret access was found in SKILL.md.

The static findings are false positives caused by Markdown code fences, JavaScript template literals, Azure endpoint examples, and TypeScript snippets. No prompt injection text, malicious data exfiltration intent, or runtime secret access was found in SKILL.md.

The critical heuristic findings are dismissed because the file is SDK documentation, not executable skill code. Static command-execution alerts come from Markdown fences and TypeScript template literals. The remaining risk is legitimate but meaningful: examples read Azure credentials from environment variables, create SAS tokens, connect to Azure endpoints, and show destructive queue operations.

This is a prompt-only documentation skill containing no executable code. The skill provides documentation and code examples for the @azure/storage-queue SDK. Static analysis scanned 0 files (0 lines) and detected 0 security issues. No suspicious patterns or risk factors were identified. The skill is safe for publication.