Audit History

All 22 static findings are false positives caused by JavaScript template literals, Markdown code references, and ordinary Next.js examples. However, the playbook demonstrates database mutations without explicit schema validation or authorization, creating a high-risk pattern when copied into production.

The static command, network, environment, sensitive-file, and reconnaissance alerts are false positives in Markdown and TypeScript documentation samples. No prompt injection or malware intent was found. Semantic review found that mutation examples should add validation and authorization guidance before publication.

The static command, network, environment, sensitive-file, and reconnaissance alerts are false positives in Markdown and TypeScript documentation samples. No prompt injection or malware intent was found. Semantic review found that mutation examples should add validation and authorization guidance before publication.

Static analysis reported command execution, weak cryptography, reconnaissance, network, and environment access patterns. Review found the command, weak-crypto, and reconnaissance alerts are false positives caused by Markdown code fences, file names, comments, and normal Next.js examples. The skill is safe to publish with low risk because it contains documentation only, but some copyable examples need validation and authorization hardening.

This skill contains documentation-only markdown files with Next.js educational code examples. All 56 static findings are false positives because the scanner incorrectly flagged markdown code blocks as executable code. No actual security risks detected.