Static analysis flagged Markdown backticks, TypeScript template literals, sample relative HTTP calls, and repeated use of the word hybrid. Review found these are documentation examples for Angular migration, not executable shell code, live network behavior, reconnaissance, or prompt injection.
Static analysis flagged Markdown backticks, TypeScript template literals, sample relative HTTP calls, and repeated use of the word hybrid. Review found these are documentation examples for Angular migration, not executable shell code, live network behavior, reconnaissance, or prompt injection.
Static analysis reported many high-risk patterns, but review found they are Markdown examples for Angular migration rather than executable skill behavior. The HTTP examples use relative application API paths, and no prompt injection, exfiltration, malicious command execution, or hidden business logic was found in the reviewed file.
1
Files scanned
411
Lines analyzed
2
Review items
4
False positives ignored
Static false positives ignored (4)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
False Positive: Markdown Backticks Flagged as Shell Execution
Verdict: FALSE_POSITIVE. The flagged locations are fenced Markdown code blocks and Angular template literals that document migration examples. They are not Ruby or shell backtick execution and are not executed by the skill.
The locations appear inside documentation examples in SKILL.md, including TypeScript, JavaScript, HTML, and plain text fences. No runnable script wrapper or instruction executes these snippets automatically.
False Positive: Relative HTTP Examples Flagged as Network Access
Verdict: FALSE_POSITIVE. The HTTP calls are AngularJS and Angular service examples using relative paths such as application API routes. They do not contact third-party endpoints or transmit secrets from the skill environment.
Both network indicators are sample application code in documentation, not active skill code. The paths are relative API examples, with no external host, token handling, or exfiltration pattern.
Verdict: FALSE_POSITIVE. The flagged description line explains Angular migration scope and contains no cryptographic operation, algorithm choice, key material, or hash usage.
The line is frontmatter text about framework migration. I found no evidence of weak cryptographic algorithms in the reviewed file.
Verdict: FALSE_POSITIVE. The flagged lines describe migration approaches, setup phases, and resource names. They do not collect host data, enumerate files, inspect processes, or run reconnaissance commands.
The lines are documentation headings, migration steps, and resource references. No evidence found of system discovery commands or environment inspection logic.
Static analysis reported many high-risk patterns, but review found they are Markdown examples for Angular migration rather than executable skill behavior. The HTTP examples use relative application API paths, and no prompt injection, exfiltration, malicious command execution, or hidden business logic was found in the reviewed file.
1
Files scanned
411
Lines analyzed
2
Review items
4
False positives ignored
Static false positives ignored (4)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
False Positive: Markdown Backticks Flagged as Shell Execution
Verdict: FALSE_POSITIVE. The flagged locations are fenced Markdown code blocks and Angular template literals that document migration examples. They are not Ruby or shell backtick execution and are not executed by the skill.
The locations appear inside documentation examples in SKILL.md, including TypeScript, JavaScript, HTML, and plain text fences. No runnable script wrapper or instruction executes these snippets automatically.
False Positive: Relative HTTP Examples Flagged as Network Access
Verdict: FALSE_POSITIVE. The HTTP calls are AngularJS and Angular service examples using relative paths such as application API routes. They do not contact third-party endpoints or transmit secrets from the skill environment.
Both network indicators are sample application code in documentation, not active skill code. The paths are relative API examples, with no external host, token handling, or exfiltration pattern.
Verdict: FALSE_POSITIVE. The flagged description line explains Angular migration scope and contains no cryptographic operation, algorithm choice, key material, or hash usage.
The line is frontmatter text about framework migration. I found no evidence of weak cryptographic algorithms in the reviewed file.
Verdict: FALSE_POSITIVE. The flagged lines describe migration approaches, setup phases, and resource names. They do not collect host data, enumerate files, inspect processes, or run reconnaissance commands.
The lines are documentation headings, migration steps, and resource references. No evidence found of system discovery commands or environment inspection logic.
Pure documentation skill containing only markdown files with educational code examples. No executable code, no network operations, no file system access. All static findings are false positives: markdown code block delimiters (```) misinterpreted as shell backticks, and JSON text fields with keywords triggering false pattern matches.
2
Files scanned
587
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Pure documentation skill containing only markdown files with educational code examples. No executable code, no network operations, no file system access. All static findings are false positives: markdown code block delimiters (```) misinterpreted as shell backticks, and JSON text fields with keywords triggering false pattern matches.
2
Files scanned
587
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Pure documentation skill with no code execution, file system access, or network operations. Contains only markdown documentation and configuration files with TypeScript/JavaScript code examples for educational purposes.
4
Files scanned
627
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Pure documentation skill with no code execution, file system access, or network operations. Contains only markdown documentation and configuration files with TypeScript/JavaScript code examples for educational purposes.
4
Files scanned
627
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.