Most static findings are false positives from Markdown code fences, documentation links, local service defaults, and normal database client methods. The review found one real issue: the pgvector metadata filter builds part of a SQL query from unvalidated keys. No prompt injection attempt or malicious marketplace intent was found.
The pgvector template appends metadata filter keys directly into a SQL predicate before executing the query. If untrusted keys reach this function, callers could trigger SQL injection or malformed queries even though values use parameters.
The code iterates over filter_metadata keys and inserts each key into an f-string SQL fragment. The values are parameterized, but the key itself is not validated or allowlisted.
Most static findings are false positives from Markdown code fences, documentation links, local service defaults, and normal database client methods. The review found one real issue: the pgvector metadata filter builds part of a SQL query from unvalidated keys. No prompt injection attempt or malicious marketplace intent was found.
The pgvector template appends metadata filter keys directly into a SQL predicate before executing the query. If untrusted keys reach this function, callers could trigger SQL injection or malformed queries even though values use parameters.
The code iterates over filter_metadata keys and inserts each key into an f-string SQL fragment. The values are parameterized, but the key itself is not validated or allowlisted.
Static analysis reported command execution, network, credential, weak crypto, reconnaissance, and combined-danger patterns. Most are false positives from Markdown code fences, database client examples, API-key parameters, and documentation links; however, the pgvector template interpolates metadata keys into SQL and should be published with a security warning.
TRUE POSITIVE semantic issue. The pgvector search example parameterizes filter values but interpolates metadata keys directly into a SQL condition. If copied into an application that accepts user-controlled filter keys, this can permit SQL injection or query manipulation. No malicious intent or exfiltration behavior was found.
The SQL value is parameterized, but the metadata key is inserted with string formatting before query execution. This is a clear copy-paste vulnerability when filter keys can come from untrusted input.
Static false positives ignored (5)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
External Command Findings Are Markdown Fence False Positives
FALSE POSITIVE. The reported Ruby or shell backtick execution locations are Markdown code fence delimiters around documentation examples, not executable code paths. No shell execution API or command invocation was found in the inspected skill file.
The suspicious tokens are the opening and closing triple-backtick fences in Markdown. The surrounding content is explanatory Python sample code, not a runnable installer or script.
Network Findings Are Client Examples and Documentation Links
FALSE POSITIVE for malicious networking. The conn.fetch calls are PostgreSQL database reads, the Weaviate URL defaults to localhost, and the hardcoded URLs are public documentation links. These examples may contact configured vector services if used by a developer, but they do not exfiltrate data from the skill itself.
The network-related lines are either database client method calls or reference links. No credential-bearing request to an unexpected external endpoint was found.
FALSE POSITIVE for secret harvesting. The Pinecone example accepts an api_key parameter and passes it to the official client constructor. The skill does not read environment variables, enumerate secrets, log keys, or send keys to an unrelated endpoint.
The key is a constructor argument in sample code and is only passed to Pinecone(api_key=api_key). There is no process environment access or unauthorized transmission pattern.
Weak Crypto and Reconnaissance Findings Are Scanner Noise
FALSE POSITIVE. The weak-crypto and system-reconnaissance detections do not correspond to cryptographic operations, host enumeration, or sensitive system discovery in the inspected context. The relevant lines are metadata, SQL setup, joins, or general best-practice text.
Manual review found no md5, sha1, host probing, environment discovery, or similar sensitive behavior at these locations. The static labels appear triggered by unrelated words and SQL syntax.
FALSE POSITIVE for malicious intent. The static tool combined code-fence, network, and API-key parameter detections into a critical heuristic, but manual review found a documentation-only skill with no executable installer, no prompt injection attempt, and no data exfiltration flow.
The file contains only Markdown guidance and examples. The heuristic ingredients are explainable as documentation constructs, though the SQL filter issue remains a real medium-risk example vulnerability.
This skill contains only documentation and code templates for implementing vector search. No executable code, file access, or network operations are performed by the skill itself. The static analyzer detected patterns in documentation examples and mathematical formulas that triggered false positive security alerts. All detected 'network', 'external_commands', and 'env_access' patterns are documentation artifacts, not actual malicious code.
This skill contains only documentation and code templates for implementing vector search. No executable code, file access, or network operations are performed by the skill itself. The static analyzer detected patterns in documentation examples and mathematical formulas that triggered false positive security alerts. All detected 'network', 'external_commands', and 'env_access' patterns are documentation artifacts, not actual malicious code.
This skill contains only documentation and code templates for implementing vector search. No executable code, file access, or network operations are performed by the skill itself. The network references in templates are example configurations for users to adapt.
4
Files scanned
777
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
This skill contains only documentation and code templates for implementing vector search. No executable code, file access, or network operations are performed by the skill itself. The network references in templates are example configurations for users to adapt.
4
Files scanned
777
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.