All static findings were reviewed against SKILL.md and adjudicated as false positives. The matches are Markdown fences, normal Solidity imports, Hardhat and Foundry examples, placeholder RPC usage, and environment variable references without exfiltration or prompt injection evidence.
All static findings were reviewed against SKILL.md and adjudicated as false positives. The matches are Markdown fences, normal Solidity imports, Hardhat and Foundry examples, placeholder RPC usage, and environment variable references without exfiltration or prompt injection evidence.
Static analysis found many command, network, and secret patterns, but the reviewed file is a documentation skill made of Hardhat and Foundry examples. No prompt injection, malware, credential exfiltration, or destructive intent was found; the remaining risk is that users may run CLI commands or configure private keys and RPC/API secrets from the examples.
1
Files scanned
400
Lines analyzed
6
Review items
2
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Environment-Based Private Key and API Key Configuration
The Hardhat examples read MAINNET_RPC_URL, PRIVATE_KEY, COINMARKETCAP_API_KEY, ETHERSCAN_API_KEY, and fork RPC values from environment variables. This is normal for blockchain tooling, but users must avoid exposing private keys in shared projects, logs, or CI settings.
The environment variable references are explicit and include private key and API key names. The context is legitimate test configuration, so the issue is handling risk rather than confirmed exfiltration.
The skill includes examples that run Hardhat coverage, Hardhat verification, npm install, compile, test, and coverage commands. These are expected for this skill, but users should run them only in trusted repositories after reviewing dependencies and configuration.
The commands are plainly visible in documentation examples and match the skill purpose. They are not executed by the skill itself, so the risk depends on user execution context.
Mainnet Forking and Account Impersonation Examples
The examples show mainnet fork RPC use, hardhat_reset, hardhat_impersonateAccount, and live contract interactions. These are standard test techniques, but they create network dependence and can be misunderstood as permission to use production secrets or signers.
The network and impersonation calls are concrete, but they are presented as local fork testing patterns. No evidence shows unauthorized access or real transaction signing.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Relative Import Flagged as Path Traversal False Positive
The scanner flagged ../src/Token.sol, but this is a normal Solidity relative import in a Foundry test example. No file read, write, upload, or user-controlled path handling is present.
The line is a static import statement inside an example test contract. There is no dynamic filesystem operation or traversal sink.
Blocker Keyword and Weak Crypto Flags Are Contextual False Positives
The scanner reported C2 keywords and weak cryptographic algorithm markers on smart contract testing lines. Review found testing terminology, contract addresses, DAI references, and describe blocks, but no command-and-control behavior or weak cryptography implementation.
The cited lines are ordinary Solidity and JavaScript test examples. I found no semantic evidence of C2 infrastructure, encryption downgrade, or cryptographic misuse.
Static analysis found many command, network, and secret patterns, but the reviewed file is a documentation skill made of Hardhat and Foundry examples. No prompt injection, malware, credential exfiltration, or destructive intent was found; the remaining risk is that users may run CLI commands or configure private keys and RPC/API secrets from the examples.
1
Files scanned
400
Lines analyzed
6
Review items
2
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Environment-Based Private Key and API Key Configuration
The Hardhat examples read MAINNET_RPC_URL, PRIVATE_KEY, COINMARKETCAP_API_KEY, ETHERSCAN_API_KEY, and fork RPC values from environment variables. This is normal for blockchain tooling, but users must avoid exposing private keys in shared projects, logs, or CI settings.
The environment variable references are explicit and include private key and API key names. The context is legitimate test configuration, so the issue is handling risk rather than confirmed exfiltration.
The skill includes examples that run Hardhat coverage, Hardhat verification, npm install, compile, test, and coverage commands. These are expected for this skill, but users should run them only in trusted repositories after reviewing dependencies and configuration.
The commands are plainly visible in documentation examples and match the skill purpose. They are not executed by the skill itself, so the risk depends on user execution context.
Mainnet Forking and Account Impersonation Examples
The examples show mainnet fork RPC use, hardhat_reset, hardhat_impersonateAccount, and live contract interactions. These are standard test techniques, but they create network dependence and can be misunderstood as permission to use production secrets or signers.
The network and impersonation calls are concrete, but they are presented as local fork testing patterns. No evidence shows unauthorized access or real transaction signing.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Relative Import Flagged as Path Traversal False Positive
The scanner flagged ../src/Token.sol, but this is a normal Solidity relative import in a Foundry test example. No file read, write, upload, or user-controlled path handling is present.
The line is a static import statement inside an example test contract. There is no dynamic filesystem operation or traversal sink.
Blocker Keyword and Weak Crypto Flags Are Contextual False Positives
The scanner reported C2 keywords and weak cryptographic algorithm markers on smart contract testing lines. Review found testing terminology, contract addresses, DAI references, and describe blocks, but no command-and-control behavior or weak cryptography implementation.
The cited lines are ordinary Solidity and JavaScript test examples. I found no semantic evidence of C2 infrastructure, encryption downgrade, or cryptographic misuse.
Documentation-only skill containing code examples and best practices for smart contract testing. Static findings are false positives triggered by blockchain testing terminology (prank, fork, deal), environment variable references demonstrating secure secret handling patterns, and markdown code block syntax. The skill teaches recommended security practices and has no executable code, network calls, or file access capabilities.
Documentation-only skill containing code examples and best practices for smart contract testing. Static findings are false positives triggered by blockchain testing terminology (prank, fork, deal), environment variable references demonstrating secure secret handling patterns, and markdown code block syntax. The skill teaches recommended security practices and has no executable code, network calls, or file access capabilities.
This is a prompt-based documentation skill containing only guidance, examples, and best practices for smart contract testing. The skill has no executable code and does not access files, networks, or execute commands. References to environment variables in example configurations are standard patterns for user projects.
This is a prompt-based documentation skill containing only guidance, examples, and best practices for smart contract testing. The skill has no executable code and does not access files, networks, or execute commands. References to environment variables in example configurations are standard patterns for user projects.