Audit History

Most static external-command and network hits are false positives caused by Markdown fences, inline formatting, examples, and GitHub reference links. Real risks remain in the skill intent: it targets hidden .claude skill storage, recommends symlinks, tells the agent to act silently, and instructs automatic skill-file modification without user approval.

Most static external-command and network hits are false positives caused by Markdown fences, inline formatting, examples, and GitHub reference links. Real risks remain in the skill intent: it targets hidden .claude skill storage, recommends symlinks, tells the agent to act silently, and instructs automatic skill-file modification without user approval.

Static analysis flagged many external command, filesystem, network, and weak-crypto patterns in SKILL.md. Most command and weak-crypto hits are false positives from Markdown fences, Makepad names, examples, and documentation, with no executable scripts or confirmed malicious exfiltration. The remaining concern is behavioral: the skill instructs agents to silently read project files and automatically edit skill files, so publication should include a clear warning.

All 170 static findings are FALSE POSITIVES. SKILL.md is a pure documentation file containing markdown instructions with code examples. The static analyzer detected patterns in documentation (git commands in code blocks, file paths with dots, GitHub URLs) but these are not executable code. This is purely documentation content for a skill system. No network calls, no file operations, no command execution capabilities exist in this skill.

All 170 static findings are FALSE POSITIVES. SKILL.md is a pure documentation file containing markdown instructions with code examples. The static analyzer detected patterns in documentation (git commands in code blocks, file paths with dots, GitHub URLs) but these are not executable code. This is purely documentation content for a skill system. No network calls, no file operations, no command execution capabilities exist in this skill.

All 165 static findings are FALSE POSITIVES. SKILL.md is a documentation file containing markdown instructions with code examples. The static analyzer detected patterns in documentation (git commands in code blocks, file paths with dots, GitHub URLs) but these are not executable code. This is purely documentation content for a skill system.

All 165 static findings are FALSE POSITIVES. SKILL.md is a documentation file containing markdown instructions with code examples. The static analyzer detected patterns in documentation (git commands in code blocks, file paths with dots, GitHub URLs) but these are not executable code. This is purely documentation content for a skill system.

All 165 static findings are FALSE POSITIVES. SKILL.md is a documentation file containing markdown instructions with code examples. The static analyzer detected patterns in documentation (git commands in code blocks, file paths with dots, GitHub URLs) but these are not executable code. This is purely documentation content for a skill system.