The only static finding is a false positive caused by Markdown inline code around a file path. No prompt injection, data exfiltration intent, or malicious behavior was found in SKILL.md.
The only static finding is a false positive caused by Markdown inline code around a file path. No prompt injection, data exfiltration intent, or malicious behavior was found in SKILL.md.
Static analysis reported weak cryptography and shell execution patterns, but the reviewed file contains only Markdown instructions. The cryptography alerts are prose false positives, and the backtick alert is a Markdown path reference. The skill does direct agents to write a design document and commit it to git, so publication is acceptable with low-risk filesystem and git-operation awareness.
1
Files scanned
55
Lines analyzed
3
Review items
2
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill asks the agent to write a validated design to docs/plans/YYYY-MM-DD-<topic>-design.md and commit the document to git. This is a normal planning workflow, but it can modify the user's repository if followed without confirmation.
The file explicitly instructs document creation and a git commit. The context is benign documentation workflow guidance, with no evidence of hidden commands, obfuscation, network access, or data exfiltration.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static Weak Cryptography Alerts Are Prose False Positives
The reported weak cryptography findings occur in ordinary English planning text, headings, and documentation instructions. No cryptographic API, hashing function, cipher, or password handling code appears in the reviewed file.
The reviewed content is Markdown guidance about brainstorming and design validation. There is no executable code or security-sensitive cryptographic operation at the reported lines.
Static Backtick Execution Alert Is a Markdown False Positive
The reported Ruby or shell backtick execution pattern is a Markdown inline-code path, not executable Ruby, shell, or script content. The file does not define a command runner or pass user input to a shell.
Line 38 uses backticks only to format a destination file path in Markdown. The surrounding file contains no interpreter context where those backticks would execute.
Static analysis reported weak cryptography and shell execution patterns, but the reviewed file contains only Markdown instructions. The cryptography alerts are prose false positives, and the backtick alert is a Markdown path reference. The skill does direct agents to write a design document and commit it to git, so publication is acceptable with low-risk filesystem and git-operation awareness.
1
Files scanned
55
Lines analyzed
3
Review items
2
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill asks the agent to write a validated design to docs/plans/YYYY-MM-DD-<topic>-design.md and commit the document to git. This is a normal planning workflow, but it can modify the user's repository if followed without confirmation.
The file explicitly instructs document creation and a git commit. The context is benign documentation workflow guidance, with no evidence of hidden commands, obfuscation, network access, or data exfiltration.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static Weak Cryptography Alerts Are Prose False Positives
The reported weak cryptography findings occur in ordinary English planning text, headings, and documentation instructions. No cryptographic API, hashing function, cipher, or password handling code appears in the reviewed file.
The reviewed content is Markdown guidance about brainstorming and design validation. There is no executable code or security-sensitive cryptographic operation at the reported lines.
Static Backtick Execution Alert Is a Markdown False Positive
The reported Ruby or shell backtick execution pattern is a Markdown inline-code path, not executable Ruby, shell, or script content. The file does not define a command runner or pass user input to a shell.
Line 38 uses backticks only to format a destination file path in Markdown. The surrounding file contains no interpreter context where those backticks would execute.
Static analysis flagged external commands and cryptographic algorithms, but manual review confirms these are false positives. The skill contains only documentation text - no executable code. Backticks at line 38 are markdown formatting, not shell execution. No cryptographic code exists in the skill.
1
Files scanned
55
Lines analyzed
0
Review items
2
False positives ignored
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static analyzer incorrectly flagged 'weak cryptographic algorithm' at multiple lines. Manual review confirms no cryptographic code exists - the skill contains only prose documentation about design methodology.
The skill file contains no cryptographic code - only documentation text. Static analyzer pattern matching appears to have triggered on keywords in the prose.
Static analyzer flagged 'Ruby/shell backtick execution' at line 38, but the backticks are markdown code formatting in a documentation path reference, not actual shell execution.
The line contains a markdown path reference with backtick formatting - this is documentation, not executable code.
No confirmed security findings were recorded for this completed audit.