審計紀錄

Static analysis reported many high-risk patterns, but manual review found most were false positives from markdown examples, CSS color tokens, Go checksum data, fixed build paths, and SQLModel session.exec calls. The skill is still medium risk because it guides agents to copy files, run package managers and dev servers, read environment configuration, and generate networked backend templates. Publish with a warning to review commands and dependencies before execution.

Legitimate project scaffolding skill with standard development tools. Shell commands and script execution are directly related to project initialization purpose. No credential theft, network exfiltration, or obfuscation patterns detected. Static findings are false positives from pattern matching limitations on documentation and configuration files.

Legitimate project scaffolding skill with standard development tools. Shell commands and script execution are directly related to project initialization purpose. No credential theft, network exfiltration, or obfuscation patterns detected. Static findings are false positives from pattern matching limitations on documentation and configuration files.

Legitimate project scaffolding skill with standard development tools. Shell commands and script execution are directly related to project initialization purpose. No credential theft, network exfiltration, or obfuscation patterns detected. Static findings are false positives from pattern matching limitations on documentation and configuration files.

Legitimate project scaffolding skill with standard development tools. Shell scripts and command execution are directly related to project initialization purpose. No credential theft, network exfiltration, or obfuscation patterns detected.

Legitimate project scaffolding skill with standard development tools. Shell scripts and command execution are directly related to project initialization purpose. No credential theft, network exfiltration, or obfuscation patterns detected.

Legitimate project scaffolding skill with standard development tools. Shell scripts and command execution are directly related to project initialization purpose. No credential theft, network exfiltration, or obfuscation patterns detected.