審計紀錄

Static analysis heavily overcounted Markdown code fences as Ruby backtick execution and marked documentation URLs as risky network behavior. Human review found no prompt injection or confirmed malicious intent, but the skill can run npm/npx commands and includes troubleshooting guidance that may expose OAuth token state in browser storage or console logs.

Documentation-only skill providing step-by-step guidance for integrating bodhi-js-sdk into React applications. All 438 static findings are false positives: the scanner misinterprets markdown code block delimiters (triple backticks) as Ruby shell backtick execution, legitimate Bodhi SDK endpoints as hardcoded network targets, and standard Vite environment variable patterns as sensitive data access. No executable code exists - only markdown documentation files (.md) with code examples for user reference.

Documentation-only skill providing step-by-step guidance for integrating bodhi-js-sdk into React applications. All 438 static findings are false positives: the scanner misinterprets markdown code block delimiters (triple backticks) as Ruby shell backtick execution, legitimate Bodhi SDK endpoints as hardcoded network targets, and standard Vite environment variable patterns as sensitive data access. No executable code exists - only markdown documentation files (.md) with code examples for user reference.

Documentation-only skill providing guidance for integrating bodhi-js-sdk into React applications. No executable code present. All described capabilities are standard web development practices for LLM SDK integration.

Documentation-only skill providing guidance for integrating bodhi-js-sdk into React applications. No executable code present. All described capabilities are standard web development practices for LLM SDK integration.

Documentation-only skill providing guidance for integrating bodhi-js-sdk into React applications. No executable code present. All described capabilities are standard web development practices for LLM SDK integration.