Audit History

All 21 static alerts are false positives caused by placeholder configuration text, ordinary dictionary keys, headings, and Markdown code fences. The skill does retrieve untrusted web and repository content without prompt-injection handling, creating a medium-risk indirect prompt-injection exposure.

The static findings were all false positives after contextual review. The high findings are placeholder API key setup docs or variable-name matches, while medium command findings are markdown code fences with Exa API examples. No prompt injection, exfiltration intent, or unsafe command execution evidence was found in reviewed files.

The API key and .env detections are setup documentation that uses placeholder values, not secret collection. The SKILL.md detections are Markdown fenced Python examples, and the other hits are ordinary research guidance or dictionary-key printing. No prompt injection, exfiltration intent, or abusive behavior was found in reviewed files.

Static command execution and crypto findings were false positives caused by Markdown code fences, prose, and ordinary dictionary key labels. The skill is legitimate research tooling, but it runs helper scripts and sends user search terms to Exa tools, so publication should include a network and API-key warning.

This is a legitimate research skill providing web search and code context retrieval via Exa API. The static scanner flagged 224 issues, but 181 are false positives from markdown code block delimiters being misidentified as shell commands. Other findings (env_access, crypto patterns) refer to documentation examples, not actual code. No malicious patterns detected. All network calls go to documented Exa API endpoints.

This is a legitimate research skill providing web search and code context retrieval via Exa API. The static scanner flagged 224 issues, but 181 are false positives from markdown code block delimiters being misidentified as shell commands. Other findings (env_access, crypto patterns) refer to documentation examples, not actual code. No malicious patterns detected. All network calls go to documented Exa API endpoints.

This is a legitimate research skill that provides web search and code context retrieval via Exa API. Contains Python helper scripts for query optimization and research workflows. All network calls are to documented Exa API endpoints. No malicious patterns detected.

This is a legitimate research skill that provides web search and code context retrieval via Exa API. Contains Python helper scripts for query optimization and research workflows. All network calls are to documented Exa API endpoints. No malicious patterns detected.

This is a legitimate research skill that provides web search and code context retrieval via Exa API. Contains Python helper scripts for query optimization and research workflows. All network calls are to documented Exa API endpoints. No malicious patterns detected.