amd/skills lemonade-router-builder
Checked the catalogued skill at lemonade-router-builder.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
A set by no findings on this axis
B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →
18 suppressed by AI triage
Documentation shows example curl commands, not executed code, so no threat.
Example curl commands in documentation; no execution occurs, so not a threat.
Shows example curl usage; it is not run automatically, thus not a threat.
Illustrates curl examples in documentation, no execution; benign.
Contains example curl commands; not executed, hence benign.
Example curl command in docs; no runtime execution, so benign.
Shows sample curl commands in documentation; not executed, therefore not a threat.
The curl command appears only in documentation as an example and does not represent actual network activity.
The curl command is part of a tutorial in the file and is not executed, thus not a threat.
This is an illustrative example in documentation, not an active outbound network call.
The shown curl command is just an example in the text and poses no real risk.
Schema URLs are normal configuration references, not outbound execution.
ID URL is a benign reference to the schema, not an active network call.
The script intentionally fetches a schema from a public GitHub repo, a legitimate outbound network call.
The fetch function is part of normal schema synchronization and uses a trusted GitHub URL.
The URL is a public raw.githubusercontent.com resource used for expected data retrieval.
The urllib.request.urlopen call is a standard network operation for schema download.
The call to fetch the schema is part of the tool’s normal functionality, not malicious.