amd/skills tracelens-analysis-orchestrator
Checked the catalogued skill at tracelens-analysis-orchestrator.
F; retained sample includes a critical finding · SD-009 · what this rule accepts as a false positive →
D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
B set by findings not listed in the stored summary
69 suppressed by AI triage
The detected string is a hex digest, not base64-encoded data, so no obfuscation is present.
The matched string appears in documentation describing a Python command, not an active malicious payload.
The base64-like text is part of a documentation reference, not executable malicious code.
The context shows normal documentation, not a hidden or malicious base64 payload.
The Base64 string appears in a documentation file and is not used for code execution.
The file is documentation text with no executable content or base64 strings present.
The Base64 string is embedded in documentation, not used for malicious purposes.
The Base64 string is included as part of a documentation example.
The Base64 string is present in a documentation file and does not represent executable code.
The string in the script is plain text, not base64 encoded.
The quoted content is a normal shell command, not a base64 encoded payload.
The quoted content is a normal shell command, not a base64 encoded payload.
The code only echoes a string and does not contain any eval with unsanitized variable input.
The long base64 string appears only in comments and is not executed by the script.
Same base64 string is in a comment block and has no executable effect.
The base64 data is part of documentation, not used by the script.
No code references the base64 string; it is purely informational.
Base64 appears only in a comment, not parsed or executed.
The string is part of a comment, so there is no threat.
No path traversal or absolute system directory paths found in the file content.
Same as above; the line is a documentation note, not executable code or config.
Documentation references a config setting for outbound calls, not actual execution.
Base64 strings in comments are benign test data.
Base64 strings are non-executable test artifacts.
Long string is part of a descriptive comment, not executed.
Same as previous; harmless.
No eval with unsanitized variables; code uses run_llm_agent safely.
Similar safe usage; no eval risk.
Base64 string in comment is non-malicious.
Command construction uses safe variables, no eval.
Same safe construction as above.
Run_llm_agent call is safe; no eval injection.
The code defines functions and performs calculations without any outbound network calls.
No network operations are present; the code is purely computational.
The snippet only defines functions and prints results, not network activity.
Code is local data processing and printing, no external calls.
The functions perform statistical calculations without network communication.
Only local computations and print statements; no outbound traffic.
The code simply formats output, not making any network request.
Printing and local data handling; no external network calls.
The section prints results; it contains no outbound network operations.
No base64-encoded string present; only regex definitions are shown.
README.md contains only shell script snippets; no actual Base64 data present, flag is a false positive.
Same as above; documentation file does not embed Base64.
No Base64 payload in the file, flag is benign.
No base64 string present; scanner misidentified variable assignment as obfuscation.
No base64 string present; scanner misidentified variable assignment as obfuscation.
No base64 encoded content detected in the snippet
No base64 encoded content detected in the snippet
No base64 data present; likely false positive.
No base64 data present; likely false positive.
The detected string is a placeholder, not a real base64-encoded payload.
The string is a parameter placeholder, not a malicious base64-encoded command.
Only a placeholder for a YAML file path, no actual base64 content.
The string is a template for a command, not obfuscated base64 data.
The string is a placeholder command template, not real base64.
Placeholder for reproducer command, not a base64 payload.
Command template for copying directories, not obfuscated base64.
Shell command to copy directories, no base64 obfuscation.
Copy command in documentation, not a malicious base64 string.
Listing file paths; no base64 obfuscation present.
The matched string is a filesystem path, not Base64-encoded data.
The matched string is a filesystem path, not Base64-encoded data.
The matched string is a filesystem path, not Base64-encoded data.
The matched string is a shell command path, not Base64-encoded data.
The matched string is a shell command path, not Base64-encoded data.
The matched string is a directory path, not Base64 encoded data.
The matched string is a file path, not a base64-encoded payload.
The matched text contains only ellipsis (...) placeholders, not an actual path traversal pattern.