briiirussell/cybersecurity-skills dependency-audit
Checked the catalogued skill at dependency-audit.
F; retained sample includes a critical finding · SD-009 · what this rule accepts as a false positive →
A set by no findings on this axis
B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →
18 suppressed by AI triage
The content is documentation explaining outbound network call patterns, not executable code.
The text is a documentation note about curl pipe-to-shell risks, not a real invocation.
The flagged text is part of documentation describing post‑install hooks, not an actual lifecycle script in the codebase.
The script fetches vulnerability data from a trusted public API, a legitimate operation.
The script pulls EPSS scores from a public endpoint, a benign data‑fetching action.
The code defines a constant URL for a public KEV feed, just a reference to an external source.
Defines EPSS URL for public data retrieval; no malicious intent.
Defines OSV URL for advisory lookup, a benign external data source.
$schema field merely references an external schema, not an active outbound network call or permission grant.
$id field is a reference URI, not an active outbound call or permission grant.
Content discusses MPTCP kernel configuration, not DNS tunneling.
Content details MPTCP exposure, unrelated to DNS exfiltration.
Content explains kernel namespace behavior for MPTCP, not DNS queries.
The code only constructs a URL string for documentation, not performing a network call.
It sets a JSON schema URL string; no network request is made.
The informationUri is a static GitHub URL; the code does not perform any outbound call.
The outbound network call is part of a documentation example, not executed code.
The curl example appears only in documentation for permitted live checks, not actual code.