codeswithroh/tastemaker tastemaker
Checked the catalogued skill at tastemaker.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
F; retained sample includes a critical finding · SD-004 · what this rule accepts as a false positive →
A set by no findings on this axis
15 suppressed by AI triage
The matched string is a literal SVG namespace URL in a string constant, not an outbound network call.
The code only parses nested <g> tags, with no network operations.
This line is part of a loop that extracts XML segments; it does not perform any network request.
The matched text is only documentation of an external API endpoint, not an actual outbound network call or permission grant, so it poses no threat.
Defines an allowlist-based URL guard, not a direct network call.
Lists permitted hosts; restrictive configuration, not a broad permission.
User-agent string definition; benign configuration.
Custom redirect handler enforcing the allowlist; defensive code.
Instantiates guarded opener; benign implementation.
Defines safe urlopen_checked function; not a direct outbound call.
The script intentionally performs outbound HTTP requests to public image APIs for legitimate functionality.
The URL is a known public API endpoint used intentionally by the script.
The script references Pixabay’s public API for image search, a benign operation.
The User-Agent string contains a public GitHub URL, not a malicious outbound call.
The script warns about missing API key and references Pixabay documentation, a normal informational message.