daymade/claude-code-skills frontend-visual-qa
Checked the catalogued skill at frontend-visual-qa.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
A set by no findings on this axis
A set by no findings on this axis
22 suppressed by AI triage
The URL is merely a string in a prompt; no network call is executed.
The endpoint is referenced only as text; no outbound request is made.
The URL appears only as part of a prompt description, not as an active call.
The excerpt describes a documented example of a fetch call used for testing, not an actual malicious outbound network request.
It is a sample diagnostic command for checking server Range support, purely instructional.
Shows how to use curl for range header diagnostics; no malicious activity implied.
Describes expected curl response for a range-capable server; purely explanatory.
The code simply searches for Playwright modules in parent directories, a normal pattern for dependency resolution.
The network call is a standard Playwright route.fetch used for request interception, not an exfiltration or malicious outbound call.
The string only documents a usage example and does not execute any outbound network call.
It references a static system path to locate an executable, not to traverse arbitrary directories.
It lists a fixed path used solely for locating a browser binary, not for arbitrary file access.
The path is a constant used to find an executable, not to traverse or modify files outside the script.
It is a fixed system path for a browser binary, not an exploitative path traversal.
The URL points to localhost in a test, not an external host.
The URL references 127.0.0.1 within a test, not a real outbound call.
This test uses a localhost address, which is benign.
The location is a local server set up in the test environment.
The URL targets a test server on localhost, not an external resource.
The probe URL is localhost for testing navigation failures.
Target URL is a local test server used for visual layout redaction.
The URL points to a local test server for error redaction scenarios.