forcedotcom/sf-skills external-diagram-mermaid-generate
Checked the catalogued skill at external-diagram-mermaid-generate.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →
22 suppressed by AI triage
Relative markdown link to another skill manifest, not an actual file read/write
Relative markdown link to another skill manifest, not an actual file read/write
Relative markdown link to another skill manifest, not an actual file read/write
Relative markdown link to another skill manifest, not an actual file read/write
Relative markdown link to another skill manifest, not an actual file read/write
Relative markdown link to another skill manifest, not an actual file read/write
This is a documentation snippet demonstrating a standard OAuth client credentials flow, not a malicious outbound call.
This is a documentation snippet demonstrating a standard OAuth client credentials flow, not a malicious outbound call.
This is a documentation snippet demonstrating a standard OAuth client credentials flow, not a malicious outbound call.
Shows a standard API request example in documentation.
Contains a Base64‑encoded JWT assertion used for legitimate OAuth flow.
Illustrates a normal outbound request using requests.post in documentation.
Documentation example of a legitimate Salesforce token request, not an executed malicious call.
Python code snippet demonstrating a standard Salesforce refresh token call in documentation, not malicious.
Curl example showing legitimate Salesforce token revocation in documentation, not an attack.
The reference to /tmp/mermaid-preview.mmd appears only in documentation explaining how to use a temporary file; it is not executed as code and poses no threat.
Same absolute path reference is used in a usage example within documentation, not in executable code, and thus does not represent a real threat.
The file is documentation with no actual path traversal code, scanner likely flagged a false positive.
The flagged path traversal appears to be a documentation example, not an active vulnerability.
No path traversal evidence in the context; the line contains only empty content.
The flagged content is generic documentation; no actual path traversal code or file operations are present
Doc snippet, harmless.