forcedotcom/sf-skills platform-mcp-tool-widget-coordinate
Checked the catalogued skill at platform-mcp-tool-widget-coordinate.
C; retained sample includes a medium finding · SD-008 · what this rule accepts as a false positive →
A set by no findings on this axis
A set by no findings on this axis
12 suppressed by AI triage
The file is documentation and contains no real base64-encoded payload.
The path referenced is a standard bundle resource, not a traversal outside the skill directory.
No base64 content is present; the rule was triggered incorrectly.
Documentation references a relative file path; no code execution.
Path shown is within documentation; not used for file access.
The matched text is a JSON snippet, not a base64-encoded string.
No actual base64 string present in the documented content, likely a false positive.
The snippet is a benign JSON example, not base64 encoded data.
The path referenced is a relative renderer file, not a traversal attack.
No base64 string present; likely a false positive.
The content shows JSON configuration, no base64 encoding detected.
The path is a relative reference with no '..' or absolute system directories, so it does not pose a traversal risk.