Scanned skills
github/awesome-copilot sandbox-npm-install
Checked the catalogued skill at sandbox-npm-install.
D AI-triaged 1
A Security
A set by no findings on this axis
D Permissions
D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
A Transparency
A set by no findings on this axis
1 finding
scripts/install.sh
2 suppressed by AI triage
SKILL.md
The flagged section is just documentation of post‑install verification steps, not an executable post‑install script.
scripts/install.sh
Relative traversal is used to compute the repository root for internal use, not malicious.