google/skills cloud-trace-querying
Checked the catalogued skill at cloud-trace-querying.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
A set by no findings on this axis
27 suppressed by AI triage
The matched text is a documentation example of an HTTP host, not code that performs DNS lookups or exfiltration.
The content is documentation describing static server addresses, not actual DNS exfiltration.
The script uses a static relative path within the project, not user‑supplied input, so it is not a malicious path traversal.
The script uses a static relative path within the project, not user‑supplied input, so it is not a malicious path traversal.
The code only declares a Google Cloud auth scope, not performing an outbound request, so it is benign.
The function makes a GET request to a legitimate Google Observability API for retrieving a scope, a normal internal operation.
The code performs a GET to the Google Logging API to fetch resources, which is a legitimate outbound call within the application.
The relative path traversal is static and intentionally used to locate internal test directories, not user input.
The script is a controlled test harness; the path traversal points to a known internal repository directory, posing no security risk.
Outbound references occur only in test mocks and are not executed.
Same as above.
The script uses a static relative path within the project, not user‑supplied input, so it is not a malicious path traversal.
The file is documentation and the outbound call is an example, not executable code.
The script uses a static relative path within the project, not user‑supplied input, so it is not a malicious path traversal.
Absolute path used only in a comment in a test file.
Path used in a mock test, not in production code.
Test fixture creates a temporary path for cleanup tests.
Lock file path used only in unit tests.
Test code creates an active virtual environment path for testing.
Lock file path used only in test for active environment.
The absolute path is used in a test setup for a temporary directory and does not expose a real path traversal vulnerability.
The absolute path appears only in a unit test for a temporary directory; it is harmless and not exploitable.
Absolute path used only in unit tests, not in production code
Absolute path used only in unit tests, not in production code
Absolute path used only in unit tests, not in production code
Absolute path used only in unit tests, not in production code
The script uses a static relative path within the project, not user‑supplied input, so it is not a malicious path traversal.