jimliu/baoyu-skills baoyu-danger-gemini-web
Checked the catalogued skill at baoyu-danger-gemini-web.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
A set by no findings on this axis
A set by no findings on this axis
26 suppressed by AI triage
Static URL string used in test code, no actual outbound network call.
The string is only a URL prefix used for generated image URLs, not an actual outbound request
The line references the same URL prefix; no outbound call is performed here
Defines a static endpoint URL; no network call is executed.
Defines a static endpoint URL; no network call is executed.
Defines a static endpoint URL; no network call is executed.
Defines a static endpoint URL; no network call is executed.
Defines a static endpoint URL; no network call is executed.
Defines a static endpoint URL; no network call is executed.
Header configuration referencing external host; no network call is executed.
Header configuration referencing external host; no network call is executed.
Standard fetch usage in a utility function, no malicious behavior.
Standard fetch usage with timeout handling; benign.
URL reference used for navigation, not an actual outbound request from the script.
Absolute Windows path constants for locating Chrome executable, safe configuration.
Same as above, safe absolute path constant.
Same as above, safe absolute path constant.
Same as above, safe absolute path constant.
Linux absolute path constant for Chrome binary, safe.
Linux absolute path constant for Chrome binary, safe.
Linux absolute path constant for Chrome binary, safe.
Linux absolute path constant for Chrome binary, safe.
Linux absolute path constant for Microsoft Edge binary, safe.
Chrome DevTools API call to retrieve cookies, not an outbound network call from the script.
Chrome DevTools API call to retrieve cookies, not an outbound network call from the script.
The function is intentionally uploading a file to a predefined endpoint, a normal and expected operation.