jimliu/baoyu-skills baoyu-url-to-markdown
Checked the catalogued skill at baoyu-url-to-markdown.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
A set by no findings on this axis
A set by no findings on this axis
17 suppressed by AI triage
The code merely constructs a URL string for embedding a tweet; no outbound network request is performed.
The code builds a URL string for the tweet author; it does not execute any network call, thus posing no real threat.
The code only constructs a URL string, not performing any outbound network request.
The code builds a URL string for display; no actual outbound network call is executed.
The file is documentation only and contains no actual outbound network calls or permission grants.
Documentation merely references outbound network call patterns, not executing or configuring them.
The code only constructs URL strings; it does not perform any outbound network requests.
The file is a documentation text with no executable code or config that would enable outbound network calls.
Help text shows example URLs but no executable outbound call in the code.
Example URL in help text only; no outbound network logic present.
Duplicate example URL; still no real network call in the script.
Same as above; example URL only.
Example URL for Twitter status; no execution logic here.
Same example as previous; no real outbound call in this file.
The constant simply stores a public API endpoint for a legitimate service, not an illicit network request.
The fetch call is part of normal functionality to retrieve markdown from a trusted external API, not an unauthorized data exfiltration.
The fetch call is a normal part of the media downloader's intended functionality.