leonxlnx/cinetic cinetic
Checked the catalogued skill at cinetic.
F; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
F set by findings not listed
B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →
34 suppressed by AI triage
Script merely copies local files; no malicious code or external downloads detected
The content contains no outbound network call or permission grant, only descriptive text about SVG assets.
There is no evidence of outbound network activity or related permissions in the snippet provided.
The content is documentation describing a detection, not an actual outbound network call or permission grant.
The file is documentation and the outbound call is an example, not executable code.
Documentation references outbound network call patterns; not executable code.
The file is a documentation text with no executable code or config that would enable outbound network calls.
Documentation example illustrating outbound network call permission, not an active threat
The text is a documentation note describing a logged outbound call, not an executable network request.
The URL appears only in a copyright field and does not represent an executable network call.
The URL is used only as a reference in metadata, not an actual network request.
This entry merely cites a license URL; no network traffic is triggered.
The GitHub link is for attribution only, not an outbound call.
It is a static license reference, not an active network operation.
The URL is part of copyright metadata, not an executable call.
Only a license reference; no network request is made.
GitHub URL used for attribution; no outbound traffic.
The link is in copyright metadata, not an executed call.
URL appears only as reference in metadata; no network operation.
The GitHub link is for attribution, not an outbound network call.
The absolute path is hard-coded and not controlled by user input, so it does not allow arbitrary file access beyond the intended sandbox.
No base64 string present; the matched line contains an import statement, not obfuscated data.
The URL is only the SVG namespace URI used in a string literal, not an actual outbound network request.
The README merely documents a command that may perform a network fetch; it does not execute code or grant permissions, so it is not a real threat.
The line is a comment describing how to use a script; it contains no executable outbound network call.
The code snippet in documentation demonstrates a hardcoded absolute path for illustration; no user input is involved and it is not used to perform unsafe file access, so it is benign.
File is prose; outbound call patterns are mentioned as examples, not real network calls.
The text is a documentation note describing a logged outbound call, not an executable network request.
The file is documentation and the outbound call is an example, not executable code.
The flagged text is a documentation note, not an actual outbound network call or permission grant.
Same reasoning: documentation example, not a threat.
The file is documentation, not executable code; the referenced outbound call is only noted in prose and not an actual configuration.
Documentation contains a note about outbound network calls, not actual code or configuration that would execute them.
The file is documentation and only contains a placeholder text, not an actual outbound network call or permission grant.