Scanned skills

nomadamas/k-skill government-bond-analysis

Checked the catalogued skill at government-bond-analysis.

SkillTrust corpus scan 8 November 2026 v0.13.0 via skillsh Verify on GitHub
D AI-triaged 17
D Security

D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →

A Permissions

A set by no findings on this axis

A Transparency

A set by no findings on this axis

showing 10 of 17
securityhigh SD-007
scripts/collect.mjs
securityhigh SD-007
scripts/core.mjs
securityhigh SD-007
scripts/harness.mjs
securityhigh SD-007
scripts/harness.mjs
securityhigh SD-007
scripts/harness.mjs
securityhigh SD-007
scripts/harness.mjs
securityhigh SD-007
scripts/harness.mjs
securityhigh SD-007
scripts/harness.mjs
securityhigh SD-007
scripts/harness.mjs
securityhigh SD-007
scripts/harness.mjs
10 suppressed by AI triage
securityhigh SD-007 benign_example
scripts/cli.mjs

Only a string reference to a URL, no network call is made.

securityhigh SD-007 benign_example
scripts/cli.mjs

Only a string reference to a URL, no network call is made.

securityhigh SD-007 benign_example
scripts/cli.mjs

Only a string reference to a URL, no network call is made.

securityhigh SD-007 benign_example
scripts/cli.mjs

Only a string reference to a URL, no network call is made.

securityhigh SD-007 benign_example
scripts/cli.mjs

Only a string reference to a URL, no network call is made.

securityhigh SD-007 benign_example
scripts/dual.mjs

The reference to https://ecos.bok.or.kr/ is only a source URL in a string literal, not an executed network call or permission grant.

securityhigh SD-007 benign_example
scripts/dual.mjs

The URL appears only as documentation text, not as code performing an outbound request.

securityhigh SD-007 benign_example
scripts/dual.mjs

The URL is embedded in a markdown string, not executed as network traffic.

securityhigh SD-007 benign_example
scripts/dual.mjs

The URL is part of a static string for reference, not an outbound call.

securityhigh SD-007 benign_example
scripts/harness.mjs

Placeholder config file with no actual outbound network call.