nvidia/skills deepstream-sop
Checked the catalogued skill at deepstream-sop.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
B set by findings not listed in the stored summary
18 suppressed by AI triage
The file contains a test example with a curl or Python request snippet, not an actual outbound call.
Same as above; the content is a benign example of an outbound request pattern.
The URL appears only in a comment referencing the license, not as an executable network request.
The relative include path is used for compilation, not for runtime file access outside the skill.
Absolute system include path is part of build configuration, not a runtime traversal.
Relative include path is a standard compile-time reference, not a malicious traversal.
The URL appears only in a comment, not in executable code.
The URL is a license reference in a comment, not an executable network call.
The URL is in a license comment, not an actual outbound call.
Hardcoded absolute path is not user‑controlled, so no path traversal risk.
Hardcoded absolute path is safe; it is not derived from external input.
The URL is only in a comment/header, not executed as a network call.
The URL appears only in a comment, not as an executable network request.
The URL is only in a comment/header, not executed as a network call.
The URL is a static license reference in a comment, not an executed network request.
No path traversal or absolute system directory paths found in the file content.
The file is a Markdown documentation containing example code; the path traversal occurs only in a code snippet, not executed, so it is not a real threat.
The URL appears only in a comment referencing the license, not as an executable network request.