nvidia/skills hsb-flash
Checked the catalogued skill at hsb-flash.
D set by findings not listed
D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
B set by findings not listed in the stored summary
7 suppressed by AI triage
The absolute path /home/nvidia is a user-supplied remote root, not a local path traversal, so it poses no local file system risk.
The absolute path appears only as a string in a JSON field, not executable code, so it does not pose a traversal risk.
The path is part of a test question string, not used for file access, making it benign.
The path reference is only present as text in JSON, not leveraged for file operations, so it is harmless.
The URL appears only in a comment referencing a license, not as an executable network request.
Documentation describes outbound calls; no actual code present.
Documentation describes outbound calls; no actual code present.