runpod/runpod-plugins-official runpod
Checked the catalogued skill at runpod.
F; retained sample includes a critical finding · SD-009 · what this rule accepts as a false positive →
F; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
B set by findings not listed in the stored summary
39 suppressed by AI triage
Relative markdown links to other docs are harmless references, not code that accesses files outside the skill.
Relative link in documentation; no file read/write performed.
Relative markdown links to other skill files are normal and do not enable file system traversal
Relative markdown links to other skill files are normal and do not enable file system traversal
Relative file reference in text; no code execution.
Documentation reference; does not traverse system directories.
Relative markdown links to other skill files are normal and do not enable file system traversal
Reference to another document; no file system access.
Link within repo; harmless relative path.
Documentation reference using "../"; not a security issue.
Reference to other markdown; benign.
Relative link in documentation; safe.
Link to golden-path docs; not executable.
The text merely describes a CLI path, not an actual file traversal or malicious code.
The snippet describes documentation of curl usage, not a real outbound call in executable code.
No path traversal or absolute system directory paths found in the file content.
No path traversal string is present in the context, just empty lines.
The file is documentation only and contains no actual outbound network calls or permission grants.
No path traversal evidence in the context; the line contains only empty content.
No path traversal evidence in the context; the line contains only empty content.
The flagged content is generic documentation; no actual path traversal code or file operations are present
The flagged path traversal appears to be a documentation example, not an active vulnerability.
The script only creates ~/.ssh, writes a public key, and sets permissions—no private credentials are read or exposed.
Same reasoning: documentation example, not a threat.
The manifest contains no actual path traversal or system directory references, likely a false positive detection.
The file is documentation, not code, and contains no actual ../ traversal or system directory paths.
No path traversal string is present in the context, just empty lines.
The text appears to be a documentation placeholder rather than an actual outbound network call or configuration.
Documentation does not include any outbound network calls; the match refers to a configuration placeholder, not an actual call.
Documentation file shows no actual path traversal patterns, likely a false positive.
No path traversal or system directory references present in the file content around the flagged lines.
The file is documentation, and the flagged lines are empty; no real path traversal code present.
Documentation text referencing outbound network call, not an active config or code.
Documentation only, no executable code or configuration making outbound calls.
Documentation context, no executable path traversal usage detected.
Empty documentation lines; false positive from pattern matching.
The file contains documentation, not code, and only references a detected outbound call in text, not an actual network operation.
The content is documentation describing a detection, not an actual outbound network call or permission grant.
The file is documentation and the outbound call is an example, not executable code.