secondsky/sap-skills sap-dependency-security
Checked the catalogued skill at sap-dependency-security.
C; retained sample includes a medium finding · SD-012 · what this rule accepts as a false positive →
A set by no findings on this axis
B set by findings not listed in the stored summary
23 suppressed by AI triage
Documentation explains how to disable post‑install scripts, no malicious code.
Excerpt shows Bun defaults to disabling postinstall scripts, a safety measure.
Same as finding 2, reiterates safe configuration.
Mentions pnpm disables postinstall scripts by default, not harmful.
Same as finding 4, safe configuration described.
Documentation describing how to add shell aliases, not an actual persistence mechanism.
Documentation showing example of adding aliases to RC file, not a real persistence change.
Documentation describing use of npq with socket, not a post-install hook.
Documentation listing categories, not an actual script.
Documentation example referencing post‑install hooks, not actual code.
Table entry citing a post‑install incident, purely descriptive.
Section describing how to disable post‑install scripts, no executable script present.
Instructional snippet for npm config; no harmful behavior.
Explanation of Bun's default behaviour, purely informational.
Documentation on pnpm disabling postinstall scripts, not active code.
Example usage of @lavamoat/allow-scripts, demonstration only.
CI integration example, no malicious payload.
Pre‑install security auditing section, illustrative.
Continuation of previous example, no harmful content.
Shell alias example in documentation, not executed.
Listing of npq validations, informational.
Comparison table of tools, purely descriptive.
Example code using fetch; no real outbound call.