Refuted findings 5
Candidates the review stage examined and rejected, kept for transparency.
Data exfiltration
criticalRefutedlow confidenceThe MCP server sends per-call telemetry (tool name, success flag, client name/version, and a pseudonymous HMAC id derived from the caller IP) to Google Analytics 4 via env-configured Measurement Protocol credentials; this is undeclared in server metadata and sits uneasily with the 'no tracking' framing, though it is documented in code comments, excludes tool arguments, and is off unless configured.
https://www.google-analytics.com/mp/collect?measurement_id=
Why it was refuted
The GA4 telemetry is documented in the module header, is a deliberate feature of the operator's own server, and excludes arguments and addresses. It sends only an HMAC pseudonym, and nothing is sent unless both env vars are set, so it is declared and low-harm rather than concealed exfiltration.
Code execution
criticalRefutedlow confidenceThe skill tells the agent to run several .mjs scripts from a sibling directory outside the artifact (~/Workspace/hikmah/analytics-toolkit) using a node binary it resolves itself, so what executes depends on whatever is at that path at runtime and cannot be verified here.
"$NODE" ~/Workspace/hikmah/analytics-toolkit/discover.mjs
Why it was refuted
Running the sibling analytics-toolkit scripts is the skill's declared core capability. The skill openly names the toolkit as a sibling repo, and the path is fixed rather than concealed or fetched from a remote source.
Code execution
criticalRefutedlow confidenceThe skill instructs the agent to run scripts (discover.mjs, gsc.mjs, ga.mjs, ga-mcp.mjs, bing.mjs, login.sh) from a sibling repo outside the artifact (~/Workspace/hikmah/analytics-toolkit) that is not shipped here, so the executed code is unverifiable and could change at runtime; this is consistent with the declared purpose but is an unshipped execution surface.
`DAYS=<n> "$NODE" ~/Workspace/hikmah/analytics-toolkit/gsc.mjs sc-domain:drwho.me`
Why it was refuted
The gsc.mjs, ga.mjs, ga-mcp.mjs and bing.mjs pulls are the skill's stated purpose, run from the declared sibling toolkit. The report is written only to a gitignored docs directory, so the 'Read-only' file_write contradiction is a false positive on the $NODE variable.
Data exfiltration
highRefutedlow confidenceThe site footer asserts 'no tracking of what you look up' while the layout conditionally loads a GA4 analytics script on every page, and tool state (the looked-up domain) lives in the page URL, so the claim may be contradicted; the GA script itself is not shown here.
Free tools. No account, no tracking of what you look up.
Why it was refuted
The footer claim concerns what users look up. The GA script loads only when configured and is consent-gated for regions that require it. The finding speculates about URL state and never shows the script sending lookups, so there is no source-to-sink chain.
Supply chain
mediumRefutedlow confidencepnpm-workspace.yaml exempts the project's own @hikmahtech/dossier-checks@0.2.0 from pnpm's minimum-release-age protection, so a freshly published package version is installed without the cooldown; the justification is an unverifiable ownership claim.
minimumReleaseAgeExclude:
Why it was refuted
The exclusion is pinned to one exact version of the project's own package. It is openly explained in a comment and carries a removal condition, so it is not concealed or an unpinned bypass.
