Why this verdict
- benign: 49 checks satisfied, no findings for skill:skills/back-forward-cache
Security findings 0
No security findings
No suspicious or malicious behavior was found; 1 candidate finding was refuted on review.
Refuted findings 1
Candidates the review stage examined and rejected, kept for transparency.
Supply chain
mediumRefutedlow confidenceUndeclared network residue: SKILL.md cites a frontendchecklist.io rule-page URL that the declared code-review purpose does not require (the skill ships its own references/rule.md and never instructs fetching the URL), leaving an unexplained remote-reference surface disclosed only as metadata/attribution.
Rule page: https://frontendchecklist.io/rules/performance/back-forward-cache
Why it was refuted
The flagged line is passive source attribution, not an operational network behavior: the URL is declared twice in the artifact (frontmatter metadata source/url fields and the labeled 'Rule page:' line that the analyzer itself records as declared claim D1), and the skill directs content lookups to the local references/rule.md rather than the URL, so harm, undeclared, and chain all fail.
Coverage gaps 4
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
apps/web/public/projects/indie-dev-toolkit/indie-dev-toolkit.mp4
context:unanalyzable_binary binary content is only byte-scanned
docs/audits/2026-10-04-mcp-validation/assets/checklist-interaction.webm
context:unanalyzable_binary binary content is only byte-scanned
docs/audits/2026-10-04-mcp-validation/assets/mcp-tab-interaction.webm
context:manifest_unparseable yaml: YAML node count exceeds 20000
pnpm-lock.yaml