What the reviewer found

A skill documenting setup of companion CLIs (GitHub CLI, Hugging Face CLI, SSH keys) for Runpod deployments. The sudo apt install is the official GitHub CLI instructions, the curl line installs the Hugging Face CLI from hf.co (the vendor's own domain), and the SSH text guides the user to generate a new key for themselves, not to read an existing one.

• installs-software — installs software

What was read

The file as it ships in nodetool-ai/nodetool:

• .claude/skills/companion-clis/SKILL.md

What the static scan said

The scan flagged 4things. The reviewer kept 0 and dismissed 4 as false.

• PE2Asks for root — false positive
• PE3Reaches for credential files — false positive
• SC2Downloads and executes remote code — false positive
• NETMakes network calls — false positive

How this review was made

Sonnet 5 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.

Produced by agentmods.dev · Sonnet 5 · 7 September 2026