What the reviewer found
Env-var secrecy tool docs; the flagged lines are the tool's own install command and anti-pattern/placeholder examples explaining what leaks secrets, not instructions to exfiltrate. [SC2 kept: remote script from varlock.dev piped to a shell]
What was read
The file as it ships in smith-horn/skillsmith:
packages/mcp-server/src/assets/skills/varlock/SKILL.md
What the static scan said
The scan flagged 4things. The reviewer kept 1 and dismissed 3 as false.
P4Subtle steering — false positiveE2Harvests environment variables — false positiveSC2Downloads and executes remote code — realNETMakes network calls — false positive
How this review was made
Sonnet 5 read the files above on 6 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.