| 1 | # Security scan allowlist for html-ppt-skill |
| 2 | # These patterns are false positives from template content, not actual threats. |
| 3 | |
| 4 | # Path traversal: templates reference shared assets via relative paths |
| 5 | # e.g. templates/full-decks/weekly-report/ → ../../../assets/ |
| 6 | # This is the correct relative path to the skill root assets directory. |
| 7 | traversal:templates/full-decks/*/index.html |
| 8 | |
| 9 | # Destructive commands: testing-safety-alert template displays forbidden |
| 10 | # commands as text examples in a security policy demo slide. |
| 11 | # They are HTML content, not executable code. |
| 12 | destructive:templates/full-decks/testing-safety-alert/index.html |
| 13 |