diff --git a/strix/core/runner.py b/strix/core/runner.py
index 55784d21..048a59de 100644
--- a/strix/core/runner.py
+++ b/strix/core/runner.py
@@ -602,7 +602,7 @@ async def run_strix_scan(
         )
         if not interactive and result is not None:
             final = getattr(result, "final_output", None)
-            # Lifecycle tools mark the root completed. 
+            # Lifecycle tools mark the root completed.
             async with coordinator._lock:
                 root_completed = coordinator.statuses.get(root_id) == "completed"
             if not root_completed:
diff --git a/strix/skills/__init__.py b/strix/skills/__init__.py
index bc2d3b40..1e66fae0 100644
--- a/strix/skills/__init__.py
+++ b/strix/skills/__init__.py
@@ -17,7 +17,7 @@ _FRONTMATTER_PATTERN = re.compile(r"^---\s*\n(?P<body>.*?)\n---\s*\n", re.DOTALL
 # Only skills with `template: jinja` in their frontmatter are rendered; the rest hold
 # literal `{{ }}` payloads.
 _SKILL_TEMPLATES = Environment(
-    autoescape=False,  # noqa: S701 - prompts, not HTML
+    autoescape=False,  # noqa: S701  # nosec B701 - prompts, not HTML
     undefined=StrictUndefined,
     trim_blocks=True,
     lstrip_blocks=True,