{"data":{"skill":{"slug":"cz07cring-ai-partner-chat","name":"ai-partner-chat","icon":"📦","repo":"https://github.com/Cz07cring/ai-partner-chat/tree/main/","status":"approved","author":"Cz07cring","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"611137e4-ec82-4f00-8602-492d3edb1f0d","skill_id":"84fe9119-0d41-4ea3-8672-61c2ff22dc76","version":6,"content_hash":"04b7033006809ec7f3e12ffa0f3cd327","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported many command, filesystem, network, and obfuscation signals. Most shell/backtick and weak-crypto hits are documentation or regex false positives, and no prompt injection attempt was found. The skill still presents high risk because it loads a model with trust_remote_code=True and is designed to persist user conversations and project notes by default.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"scripts/vector_indexer.py","line_end":95,"line_start":92},{"file":"scripts/conversation_logger.py","line_end":159,"line_start":121},{"file":"scripts/note_processor.py","line_end":99,"line_start":79},{"file":"scripts/orchestrator.py","line_end":285,"line_start":186}]},{"factor":"network","evidence":[{"file":"scripts/vector_indexer.py","line_end":95,"line_start":85},{"file":"README.md","line_end":90,"line_start":87},{"file":"SKILL.md","line_end":140,"line_start":136}]},{"factor":"filesystem","evidence":[{"file":"install.sh","line_end":46,"line_start":13},{"file":"scripts/conversation_logger.py","line_end":63,"line_start":40},{"file":"scripts/conversation_logger.py","line_end":239,"line_start":206},{"file":"scripts/note_processor.py","line_end":49,"line_start":33},{"file":"scripts/note_processor.py","line_end":90,"line_start":65},{"file":"scripts/orchestrator.py","line_end":59,"line_start":49}]},{"factor":"env_access","evidence":[{"file":"scripts/vector_indexer.py","line_end":56,"line_start":51}]},{"factor":"external_commands","evidence":[{"file":"install.sh","line_end":15,"line_start":1},{"file":"install.sh","line_end":99,"line_start":91},{"file":"SKILL.md","line_end":134,"line_start":123},{"file":"SKILL.md","line_end":186,"line_start":177},{"file":"README.md","line_end":405,"line_start":395}]}],"critical_findings":[],"high_findings":[{"title":"Remote Model Code Execution Enabled","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/vector_indexer.py","line_end":95,"line_start":92},{"file":"scripts/vector_indexer.py","line_end":90,"line_start":85}],"confidence":0.94,"description":"The vector indexer loads BAAI/bge-m3 with trust_remote_code=True. If the model source changes or is compromised, model loading can execute untrusted code in the user environment.","confidence_reasoning":"The code explicitly enables trust_remote_code while loading an external embedding model. This is a known supply-chain execution risk, even if the intended model is legitimate."}],"medium_findings":[{"title":"Default Conversation Logging and Vectorization","verdict":"TRUE_POSITIVE","locations":[{"file":"SKILL.md","line_end":31,"line_start":23},{"file":"SKILL.md","line_end":89,"line_start":83},{"file":"scripts/conversation_logger.py","line_end":159,"line_start":121},{"file":"scripts/conversation_logger.py","line_end":239,"line_start":206}],"confidence":0.93,"description":"The skill instructions tell Claude to record every conversation, and the logger writes user and AI messages to Markdown files and vector storage when importance is medium or higher.","confidence_reasoning":"The behavior is directly documented in the skill instructions and implemented in the logger. It is local storage, but it can retain sensitive conversation content by default."},{"title":"Project Notes Are Scanned and Persisted","verdict":"TRUE_POSITIVE","locations":[{"file":"SKILL.md","line_end":63,"line_start":38},{"file":"scripts/note_processor.py","line_end":90,"line_start":65},{"file":"scripts/orchestrator.py","line_end":183,"line_start":90}],"confidence":0.9,"description":"The note processor scans Markdown files under the project notes directory, reads their contents, and sends them to the orchestrator for tagging, analysis, and vector indexing.","confidence_reasoning":"The scanner behavior and persistence path are explicit in both the skill instructions and implementation. This is legitimate functionality but needs user consent and privacy warnings."},{"title":"Installer Modifies Hidden Claude Skill Directory","verdict":"TRUE_POSITIVE","locations":[{"file":"install.sh","line_end":15,"line_start":13},{"file":"install.sh","line_end":46,"line_start":30},{"file":"install.sh","line_end":68,"line_start":52}],"confidence":0.82,"description":"The installer writes into ~/.claude/skills/ai-partner-chat and removes selected old subdirectories before copying new files. The deletion is scoped, but it still changes hidden application data.","confidence_reasoning":"The installer uses a fixed target under the user home directory and scoped rm commands. This is not malicious, but marketplace users should understand the filesystem changes."}],"low_findings":[{"title":"Documented Destructive Troubleshooting Command","verdict":"TRUE_POSITIVE","locations":[{"file":"README.md","line_end":405,"line_start":400}],"confidence":0.87,"description":"The README documents rm -rf for rebuilding the local vector database. It is a manual troubleshooting command and targets only the skill vector database path.","confidence_reasoning":"The command is visible in documentation and is scoped to the skill database. It can delete user memory data but is not executed automatically."},{"title":"Static Command Alerts Are Mostly Markdown Examples","verdict":"FALSE_POSITIVE","locations":[{"file":"README.md","line_end":58,"line_start":49},{"file":"SKILL.md","line_end":134,"line_start":123},{"file":"SKILL.md","line_end":186,"line_start":177},{"file":"SKILL.md","line_end":1121,"line_start":1115}],"confidence":0.86,"description":"Many shell, Python, and PowerShell alerts occur inside README and SKILL usage examples. They are not hidden runtime execution paths, but users may copy and run them.","confidence_reasoning":"The cited locations are fenced documentation snippets. They are relevant user guidance, but they are not automatic command execution by the skill."},{"title":"Weak Cryptography Alerts Are False Positives","verdict":"FALSE_POSITIVE","locations":[{"file":"config/tags_taxonomy.json","line_end":28,"line_start":28},{"file":"config/tags_taxonomy.json","line_end":41,"line_start":41},{"file":"scripts/vector_utils.py","line_end":232,"line_start":232},{"file":"scripts/vector_utils.py","line_end":357,"line_start":357}],"confidence":0.91,"description":"The weak-crypto hits correspond to taxonomy words and prose such as design-patterns, system-design, and query descriptions, not cryptographic primitives.","confidence_reasoning":"The inspected lines contain tag names or ordinary prose. No hashing, encryption, or weak cryptographic algorithm usage is present there."}],"dangerous_patterns":[{"title":"trust_remote_code=True During Model Load","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/vector_indexer.py","line_end":95,"line_start":92}],"confidence":0.94,"description":"SentenceTransformer is called with trust_remote_code=True, allowing model repository code to run in the local Python process.","confidence_reasoning":"The dangerous option is present in executable Python code. The risk depends on the external model source and installation environment."},{"title":"Persistent Storage of User Conversations","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/conversation_logger.py","line_end":239,"line_start":206}],"confidence":0.93,"description":"Conversation messages are appended to local Markdown files and important conversations are added to the vector database.","confidence_reasoning":"The code writes full user and AI message content. This is intentional memory behavior, but it is sensitive data persistence."},{"title":"Recursive Removal in Installer","verdict":"TRUE_POSITIVE","locations":[{"file":"install.sh","line_end":46,"line_start":30}],"confidence":0.78,"description":"The installer uses rm -rf on scoped subdirectories under the target skill directory before copying replacement files.","confidence_reasoning":"The deletion is real but constrained by a hardcoded target path. It does not target root or home directly in the executable installer."}],"files_scanned":21,"total_lines":5345,"audit_model":"codex","audited_at":"2026-06-29T09:51:51.303+00:00","created_at":"2026-06-29T10:07:03.720226+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":5,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":2,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}