Historial de auditorías

Pipe to shell pattern

curl -LsSf https://astral.sh/uv/install.sh | sh

The setup command fetches a remote installer and pipes it directly to sh. If an agent follows it, network-delivered code executes without inspection or pinning.

Alto

Permissive CORS Configuration

The sample FastAPI app allows all origins, methods, headers, and credentials. If copied into production, authenticated browser requests can be exposed to unintended origins.

The CORS middleware configuration explicitly combines wildcard access with credentials. This is a common production security misconfiguration.

Alto

SKILL.md:402-441

Unauthenticated User Management Endpoints

The sample user router lists, reads, creates, and updates users without an authentication or authorization dependency. If copied, it can allow user enumeration or unauthorized account changes.

The route handlers depend only on the service dependency and show no current-user, role, or permission check. The endpoints operate on user records directly.

Elementos de revisión de capacidades (5)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

Database connection strings

database_url: str = "postgresql+asyncpg://user:pass@localhost:5432/db"

The sample settings include a runnable database URL with embedded username and password. The values are placeholders, but copied defaults can normalize hardcoded database credentials.

Alto

SKILL.md:186

Generic API/secret keys

secret_key: str = "change-me-in-production"

The sample application defines a default secret key value. If copied into a real app, predictable signing secrets can compromise tokens or other security-sensitive data.

Medio

SKILL.md:661

Hardcoded IP address

uv run uvicorn app.main:app --reload --host 0.0.0.0 --port 8000

The uvicorn command binds the application to 0.0.0.0, which can expose the service on all interfaces if copied without network controls. This is legitimate in some deployments but risky as default guidance.

Medio

SKILL.md:664

Hardcoded IP address

uv run uvicorn app.main:app --host 0.0.0.0 --port 8000 --workers 4

The uvicorn command binds the application to 0.0.0.0, which can expose the service on all interfaces if copied without network controls. This is legitimate in some deployments but risky as default guidance.

Bajo

Hardcoded URL

curl -LsSf https://astral.sh/uv/install.sh | sh

The guide hardcodes an external installer URL that users or agents may execute during setup. The URL is expected for uv installation, but it still creates supply-chain exposure when followed.

Factores de riesgo

⚡ Contiene scripts (1)

⚙️ Comandos externos (38)

🌐 Acceso a red (4)

SKILL.md:105 SKILL.md:133 SKILL.md:552 SKILL.md:571 SKILL.md:183 SKILL.md:211 SKILL.md:543 SKILL.md:186

🔑 Variables de entorno (8)

Patrones detectados

Pipe to shell pattern

Auditado por: codex

Versión de auditoría 7

4 jul 2026, 13:40

Most static findings are false positives caused by Markdown code fences or normal FastAPI example code. Confirmed risks include a remote installer piped to sh, public host binding, hardcoded secret and database defaults, permissive CORS, and unauthenticated user endpoints.

1

Archivos escaneados

710

Líneas analizadas

12

Elementos de revisión

0

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (3)

Crítico

Pipe to shell pattern

curl -LsSf https://astral.sh/uv/install.sh | sh

The setup command fetches a remote installer and pipes it directly to sh. If an agent follows it, network-delivered code executes without inspection or pinning.

Alto

Permissive CORS Configuration

The sample FastAPI app allows all origins, methods, headers, and credentials. If copied into production, authenticated browser requests can be exposed to unintended origins.

The CORS middleware configuration explicitly combines wildcard access with credentials. This is a common production security misconfiguration.

Alto

SKILL.md:402-441

Unauthenticated User Management Endpoints

The sample user router lists, reads, creates, and updates users without an authentication or authorization dependency. If copied, it can allow user enumeration or unauthorized account changes.

The route handlers depend only on the service dependency and show no current-user, role, or permission check. The endpoints operate on user records directly.

Elementos de revisión de capacidades (5)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

Database connection strings

database_url: str = "postgresql+asyncpg://user:pass@localhost:5432/db"

The sample settings include a runnable database URL with embedded username and password. The values are placeholders, but copied defaults can normalize hardcoded database credentials.

Alto

SKILL.md:186

Generic API/secret keys

secret_key: str = "change-me-in-production"

The sample application defines a default secret key value. If copied into a real app, predictable signing secrets can compromise tokens or other security-sensitive data.

Medio

SKILL.md:661

Hardcoded IP address

uv run uvicorn app.main:app --reload --host 0.0.0.0 --port 8000

The uvicorn command binds the application to 0.0.0.0, which can expose the service on all interfaces if copied without network controls. This is legitimate in some deployments but risky as default guidance.

Medio

SKILL.md:664

Hardcoded IP address

uv run uvicorn app.main:app --host 0.0.0.0 --port 8000 --workers 4

The uvicorn command binds the application to 0.0.0.0, which can expose the service on all interfaces if copied without network controls. This is legitimate in some deployments but risky as default guidance.

Bajo

Hardcoded URL

curl -LsSf https://astral.sh/uv/install.sh | sh

The guide hardcodes an external installer URL that users or agents may execute during setup. The URL is expected for uv installation, but it still creates supply-chain exposure when followed.

Factores de riesgo

⚡ Contiene scripts (1)

⚙️ Comandos externos (38)

🌐 Acceso a red (4)

SKILL.md:105 SKILL.md:133 SKILL.md:552 SKILL.md:571 SKILL.md:183 SKILL.md:211 SKILL.md:543 SKILL.md:186

🔑 Variables de entorno (8)

Patrones detectados

Pipe to shell pattern

Auditado por: codex

Versión de auditoría 6

4 jul 2026, 16:42

Most code fence, dotenv, and SQLAlchemy session findings are false positives from documentation examples. Confirmed risks include remote installer execution, hardcoded placeholder secrets, broad Uvicorn binding, permissive CORS, and unauthenticated user endpoints. No prompt injection evidence was found.

1

Archivos escaneados

710

Líneas analizadas

12

Elementos de revisión

0

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (3)

Crítico

Pipe to shell pattern

curl -LsSf https://astral.sh/uv/install.sh | sh

The command pipes a remotely downloaded installer directly into sh. This executes network content without checksum verification or review.

Alto

Permissive CORS Configuration

The sample FastAPI app allows all origins, methods, and headers while enabling credentials. This can expose authenticated browser requests if copied into production.

The CORS middleware settings are explicit and broad. The comment says to configure for production, but the unsafe default remains in the sample.

Alto

SKILL.md:402-441

Unprotected User Management Endpoints

The user routes list, fetch, create, and update users without authentication or authorization checks. A copied template could expose user records and allow unauthorized changes.

The handlers only depend on the service object and do not check a current user or permissions. The code may be illustrative, so confidence is high but not absolute.

Elementos de revisión de capacidades (5)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

Hardcoded URL

curl -LsSf https://astral.sh/uv/install.sh | sh

The hardcoded URL is used in a curl pipeline that downloads an installer. This creates network execution risk if copied without verification.

Alto

Database connection strings

database_url: str = "postgresql+asyncpg://user:pass@localhost:5432/db"

The sample sets a default database URL with embedded user and password values. Placeholder credentials can be copied into real deployments.

Alto

SKILL.md:186

Generic API/secret keys

secret_key: str = "change-me-in-production"

The sample provides a hardcoded default secret key. A predictable default can compromise tokens or signed data if reused in production.

Medio

SKILL.md:661

Hardcoded IP address

uv run uvicorn app.main:app --reload --host 0.0.0.0 --port 8000

The development command binds Uvicorn to 0.0.0.0, exposing the service on all interfaces. This is risky if copied outside a controlled environment.

Medio

SKILL.md:664

Hardcoded IP address

uv run uvicorn app.main:app --host 0.0.0.0 --port 8000 --workers 4

The production command binds Uvicorn to 0.0.0.0 without showing network controls. This can expose the API directly to untrusted networks.

Factores de riesgo

⚡ Contiene scripts (1)

⚙️ Comandos externos (38)

🌐 Acceso a red (4)

SKILL.md:105 SKILL.md:133 SKILL.md:552 SKILL.md:571 SKILL.md:183 SKILL.md:211 SKILL.md:543 SKILL.md:186

🔑 Variables de entorno (8)

Patrones detectados

Pipe to shell pattern

Auditado por: codex

Versión de auditoría 5

27 jun 2026, 12:42

AI review found no malicious intent, prompt injection, obfuscation, or credential exfiltration in the single markdown skill file. Most static findings are false positives from fenced examples, but the guide contains copy-paste risks including curl piped to sh, permissive CORS settings, placeholder secrets, and 0.0.0.0 server bindings.

1

Archivos escaneados

710

Líneas analizadas

6

Elementos de revisión

1

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Medio

Permissive CORS Example With Credentials

The FastAPI example enables wildcard origins, methods, and headers while allowing credentials. A comment says to configure this for production, but copying the example unchanged can create unsafe browser access policy.

The insecure CORS settings are visible in application example code. The nearby comment lowers confidence of harmful intent but does not remove the copy-paste risk.

Elementos de revisión de capacidades (2)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

SKILL.md:183-186 SKILL.md:543

Remote Install Script Piped to Shell

The setup guide tells users to install uv by piping a remote HTTPS script directly into sh. This is common tooling guidance, but it executes network content without local review and creates supply-chain risk if copied blindly.

The command is present in a bash example and directly pipes downloaded content into a shell. It appears intended for legitimate uv installation, so the risk is guidance-related rather than malicious.

Bajo

Placeholder Secrets and Database URL in Examples

The configuration example includes a sample database URL with user and password fields and a default secret key. These values look like placeholders, but production users must replace them with real secret management.

The values are clearly template defaults and the document later says never to commit secrets. The risk is low because no real credential or exfiltration behavior was found.

Falsos positivos estáticos ignorados (1)

Estas coincidencias estáticas fueron descartadas por la revisión semántica o coincidieron con tokens solo de esquema, por lo que se muestran por transparencia, pero no afectan la puntuación de calidad.

Bajo

SKILL.md:27-88 SKILL.md:200-206 SKILL.md:607-608 SKILL.md:661-664

Static Analyzer False Positives From Markdown Code Blocks

Most external command, dynamic import, SQLite, weak crypto, and reconnaissance alerts came from fenced markdown examples or ordinary Python imports. I did not find prompt injection, obfuscation, credential exfiltration, or hidden executable files.

The reviewed file is a single markdown skill containing instructional snippets. The flagged lines are examples, not code that runs automatically when the skill is loaded.

Factores de riesgo

⚙️ Comandos externos (4)

SKILL.md:94 SKILL.md:97-113 SKILL.md:518-525 SKILL.md:661-677

🌐 Acceso a red (3)

SKILL.md:94 SKILL.md:628 SKILL.md:661-664

🔑 Variables de entorno (4)

SKILL.md:32-33 SKILL.md:172-186 SKILL.md:543 SKILL.md:701-704

Patrones detectados

Pipe to Shell GuidanceDevelopment Server Bound to All Interfaces

Auditado por: codex

Versión de auditoría 4

21 ene 2026, 16:00

Static scanner flagged patterns from documentation examples including connection strings and shell commands. All findings are false positives - the skill contains template code for FastAPI development with no malicious intent or actual credential exposure.

2

Archivos escaneados

1,549

Líneas analizadas

9

Elementos de revisión

0

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (3)

Alto

SKILL.md:62 SKILL.md:183-186

Weak cryptographic algorithm references

Scanner flagged keywords related to password hashing and JWT authentication. These are standard secure patterns (bcrypt/scrypt) used in the template's authentication module. No weak algorithms detected.

Alto

Database connection string patterns

Example connection strings with placeholder values (user:pass@localhost) appear in configuration documentation. These are legitimate template examples, not actual credentials.

Bajo

SKILL.md:32-33

Environment configuration documentation

Documentation references .env files and python-dotenv for configuration. Standard practice for Python applications, not a security vulnerability.

Elementos de revisión de capacidades (2)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

SKILL.md:92-114

Shell command documentation

The skill documents shell commands for uv package manager and development setup. These are standard documentation patterns for build tools, not dynamic code execution.

Bajo

Hardcoded URL in install script

The uv installer URL (astral.sh) is a legitimate, official source for the package manager.

Factores de riesgo

⚡ Contiene scripts (1)

🌐 Acceso a red (1)

SKILL.md:105 SKILL.md:133 SKILL.md:172-175

🔑 Variables de entorno (3)

⚙️ Comandos externos (3)

SKILL.md:92-114 SKILL.md:516-526 SKILL.md:659-678

Auditado por: claude

Versión de auditoría 3

16 ene 2026, 12:22

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

2

Archivos escaneados

893

Líneas analizadas

4

Elementos de revisión

0

Falsos positivos ignorados

Factores de riesgo

🌐 Acceso a red (4)

⚡ Contiene scripts (1)

SKILL.md:105 SKILL.md:133 SKILL.md:552 SKILL.md:571 SKILL.md:183 SKILL.md:211 SKILL.md:543 SKILL.md:186

⚙️ Comandos externos (38)

🔑 Variables de entorno (8)

Patrones detectados

Hardcoded URLWeak cryptographic algorithmDynamic import() expressionRuby/shell backtick executionHardcoded IP addressdotenv libraryConfiguration libraryDatabase connection stringsGeneric API/secret keysEnvironment file accessSQLite database filePipe to shell patternSystem reconnaissance[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access

Auditado por: claude

Versión de auditoría 2

16 ene 2026, 12:22

AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.

2

Archivos escaneados

893

Líneas analizadas

4

Elementos de revisión

0

Falsos positivos ignorados

Factores de riesgo

🌐 Acceso a red (4)

⚡ Contiene scripts (1)