📦
Historial de auditorías
extract-design-system - 2 auditorías
Versión de auditoría 2
Más reciente Riesgo medioJun 28, 2026, 10:32 AM
Static analysis detected many command and weak-crypto patterns, but review found no prompt injection, malicious intent, network exfiltration, or real cryptographic code. The external-command findings are valid because the skill tells agents to run npx-based tools, so publication is acceptable only with a warning about user approval and package trust.
3
Archivos escaneados
101
Líneas analizadas
3
hallazgos
codex
Auditado por
Problemas de riesgo medio (1)
External package execution through npx commands
The skill instructs agents to run npx playwright install chromium and npx extract-design-system commands. This matches the stated workflow, but it executes external packages and should require user approval and package trust review.
Problemas de riesgo bajo (1)
Weak cryptography static findings dismissed
The high-severity weak cryptography matches appear to be false positives from markdown content and file references. I found no evidence of MD5, SHA1, DES, RC4, or other weak cryptographic algorithms in the reviewed lines.
Factores de riesgo
⚙️ Comandos externos (23)
references/outputs.md:3 references/outputs.md:5 references/outputs.md:7 references/outputs.md:11 references/outputs.md:15 references/workflow.md:5 references/workflow.md:6 references/workflow.md:7 references/workflow.md:8 references/workflow.md:12 references/workflow.md:14 references/workflow.md:14 SKILL.md:28-31 SKILL.md:31-33 SKILL.md:33-41 SKILL.md:41-43 SKILL.md:43-45 SKILL.md:45-47 SKILL.md:47-49 SKILL.md:49-53 SKILL.md:53-54 SKILL.md:54-55 SKILL.md:55-56
Patrones detectados
npx command execution
Versión de auditoría 1
Riesgo medioApr 9, 2026, 08:47 AM
AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.
3
Archivos escaneados
101
Líneas analizadas
1
hallazgos
claude
Auditado por
No se encontraron problemas de seguridad
Factores de riesgo
⚙️ Comandos externos (23)
references/outputs.md:3 references/outputs.md:5 references/outputs.md:7 references/outputs.md:11 references/outputs.md:15 references/workflow.md:5 references/workflow.md:6 references/workflow.md:7 references/workflow.md:8 references/workflow.md:12 references/workflow.md:14 references/workflow.md:14 SKILL.md:28-31 SKILL.md:31-33 SKILL.md:33-41 SKILL.md:41-43 SKILL.md:43-45 SKILL.md:45-47 SKILL.md:47-49 SKILL.md:49-53 SKILL.md:53-54 SKILL.md:54-55 SKILL.md:55-56
Patrones detectados
Ruby/shell backtick executionWeak cryptographic algorithm