This report does not block or authorize the manifest or ZIP.
Static analysis reported many command-execution and weak-crypto patterns, but review found these are mostly documentation examples, markdown output formatting, SQL text, or line-reference text rather than executable dangerous code. The confirmed risk is privacy exposure from reading hidden Claude and Codex transcript stores and writing extracted conversation content or a DuckDB index to local files.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
5 Files scanned · 1,413 Lines analyzed
3 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
The indexer searches default hidden Claude session directories, recursively reads JSONL transcript files, and stores message content in a local DuckDB database. This is legitimate for transcript search, but the database can contain private prompts, assistant responses, file paths, project names, and tool metadata.
The documented default paths and code confirm hidden session directories are read and indexed into a persistent database. No network exfiltration was found, so the risk is privacy exposure through local storage rather than confirmed malicious behavior.
Transcript Export Can Persist Sensitive Conversation Data
The Claude transcript extractor writes user-selected markdown output and can include tool inputs and thinking blocks. This is expected behavior, but exported transcripts may contain secrets, private code, command output, or internal project context copied from session logs.
The code directly formats optional thinking and tool data, then writes the transcript to a user-selected file. This is a clear local data handling risk, although it requires intentional CLI use and does not show exfiltration.
System Reconnaissance Findings Are Benign Metadata Output
The scripts read and print metadata such as working directory, git branch, model, file path, and CLI version. This is useful transcript context, but users should avoid sharing generated output publicly without review.
The metadata extraction is explicit and local, and it supports the advertised transcript functionality. The impact is limited to disclosure if exported transcripts or indexes are shared.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Command Execution Static Findings Are False Positives
The reported command-execution locations are markdown command examples or generated markdown code blocks, not shell execution by the Python scripts. The reviewed scripts do not call subprocess, os.system, eval, or exec for command execution.
The cited lines are documentation examples or string formatting for output. Targeted search found no command execution APIs in the scripts.
Weak Cryptography Static Findings Are False Positives
The reported weak-cryptography lines do not implement cryptography. They are headings, parser setup, SQL ordering text, or commit hash display logic used for transcript metadata.
Review found no hashing or encryption operation at the cited locations. One Codex metadata path displays a shortened commit hash, which is not used for security.