This report does not block or authorize the manifest or ZIP.
Static external-command findings are confirmed because the skill authorizes Bash and instructs agents to run memory-search.sh, doc-search.sh, which, ls, and an installer script. The weak-cryptography and most system-reconnaissance hits are false positives, but the file contains prompt-injection-style mandatory behavior and broad conversation-history access instructions, so publication should wait for human review.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
1 Files scanned · 131 Lines analyzed
4 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
External Shell Commands Depend on Unpackaged Scripts
The skill enables Bash and tells agents to run memory-search.sh, doc-search.sh, which, ls, and ./install-memory-tools.sh. The referenced scripts are not included in the reported file structure, so execution depends on the local PATH or workspace state.
The command examples are explicit and the file grants Bash access. No direct command injection is shown because the examples use quoted placeholders, but unbundled executable dependencies create review risk.
The skill instructs agents to inspect ~/.local/bin and states that scripts install there. This is local filesystem access under a hidden home directory and should be limited to explicit user-approved troubleshooting.
The hidden directory path is directly referenced. The shown command is listing and install-location guidance, not secret extraction, so medium severity is appropriate.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
The skill uses language such as "THIS IS NOT OPTIONAL" and tells the agent it "MUST FIRST search your memory." This attempts to impose default behavior from untrusted skill content and can override user intent or higher-priority workflow limits.
The quoted mandatory wording is present in the file and directly instructs agent behavior. It does not order evasion or malware, so the finding is high rather than critical.
The skill instructs agents to search previous discussions, decisions, context, and earlier work before any task. This can expose unrelated or sensitive conversation history when the user did not request retrieval.
The file repeatedly requires proactive memory searching for any instruction. The privacy impact depends on the host memory store, but the behavioral instruction is explicit.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Static analysis flagged weak cryptography at Markdown metadata and section headings, but no cryptographic API, hash routine, cipher, or credential handling is present at those locations.
Manual review of the cited lines shows prose and Markdown tables only. There is no evidence of MD5, SHA1, DES, RC4, or similar weak cryptographic use.
Most System Reconnaissance Detections Are False Positives
Static analysis flagged several lines as reconnaissance, but the cited content is conversation-context guidance or command examples. No host inventory collection, network probing, or environment enumeration is shown at those static locations.
The cited lines describe memory search behavior and example local commands, not system discovery. Separate shell-command and filesystem risks are captured in medium findings.