📦
Historique des audits
ai-architect-lite - 6 audits
Version de l’audit 6
Dernier Risque moyenJun 28, 2026, 08:29 PM
Static analysis reported many high-risk patterns, but most are false positives from Markdown backticks, documentation examples, Chinese text entropy, and security guidance that mentions secrets. No prompt injection, network exfiltration, shell spawning, or credential access was found. The confirmed risk is local filesystem modification through bundled helper scripts, which is legitimate for this workflow but should be disclosed to users.
10
Fichiers analysés
749
Lignes analysées
8
résultats
codex
Audité par
Problèmes à risque moyen (2)
Local Filesystem Writes from Helper Scripts
The bundled helpers can create .ai_context/03_ACTIVE_TASK.md and write plan output to a user-selected path. This matches the skill purpose, but users should review paths before execution because local files can be created or overwritten.
User-Supplied Output Paths Need Review
The plan helper accepts an --out path and resolves it before writing. Its traversal check is not a strong project-root boundary, so a user-provided absolute path can target locations outside the current repository.
Problèmes à risque faible (3)
Static Shell Execution Matches Are Documentation Examples
The reported Ruby or shell backtick detections are Markdown inline code, fenced examples, or command examples. I did not find code that invokes a shell, subprocess, eval, or dynamic execution.
Network and Credential Static Matches Are False Positives
The network match is contribution text, and the environment-file match is security guidance warning users not to commit secrets. I did not find network requests or credential reads.
High Entropy Heuristics Are Caused by Multilingual Documentation
The high entropy findings occur in Markdown files containing Chinese text, symbols, and examples. No encoded payload, binary blob, or obfuscated code was found in those files.
Facteurs de risque
⚡ Contient des scripts (3)
📁 Accès au système de fichiers (5)
⚙️ Commandes externes (4)
Motifs détectés
File Creation and Overwrite APIs
Version de l’audit 5
Risque moyenJan 16, 2026, 08:58 PM
AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.
11
Fichiers analysés
1,028
Lignes analysées
3
résultats
claude
Audité par
Aucun problème de sécurité trouvé
Facteurs de risque
⚙️ Commandes externes (77)
CONTRIBUTING.md:14 CONTRIBUTING.md:18 CONTRIBUTING.md:28 CONTRIBUTING.md:37-46 CONTRIBUTING.md:46-73 CONTRIBUTING.md:73-84 CONTRIBUTING.md:84-88 CONTRIBUTING.md:88-98 CONTRIBUTING.md:98-107 CONTRIBUTING.md:107-116 CONTRIBUTING.md:116-143 README.md:11 README.md:15 README.md:24 README.md:29-41 README.md:41-47 README.md:47-54 README.md:54-58 README.md:58-64 README.md:64-94 README.md:94-98 README.md:98-107 README.md:107-112 README.md:112-124 README.md:124-130 README.md:130-137 README.md:137-141 README.md:141-147 references/lite-protocol.md:5 references/lite-protocol.md:5 references/lite-protocol.md:7-20 references/lite-protocol.md:20-24 references/lite-protocol.md:24-25 references/lite-protocol.md:25-28 references/lite-protocol.md:28-29 references/lite-protocol.md:29-33 references/superpowers-lite.md:25 scripts/append_log.py:3 scripts/append_log.py:4 SECURITY.md:32 SECURITY.md:35 SECURITY.md:38 SECURITY.md:43 SECURITY.md:49 SECURITY.md:50 SKILL.md:7 SKILL.md:10 SKILL.md:15 SKILL.md:15 SKILL.md:16 SKILL.md:16 SKILL.md:16 SKILL.md:17 SKILL.md:17 SKILL.md:18 SKILL.md:18 SKILL.md:18 SKILL.md:19 SKILL.md:20 SKILL.md:20 SKILL.md:20 SKILL.md:24 SKILL.md:25 SKILL.md:25 SKILL.md:25 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:30-36 SKILL.md:36-39 SKILL.md:39 SKILL.md:39-40 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-46 SKILL.md:46-51
🌐 Accès réseau (1)
📁 Accès au système de fichiers (4)
Motifs détectés
Ruby/shell backtick executionWeak cryptographic algorithmPython HTTP librariesSystem reconnaissanceEnvironment file accessPath traversal sequenceHidden file access[HEURISTIC] High file entropy (6.30 bits) - possible binary/encrypted content[HEURISTIC] High file entropy (7.04 bits) - possible binary/encrypted content[HEURISTIC] High file entropy (7.06 bits) - possible binary/encrypted content[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network
Version de l’audit 4
Risque moyenJan 16, 2026, 08:58 PM
AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.
11
Fichiers analysés
1,028
Lignes analysées
3
résultats
claude
Audité par
Aucun problème de sécurité trouvé
Facteurs de risque
⚙️ Commandes externes (77)
CONTRIBUTING.md:14 CONTRIBUTING.md:18 CONTRIBUTING.md:28 CONTRIBUTING.md:37-46 CONTRIBUTING.md:46-73 CONTRIBUTING.md:73-84 CONTRIBUTING.md:84-88 CONTRIBUTING.md:88-98 CONTRIBUTING.md:98-107 CONTRIBUTING.md:107-116 CONTRIBUTING.md:116-143 README.md:11 README.md:15 README.md:24 README.md:29-41 README.md:41-47 README.md:47-54 README.md:54-58 README.md:58-64 README.md:64-94 README.md:94-98 README.md:98-107 README.md:107-112 README.md:112-124 README.md:124-130 README.md:130-137 README.md:137-141 README.md:141-147 references/lite-protocol.md:5 references/lite-protocol.md:5 references/lite-protocol.md:7-20 references/lite-protocol.md:20-24 references/lite-protocol.md:24-25 references/lite-protocol.md:25-28 references/lite-protocol.md:28-29 references/lite-protocol.md:29-33 references/superpowers-lite.md:25 scripts/append_log.py:3 scripts/append_log.py:4 SECURITY.md:32 SECURITY.md:35 SECURITY.md:38 SECURITY.md:43 SECURITY.md:49 SECURITY.md:50 SKILL.md:7 SKILL.md:10 SKILL.md:15 SKILL.md:15 SKILL.md:16 SKILL.md:16 SKILL.md:16 SKILL.md:17 SKILL.md:17 SKILL.md:18 SKILL.md:18 SKILL.md:18 SKILL.md:19 SKILL.md:20 SKILL.md:20 SKILL.md:20 SKILL.md:24 SKILL.md:25 SKILL.md:25 SKILL.md:25 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:30-36 SKILL.md:36-39 SKILL.md:39 SKILL.md:39-40 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-46 SKILL.md:46-51
🌐 Accès réseau (1)
📁 Accès au système de fichiers (4)
Motifs détectés
Ruby/shell backtick executionWeak cryptographic algorithmPython HTTP librariesSystem reconnaissanceEnvironment file accessPath traversal sequenceHidden file access[HEURISTIC] High file entropy (6.30 bits) - possible binary/encrypted content[HEURISTIC] High file entropy (7.04 bits) - possible binary/encrypted content[HEURISTIC] High file entropy (7.06 bits) - possible binary/encrypted content[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network
Version de l’audit 3
Risque faibleJan 10, 2026, 12:02 PM
Pure prompt-based Claude skill with two local utility scripts. Scripts access local filesystem only within project root with proper path traversal protection. No network calls, no credential access, no external command execution. Minimal security footprint with Python standard library only.
11
Fichiers analysés
699
Lignes analysées
2
résultats
claude
Audité par
Problèmes à risque faible (1)
Local filesystem access in utility scripts
Both Python scripts access the local filesystem to create and write files within the project root. append_log.py creates `.ai_context/03_ACTIVE_TASK.md` and appends log entries. plan_helper.py writes plan templates to files. These operations include path traversal protection (lines 76-79 in plan_helper.py, lines 62-75 in append_log.py) and are scoped to the project directory as documented. This is necessary for the skill's purpose of maintaining project context.
Facteurs de risque
📁 Accès au système de fichiers (3)
Version de l’audit 2
Risque faibleJan 10, 2026, 12:02 PM
Pure prompt-based Claude skill with two local utility scripts. Scripts access local filesystem only within project root with proper path traversal protection. No network calls, no credential access, no external command execution. Minimal security footprint with Python standard library only.
11
Fichiers analysés
699
Lignes analysées
2
résultats
claude
Audité par
Problèmes à risque faible (1)
Local filesystem access in utility scripts
Both Python scripts access the local filesystem to create and write files within the project root. append_log.py creates `.ai_context/03_ACTIVE_TASK.md` and appends log entries. plan_helper.py writes plan templates to files. These operations include path traversal protection (lines 76-79 in plan_helper.py, lines 62-75 in append_log.py) and are scoped to the project directory as documented. This is necessary for the skill's purpose of maintaining project context.
Facteurs de risque
📁 Accès au système de fichiers (3)
Version de l’audit 1
Risque faibleJan 10, 2026, 12:02 PM
Pure prompt-based Claude skill with two local utility scripts. Scripts access local filesystem only within project root with proper path traversal protection. No network calls, no credential access, no external command execution. Minimal security footprint with Python standard library only.
11
Fichiers analysés
699
Lignes analysées
2
résultats
claude
Audité par
Problèmes à risque faible (1)
Local filesystem access in utility scripts
Both Python scripts access the local filesystem to create and write files within the project root. append_log.py creates `.ai_context/03_ACTIVE_TASK.md` and appends log entries. plan_helper.py writes plan templates to files. These operations include path traversal protection (lines 76-79 in plan_helper.py, lines 62-75 in append_log.py) and are scoped to the project directory as documented. This is necessary for the skill's purpose of maintaining project context.