Audit History
subagent-driven-development - 8 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v8 Latest | 5 juil. 2026, 06:16 | No confirmed findings | 0 | No capability change |
| v7 | 5 juil. 2026, 06:16 | No confirmed findings | 0 | No capability change |
| v6 | 29 juin 2026, 00:32 | No confirmed findings | 2 | No capability change |
| v5 | 16 janv. 2026, 21:47 | No confirmed findings | 0 | No capability change |
| v4 | 16 janv. 2026, 21:47 | No confirmed findings | 0 | External commandsFilesystem access |
| v3 | 10 janv. 2026, 12:37 | No confirmed findings | 0 | No capability change |
| v2 | 10 janv. 2026, 12:37 | No confirmed findings | 0 | No capability change |
| v1 | 10 janv. 2026, 12:37 | No confirmed findings | 0 | Baseline |
5 juil. 2026, 06:16
All static findings were adjudicated as false positives caused by Markdown examples, fenced blocks, template file references, and review checklist wording. I found no evidence of malicious prompt injection, credential access, data exfiltration, or unsafe command execution intent in the cited files.
Risk Factors
📁 Filesystem access (2)
⚙️ External commands (6)
5 juil. 2026, 06:16
All static findings were adjudicated as false positives caused by Markdown examples, fenced blocks, template file references, and review checklist wording. I found no evidence of malicious prompt injection, credential access, data exfiltration, or unsafe command execution intent in the cited files.
Risk Factors
📁 Filesystem access (2)
⚙️ External commands (6)
29 juin 2026, 00:32
Static findings for weak cryptography and system reconnaissance are false positives from SHA tracking examples and review checklist text. The skill is not malicious, but it intentionally guides agents to run git commands, tests, commits, and possibly reviewer verification commands.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Risk Factors
⚙️ External commands (20)
📁 Filesystem access (2)
Detected Patterns
16 janv. 2026, 21:47
Pure prompt-based skill containing only markdown documentation and prompt templates. No executable code, scripts, network operations, or file access capabilities exist. The skill provides workflow guidance for managing subagent development cycles. All 53 static findings are false positives caused by pattern matching on documentation text rather than actual security threats.
Risk Factors
⚙️ External commands (20)
📁 Filesystem access (2)
16 janv. 2026, 21:47
Pure prompt-based skill containing only markdown documentation and prompt templates. No executable code, scripts, network operations, or file access capabilities exist. The skill provides workflow guidance for managing subagent development cycles. All 53 static findings are false positives caused by pattern matching on documentation text rather than actual security threats.
Risk Factors
⚙️ External commands (20)
📁 Filesystem access (2)
10 janv. 2026, 12:37
This is a pure prompt-based skill containing only markdown documentation and prompt templates. No executable code, scripts, network operations, or file access capabilities exist. The skill provides workflow guidance for managing subagent development cycles.
10 janv. 2026, 12:37
This is a pure prompt-based skill containing only markdown documentation and prompt templates. No executable code, scripts, network operations, or file access capabilities exist. The skill provides workflow guidance for managing subagent development cycles.
10 janv. 2026, 12:37
This is a pure prompt-based skill containing only markdown documentation and prompt templates. No executable code, scripts, network operations, or file access capabilities exist. The skill provides workflow guidance for managing subagent development cycles.