This report does not block or authorize the manifest or ZIP.
Static analysis reported many command execution, weak crypto, environment, and network patterns. Review found the command and weak-crypto alerts are mainly Markdown command examples, schema examples, and inline identifiers, not executable skill code. The confirmed risk is medium because the skill instructs agents to run external CLI workflows, call managed Google evaluation services, and use local custom metric code that can execute with CLI privileges.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
6 Files scanned · 1,248 Lines analyzed
3 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Managed Evaluation Workflows May Send Data To Google Services
The skill recommends dataset synthesis, server-side grading, and managed eval submission workflows. These are intended product features, but evaluation datasets and traces can contain sensitive prompts, tool outputs, or agent behavior, so users need data governance before using cloud-side commands.
The files clearly describe server-side scenario generation and managed eval submission. This is expected network behavior, but sensitive trace data could be transmitted if users run those workflows.
Environment Variable Example Uses A Mock API Key Pattern
The environment access finding points to sample Python documentation that reads EXTERNAL_API_KEY and returns a mock response when the key is missing or set to a dummy value. I did not find evidence that the skill exfiltrates or stores secrets.
The code is a documented mock-mode example and contains no outbound request in the shown block. It still teaches credential handling, so it remains a minor review note.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
Local Custom Metric Code Executes With CLI Privileges
The skill documents CodeExecutionMetric custom_function blocks and explicitly notes that local execution runs with the CLI process privileges. This is legitimate evaluation functionality, but users must only run trusted metric code because it can access local files, credentials, and network resources available to the CLI.
The documentation directly describes local custom metric execution and states it uses CLI privileges. The risk depends on user-supplied metric code, so it is a strong warning rather than confirmed malicious behavior.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Static Command Execution Alerts Are Markdown Examples
The numerous Ruby or shell backtick findings correspond to inline Markdown code, fenced command examples, and agents-cli usage instructions. No executable script, hook, or bundled program in the reviewed files runs those commands automatically.
The reviewed locations are documentation text and fenced examples. The skill consists of Markdown reference material, so these static matches are false positives for automatic command execution.
The hardcoded URL findings are public documentation links to SDK source and Google or uv documentation. They are references for users, not hidden network endpoints or exfiltration destinations.
The URLs are visible Markdown links to expected documentation. No code path automatically calls these URLs.