This report does not block or authorize the manifest or ZIP.
Static external command findings are partly confirmed because scripts/run_training.py executes a user-selected training command. Weak cryptography and Ruby backtick detections are false positives from prose, Markdown formatting, and file names. The skill is publishable with warnings for trusted repositories and explicit user-approved commands only.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
5 Files scanned · 496 Lines analyzed
3 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
TRUE_POSITIVE: scripts/run_training.py executes the selected --command value with subprocess.run. It uses shlex.split and does not use shell=True, which reduces shell injection, but the selected command can still run arbitrary executables in the target repository.
The subprocess.run call receives arguments derived from the required --command input. This is intended behavior for a training runner, but it is still real command execution.
TRUE_POSITIVE: scripts/write_outputs.py dynamically loads a shared writer module from a parent directory. No malicious intent is shown, but runtime behavior depends on code outside this skill package.
The path construction and exec_module call are explicit. The risk is contextual because the path is layout-derived rather than attacker-controlled in the shown code.
TRUE_POSITIVE with limited severity: SKILL.md instructs the agent to use parent-directory reference files. This can expand the trusted instruction surface beyond the reviewed skill files, although no prompt injection was found in the reviewed files.
The relative parent references are visible in SKILL.md. The security impact depends on the unreviewed external reference files, so confidence is medium.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
No confirmed security findings were recorded for this completed audit.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Weak Cryptography Static Detections Are False Positives
FALSE_POSITIVE: the flagged locations contain descriptions, policy prose, or an argparse description. No cryptographic algorithm use was found at these lines.
The reviewed lines do not call hash functions or cryptographic APIs. The scanner appears to have matched substrings in natural language or filenames.
Ruby Backtick Static Detections Are False Positives
FALSE_POSITIVE: the flagged Markdown lines use backticks for field names, file names, and references. No Ruby code or shell backtick execution exists at those locations.
The backticks are Markdown inline-code formatting, not executable Ruby syntax. The surrounding content is documentation.
Git Status Collection Is Expected Repository Inspection
FALSE_POSITIVE for malicious reconnaissance: scripts/run_training.py runs fixed git status commands to record files changed by training. The arguments are hardcoded and support reproducibility evidence.
The git commands are fixed and local to the supplied repository. This still inspects repository state, but the purpose matches the skill description.