This report does not block or authorize the manifest or ZIP.
Static analysis reported 757 patterns and a risk score of 100/100, but most hits are false positives from Markdown backticks, Chinese documentation, and schema examples. Confirmed risks are legitimate for a skill creation and evaluation tool: local subprocess execution, local file packaging, HTML rendering with innerHTML, local HTTP viewer behavior, and outbound Anthropic API calls for description optimization. No prompt injection attempt or malicious exfiltration intent was found during review.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
22 Files scanned · 6,602 Lines analyzed
6 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
External command execution for evaluation workflows
TRUE_POSITIVE. scripts/run_eval.py launches the Claude CLI with subprocess.Popen, and generate_review.py runs lsof before terminating local port listeners. Arguments are structured lists, not shell strings, so command injection risk is reduced. The behavior still executes local commands and should be disclosed to users.
The subprocess calls are direct and semantically confirmed. The commands serve the stated evaluation and viewer workflows, so this is a controlled but real execution risk.
HTML report viewer renders dynamic content with innerHTML
TRUE_POSITIVE. The review UI assigns generated evaluation data and spreadsheet HTML into innerHTML. Some text paths escape content, but spreadsheet and assembled HTML paths can render untrusted output if a malicious eval artifact is loaded.
The innerHTML assignments are present in active viewer code. Practical risk depends on whether loaded eval files are trusted, so confidence is high for the pattern and moderate for exploitability.
Skill packaging can archive broad local file trees
TRUE_POSITIVE. scripts/package_skill.py resolves a user-supplied skill path and writes all included files into a .skill archive, excluding only a small set of build artifacts. This is expected packaging behavior, but an incorrect path could include sensitive local files.
The archive behavior is explicit and legitimate. Sensitive-file exposure is possible only through user-selected paths or poorly scoped skill directories.
Description optimizer sends skill content to Anthropic API
TRUE_POSITIVE. scripts/improve_description.py builds prompts containing skill content, current descriptions, and eval failures, then calls the Anthropic client. This is useful for optimization, but users should know proprietary seller workflows may leave the local machine.
The API call and prompt assembly are clear in code. Risk depends on the confidentiality of the skill content and eval examples supplied by the user.
Local viewer can run as a background process and terminate port listeners
TRUE_POSITIVE. SKILL.md documents a nohup command that starts a local review viewer from a hidden home-directory skill path. generate_review.py also terminates processes listening on the selected port. This is useful, but it affects local process state.
The documented background launch and local port cleanup are explicit. They are not malicious, but users should understand the process-management side effects.
NEEDS_REVIEW but low risk. scripts/run_eval.py copies os.environ while removing CLAUDECODE for nested Claude CLI use. This may pass existing environment variables to the child process, but no evidence found of logging or exfiltrating them.
Environment access is confirmed and common for subprocess use. No evidence found that secrets are read by name or transmitted separately.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
No confirmed security findings were recorded for this completed audit.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
FALSE_POSITIVE for external network exfiltration. The fetch calls target /api/feedback in the local review viewer and save user review state. They are not hardcoded third-party endpoints.
The URLs are relative local API paths. No evidence found that these fetch calls contact a third-party host.
FALSE_POSITIVE for malicious filesystem behavior. scripts/run_loop.py writes a temporary HTML report so users can monitor optimization progress. It uses the system temporary directory and a generated filename.
The temp-file behavior is visible and tied to reporting. No evidence found of persistence, privilege escalation, or hidden payload storage.