This report does not block or authorize the manifest or ZIP.
Static analysis reported many high-risk patterns, but most are Markdown code fences and API names in plugin-development examples rather than executable skill code. No prompt injection or confirmed malicious intent was found. Medium risk remains because the guidance includes examples for external API calls, environment secrets, shell-based plugin installation, and writing exports to user-supplied paths.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
5 Files scanned · 1,914 Lines analyzed
3 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Generated Plugin Example Sends Dataset Paths to External APIs
The Python operator guide includes a sample external API integration that reads an API key from plugin secrets and sends sample file paths to an external endpoint. This is a legitimate plugin pattern, but generated plugins using it can expose local dataset paths and derived data to third-party services if users do not review the endpoint and payload.
The example directly combines ctx.secrets with an outbound requests.post call and sample.filepath data. The endpoint is an example domain and the content is documentation, so malicious intent is not confirmed.
Generated Export Example Writes to User-Supplied Paths
The label exporter example accepts output_path from operator parameters, expands the user directory, and writes JSON to that path. This supports a valid export workflow, but generated plugins should validate paths or clearly ask for confirmation before writing files.
The file write is explicit and the path comes from user input. The operation is visible and part of an exporter example, so the risk is misuse or accidental overwrite rather than confirmed abuse.
Credential and Secret Findings Are Plugin Configuration Examples
The skill discusses FiftyOne plugin secrets and environment variables so generated plugins can use user-provided API credentials. This is expected for plugin development, but users should only add secrets for services they trust.
Secret access is clearly documented and not hidden. It becomes sensitive only when a generated plugin combines secrets with unreviewed network behavior.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Shell Command Findings Are Markdown Development Examples
The static analyzer matched shell commands for installing, copying, symlinking, and testing plugins. These commands are shown in documentation code fences and are not executed by the skill itself.
The commands are inside Markdown examples for local development workflows. I found no wrapper, script, or instruction that silently executes them.
Sensitive File and Weak Crypto Matches Are Naming False Positives
Static matches for Windows SAM, certificate keys, and weak cryptography occur in unrelated identifiers or common words such as sample placement names and dictionary key access. No evidence of credential dumping or cryptographic implementation was found.
The cited lines refer to FiftyOne UI placement constants and Python dictionary keys. I found no code that opens SAM files, reads private keys, or implements MD5 or SHA-1.