سجل التدقيق

الإصدار	التاريخ	النتيجة	عناصر المراجعة	التغيير مقارنةً بالسابقة
v4 الأحدث	5 июл. 2026 г., 19:43	1 مؤكَّد	0	لا تغيير في القدرات
v3	5 июл. 2026 г., 19:43	1 مؤكَّد	0	لا تغيير في القدرات
v2	30 июн. 2026 г., 07:46	لا توجد نتائج مؤكَّدة	3	الأوامر الخارجيةالوصول إلى الشبكةمتغيرات البيئةالوصول إلى نظام الملفات
v1	15 февр. 2026 г., 08:42	لا توجد نتائج مؤكَّدة	0	الأساس

5 июл. 2026 г., 19:43

Static findings are almost entirely documentation examples, Markdown formatting, official documentation URLs, localhost references, or placeholder environment variable usage. I found no prompt injection or hidden execution logic, but the setup guide does encourage users to provide an API key to the AI agent, which is a real secret-handling risk.

6

الملفات التي تم فحصها

1,416

الأسطر التي تم تحليلها

5

عناصر المراجعة

0

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (1)

مرتفع

references/create-mastra.md:13-15 references/create-mastra.md:107-115

API Key Disclosure Encouraged During Automatic Setup

The setup guide offers an automatic setup option where the user gives the AI agent an API key. This can encourage users to paste real provider credentials into chat instead of storing them locally.

The wording explicitly asks for an API key for automatic setup, and later instructs creating a .env file with provider keys. This is a clear secret-handling risk, although there is no evidence of exfiltration code.

عوامل الخطر

⚙️ الأوامر الخارجية (35)

🌐 الوصول إلى الشبكة (17)

references/common-errors.md:511 references/common-errors.md:373 references/migration-guide.md:51 references/remote-docs.md:56 references/remote-docs.md:62 references/remote-docs.md:79 references/remote-docs.md:96 references/remote-docs.md:97 references/remote-docs.md:105 references/remote-docs.md:154 references/remote-docs.md:164 references/remote-docs.md:171 SKILL.md:8 SKILL.md:40 SKILL.md:66 SKILL.md:149 SKILL.md:159

🔑 متغيرات البيئة (18)

📁 الوصول إلى نظام الملفات (1)

references/create-mastra.md:146

دقّقه: codex

إصدار التدقيق 3

5 июл. 2026 г., 19:43

Static findings are almost entirely documentation examples, Markdown formatting, official documentation URLs, localhost references, or placeholder environment variable usage. I found no prompt injection or hidden execution logic, but the setup guide does encourage users to provide an API key to the AI agent, which is a real secret-handling risk.

6

الملفات التي تم فحصها

1,416

الأسطر التي تم تحليلها

5

عناصر المراجعة

0

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (1)

مرتفع

references/create-mastra.md:13-15 references/create-mastra.md:107-115

API Key Disclosure Encouraged During Automatic Setup

The setup guide offers an automatic setup option where the user gives the AI agent an API key. This can encourage users to paste real provider credentials into chat instead of storing them locally.

The wording explicitly asks for an API key for automatic setup, and later instructs creating a .env file with provider keys. This is a clear secret-handling risk, although there is no evidence of exfiltration code.

عوامل الخطر

⚙️ الأوامر الخارجية (35)

🌐 الوصول إلى الشبكة (17)

references/common-errors.md:511 references/common-errors.md:373 references/migration-guide.md:51 references/remote-docs.md:56 references/remote-docs.md:62 references/remote-docs.md:79 references/remote-docs.md:96 references/remote-docs.md:97 references/remote-docs.md:105 references/remote-docs.md:154 references/remote-docs.md:164 references/remote-docs.md:171 SKILL.md:8 SKILL.md:40 SKILL.md:66 SKILL.md:149 SKILL.md:159

🔑 متغيرات البيئة (18)

📁 الوصول إلى نظام الملفات (1)

references/create-mastra.md:146

دقّقه: codex

إصدار التدقيق 2

30 июн. 2026 г., 07:46

Static analysis reported many command, network, filesystem, and secret-related patterns, but review found them in Markdown setup and troubleshooting examples rather than executable skill code. The skill is publishable with a medium warning because it guides package installation, project file creation, local documentation reads, remote documentation fetches, and API key configuration.

6

الملفات التي تم فحصها

1,416

الأسطر التي تم تحليلها

7

عناصر المراجعة

1

تم تجاهل الإيجابيات الكاذبة

عناصر مراجعة القدرات (3)

هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.

متوسط

references/create-mastra.md:25-68 references/create-mastra.md:187-193 references/migration-guide.md:48-64 references/common-errors.md:385-393

Project Setup Commands and Package Installation

The skill recommends commands such as npm create, npm install, npm run dev, npx codemod, mkdir, and docker run. These are legitimate Mastra development steps, but they can modify the workspace, install third-party packages, start services, or run package scripts, so users should approve commands before execution.

The commands are clearly present in Markdown examples and are useful for the stated framework workflow. Confidence is high that they are operationally risky but not malicious because no hidden execution path exists in the skill files.

متوسط

references/create-mastra.md:107-115 references/common-errors.md:396-406 references/common-errors.md:430-448

API Key and Environment File Guidance

The skill instructs users to create .env files and configure provider API keys for Mastra projects. This is expected for LLM applications, but it increases secret-handling risk if assistants echo keys, commit .env files, or transmit credentials while fetching documentation.

The referenced lines explicitly mention .env files, API key names, and process.env usage. The examples do not exfiltrate secrets, so the finding is a medium-risk handling concern rather than confirmed abuse.

متوسط

SKILL.md:62-71 references/remote-docs.md:22-33 references/remote-docs.md:148-173

Remote Documentation Fetching

The skill directs assistants to use Mastra documentation URLs and WebFetch for current API information. These requests are to official documentation endpoints, but the behavior still requires network access and could expose query prompts to the documentation service.

Network guidance is explicit and repeated, with WebFetch examples limited to mastra.ai documentation. Confidence is high for legitimate network use and medium for user-data exposure risk because prompt contents depend on future use.

تم تجاهل الإيجابيات الكاذبة الثابتة (1)

تم تجاهل هذه المطابقات الثابتة بواسطة المراجعة الدلالية أو لأنها طابقت رموزًا خاصة بالمخطط فقط، لذا تُعرض للشفافية لكنها لا تؤثر في درجة الجودة.

منخفض

SKILL.md:23-56 references/embedded-docs.md:24-87 references/common-errors.md:368-399 references/create-mastra.md:140-164

Static Analyzer False Positives in Markdown Examples

Most reported Ruby backtick execution, weak cryptography, hardcoded IP, path traversal, and reconnaissance patterns are Markdown code fences, filenames, model names, localhost examples, or troubleshooting text. No executable Ruby, shell wrapper, obfuscated payload, or malicious control flow was found in the reviewed skill files.

The scanner matched documentation syntax and example text rather than executable source files. Confidence is high because all reviewed hits are in Markdown references and no separate scripts are present.

عوامل الخطر

⚙️ الأوامر الخارجية (4)

SKILL.md:25-27 references/create-mastra.md:25-68 references/migration-guide.md:48-64 references/common-errors.md:385-393

🌐 الوصول إلى الشبكة (3)

SKILL.md:62-71 references/remote-docs.md:22-47 references/remote-docs.md:148-173

🔑 متغيرات البيئة (3)

references/create-mastra.md:107-115 references/common-errors.md:396-406 references/common-errors.md:430-448

📁 الوصول إلى نظام الملفات (3)

SKILL.md:48-56 references/embedded-docs.md:34-53 references/create-mastra.md:71-119

الأنماط المكتشفة

External Commands in DocumentationLocal File Reads and Project File Creation Guidance

دقّقه: codex

إصدار التدقيق 1

15 февр. 2026 г., 08:42

This is a documentation/reference skill providing guidance on the Mastra framework. All static findings are false positives: (1) Backtick patterns are markdown code block delimiters in documentation, not shell commands. (2) Hardcoded URLs are legitimate documentation links. (3) Environment variable patterns are code examples showing configuration. (4) Cryptographic references are documentation content. No actual security risks present.

6

الملفات التي تم فحصها

1,416

الأسطر التي تم تحليلها

0

عناصر المراجعة

0

تم تجاهل الإيجابيات الكاذبة

لم تُسجّل نتائج أمنية مؤكدة لهذا التدقيق المكتمل.

دقّقه: claude

مقارنة الإصدارات

مخاوف أمنية مؤكدة (1)

عوامل الخطر

مخاوف أمنية مؤكدة (1)

عوامل الخطر

عوامل الخطر

الأنماط المكتشفة