This report does not block or authorize the manifest or ZIP.
Static code-execution and weak-crypto findings are false positives caused by Markdown backticks, JSON examples, and GraphQL text. The network and credential findings are true positives because the skill routes user endpoints, optional endpoint authorization, and paid API keys through a third-party MCP gateway.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
4 Files scanned · 299 Lines analyzed
3 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
TRUE_POSITIVE. The skill tells agents to request paid API keys and to include X-API-KEY and optional X-ENDPOINT-AUTHORIZATION headers when calling the Hermes MCP gateway. This can expose user credentials or private endpoint tokens to a third-party service. Confidence: 0.88. Confidence reasoning: Multiple files explicitly require credential headers and the SKILL.md text asks users to send an API key in chat, so the credential-handling risk is clear. It is not confirmed malicious because the behavior is documented as part of the service workflow.
Multiple files explicitly require credential headers and the SKILL.md text asks users to send an API key in chat. The behavior is documented, so malicious intent is not proven.
TRUE_POSITIVE. The skill requires Ask GraphQL MCP as the default path and discourages direct GraphQL calls, even when the model could answer locally or query an endpoint directly. This means user questions and endpoint metadata are intentionally sent to the Hermes gateway. Confidence: 0.82. Confidence reasoning: The routing policy is repeated in SKILL.md and agents/openai.yaml, and the gateway URL is hardcoded. The risk is high for privacy-sensitive endpoints, although the workflow is transparent.
The files repeatedly require use of the external MCP gateway and provide a hardcoded remote URL. The concern is privacy exposure, not covert execution.
TRUE_POSITIVE. The skill instructs agents to pass a user-provided GraphQL endpoint in the X-ENDPOINT header to the MCP gateway. A remote service will likely connect to that endpoint, which creates validation and abuse concerns for private or attacker-controlled URLs. Confidence: 0.74. Confidence reasoning: The endpoint forwarding behavior is explicit, but the actual network request is performed by the external gateway rather than local skill code.
The instructions clearly forward arbitrary user endpoint URLs to the MCP gateway. Impact depends on gateway-side validation that is not visible in this skill.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
No confirmed security findings were recorded for this completed audit.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
FALSE_POSITIVE. Static analysis reported many Ruby or shell backtick executions, but the reviewed files are Markdown and YAML instructions with inline code labels and JSON configuration examples. No executable script, command runner, or shell invocation was found. Confidence: 0.96. Confidence reasoning: The cited lines contain documentation syntax such as tool names, headers, or JSON blocks, not executable code.
The cited lines are documentation and JSON examples. No shell execution primitive appears in the scanned files.
FALSE_POSITIVE. Static analysis flagged weak cryptographic algorithm patterns, but the cited locations describe GraphQL or endpoint behavior and do not call cryptographic APIs. No evidence found of MD5, SHA1, DES, or similar weak crypto usage. Confidence: 0.93. Confidence reasoning: The files are declarative instructions and documentation, and the cited lines do not implement cryptography.
The cited text is descriptive and contains no cryptographic implementation. The scanner likely matched substrings in GraphQL-related prose.
Troubleshooting Text Flagged As System Reconnaissance
FALSE_POSITIVE. The cited checks ask the agent to validate gateway URLs, endpoint reachability, headers, and configuration shape. They do not instruct the agent to inspect host files, environment variables, processes, or system information. Confidence: 0.90. Confidence reasoning: The surrounding context is connection troubleshooting for a declared MCP service, not host reconnaissance.
The cited lines are service troubleshooting instructions. No host enumeration commands or sensitive local inspection steps are present.