This report does not block or authorize the manifest or ZIP.
Static analysis reported command execution, network, credential, weak crypto, reconnaissance, and combined-danger patterns. Most are false positives from Markdown code fences, database client examples, API-key parameters, and documentation links; however, the pgvector template interpolates metadata keys into SQL and should be published with a security warning.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
1 Files scanned · 559 Lines analyzed
1 item shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
TRUE POSITIVE semantic issue. The pgvector search example parameterizes filter values but interpolates metadata keys directly into a SQL condition. If copied into an application that accepts user-controlled filter keys, this can permit SQL injection or query manipulation. No malicious intent or exfiltration behavior was found.
The SQL value is parameterized, but the metadata key is inserted with string formatting before query execution. This is a clear copy-paste vulnerability when filter keys can come from untrusted input.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
External Command Findings Are Markdown Fence False Positives
FALSE POSITIVE. The reported Ruby or shell backtick execution locations are Markdown code fence delimiters around documentation examples, not executable code paths. No shell execution API or command invocation was found in the inspected skill file.
The suspicious tokens are the opening and closing triple-backtick fences in Markdown. The surrounding content is explanatory Python sample code, not a runnable installer or script.
Network Findings Are Client Examples and Documentation Links
FALSE POSITIVE for malicious networking. The conn.fetch calls are PostgreSQL database reads, the Weaviate URL defaults to localhost, and the hardcoded URLs are public documentation links. These examples may contact configured vector services if used by a developer, but they do not exfiltrate data from the skill itself.
The network-related lines are either database client method calls or reference links. No credential-bearing request to an unexpected external endpoint was found.
FALSE POSITIVE for secret harvesting. The Pinecone example accepts an api_key parameter and passes it to the official client constructor. The skill does not read environment variables, enumerate secrets, log keys, or send keys to an unrelated endpoint.
The key is a constructor argument in sample code and is only passed to Pinecone(api_key=api_key). There is no process environment access or unauthorized transmission pattern.
Weak Crypto and Reconnaissance Findings Are Scanner Noise
FALSE POSITIVE. The weak-crypto and system-reconnaissance detections do not correspond to cryptographic operations, host enumeration, or sensitive system discovery in the inspected context. The relevant lines are metadata, SQL setup, joins, or general best-practice text.
Manual review found no md5, sha1, host probing, environment discovery, or similar sensitive behavior at these locations. The static labels appear triggered by unrelated words and SQL syntax.
FALSE POSITIVE for malicious intent. The static tool combined code-fence, network, and API-key parameter detections into a critical heuristic, but manual review found a documentation-only skill with no executable installer, no prompt injection attempt, and no data exfiltration flow.
The file contains only Markdown guidance and examples. The heuristic ingredients are explainable as documentation constructs, though the SQL filter issue remains a real medium-risk example vulnerability.