Most detections are Markdown formatting, fixed documentation links, or fixed local path resolution. One documented shell invocation accepts a supplied subject ID without showing quoting or argument-array handling, which can create command-injection risk if copied into a shell. No prompt-injection or data-exfiltration intent was found.
1
Files scanned
80
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
2. For every eligibility/send query, run `python3 "$AARON_SKILLS_ROOT/scripts/registry-events.py" is
The documented shell command inserts a supplied subject ID as an unquoted argument. An unsafe invocation could permit shell metacharacter injection unless the host uses argument arrays or validates the ID.
Most detections are Markdown formatting, fixed documentation links, or fixed local path resolution. One documented shell invocation accepts a supplied subject ID without showing quoting or argument-array handling, which can create command-injection risk if copied into a shell. No prompt-injection or data-exfiltration intent was found.
1
Files scanned
80
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
2. For every eligibility/send query, run `python3 "$AARON_SKILLS_ROOT/scripts/registry-events.py" is
The documented shell command inserts a supplied subject ID as an unquoted argument. An unsafe invocation could permit shell metacharacter injection unless the host uses argument arrays or validates the ID.
Most static findings are Markdown formatting, repository links, metadata URLs, or a safe fixed Git command. The skill does invoke a repository Python utility and permits broad deny-only suppression, creating bounded execution and integrity risks.
Any validated producer may immediately suppress a subject without owner capability. A compromised producer could alter contact eligibility at scale.
The document explicitly permits any validated producer to append immediate deny-only suppression and acknowledges that a bad producer can cause non-contact.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
2. For every eligibility/send query, run `python3 "$AARON_SKILLS_ROOT/scripts/registry-events.py" is
Line 51 directs the agent to execute a Python script selected through AARON_SKILLS_ROOT with a user-supplied subject identifier. Root validation and argument-safe invocation are required to prevent unintended execution.
Most static findings are Markdown formatting, repository links, metadata URLs, or a safe fixed Git command. The skill does invoke a repository Python utility and permits broad deny-only suppression, creating bounded execution and integrity risks.
Any validated producer may immediately suppress a subject without owner capability. A compromised producer could alter contact eligibility at scale.
The document explicitly permits any validated producer to append immediate deny-only suppression and acknowledges that a bad producer can cause non-contact.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
2. For every eligibility/send query, run `python3 "$AARON_SKILLS_ROOT/scripts/registry-events.py" is
Line 51 directs the agent to execute a Python script selected through AARON_SKILLS_ROOT with a user-supplied subject identifier. Root validation and argument-safe invocation are required to prevent unintended execution.
Most findings are false positives caused by Markdown code formatting, relative documentation links, and metadata URLs. The skill does direct agents to resolve a project root with shell substitution and invoke a Python script with an unquoted user-supplied subject identifier, creating genuine command execution risk.
1
Files scanned
80
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
2. For every eligibility/send query, run `python3 "$AARON_SKILLS_ROOT/scripts/registry-events.py" is
Line 51 directs execution of a Python script and leaves the user-supplied subject identifier unquoted. Shell metacharacters in an identifier could become command injection if substituted directly.
1. Read [`registry-event-protocol.md`](../../references/registry-event-protocol.md) and [`runtime-in
Line 50 explicitly directs the agent to resolve a root by executing git inside shell command substitution. Although the purpose is legitimate, it causes external command execution.
Most static findings are false positives from Markdown backticks, relative documentation links, and homepage metadata. One real medium-risk issue remains: an optional live Resend connector command can mutate external suppression state. The skill also handles persistent subscriber consent records, so privacy minimization and retention controls are required.
The skill documents a Resend connector command with --live to mirror opt-outs to the email platform. This can change external subscriber state and needs explicit confirmation and safe argument handling.
Line 67 directly shows a live connector command for Resend suppression. The action is scoped to opt-outs, but it has external side effects.
The skill writes per-subject consent records and event history under memory/consent. These records can include subscriber identifiers and compliance proof, so minimization and retention controls are important.
Lines 46 and 90-92 describe durable per-subject records and first-write confirmation. The privacy risk is inherent to the stated registry function.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency downstream sync (when Resend is the ESP)**: after an opt-out is recorded here, `py
Line 67 documents a python3 connector command with --live that can mutate Resend suppression state. It is optional and scoped, but it is real external command execution with external side effects.
The audit confirms one contextual risk: line 67 documents an optional live Resend connector command that can mutate an external ESP roster. The remaining static findings are false positives caused by Markdown backticks, repository-relative links, homepage metadata, and documentation wording. No prompt-injection attempt or data-exfiltration instruction was found in SKILL.md.
1
Files scanned
108
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency downstream sync (when Resend is the ESP)**: after an opt-out is recorded here, `py
Line 67 documents a python3 Resend connector command with --live, which can mutate an external ESP roster. It is scoped to opt-out syncing and described as optional, but live execution needs explicit user authorization.